Web security
Seven holes in one small website: a leaked flag in the page source, another customer’s receipt, a hidden admin page, a cookie you can edit, a login you can walk past, a search box that runs your script, and a download that escapes its folder.
Briefing
You have a browser and one small website that was built wrong in seven places. Your job each time is to find a flag the site never meant to give you — by reading what the server really sent, changing a number, editing a cookie, or walking out of a folder.
You'll learn to
- Read a page's source and change parts of a request the server trusts
- Recognise broken access control: another user's record, a hidden page
- Walk past a login with SQL injection, and run a script with reflected XSS
- Escape a folder with path traversal — and state the one-line fix for each
Before you break into a websiteOptional warm-upHow a request and response work, what a cookie is, and why the request is yours to change. About ten minutes.Read the source
The browser shows you more than the page
Someone else’s receipt
When the only check is the number in the URL
The unlinked page
Hiding a door is not locking it
Edit your own pass
Never trust what the browser holds
Walk past the login
What your input does inside the query
Your script, their browser
A search box that runs what you type
Out of the folder
Two dots that walk up a directory
Patch the holes
The fix for each one, and where they bit in real life