This repo contains the code for my Secure Code Review challenges.
Those marked with 🔴🎬 have a YouTube walkthrough available (you can find the link in the ./solution.md
in the challenge folder).
- Open Redirect 🔴🎬
- Server-side Request Forgery 🔴🎬
- Weak Password Hashing
- Hardcoded Credentials
- XML External Entity Attack 🔴🎬
- Cross-site Scripting
- Host Header Injection 🔴🎬
- Nginx Off-By-Slash
- Broken Access Control (IDOR) 🔴🎬
- Broken Access Control (JWT missing verification)
- Path Normalization Bypass
- Unquoted Bash Variables
- SQL Injection
- Race Condition
- HTTP Response Splitting
- RCE via File Upload
- OS Command Injection
- Insecure Deserialization
- Server-side Template Injection
- Local File Inclusion (Path Traversal)
- CORS Misconfiguration (Reflected Origin header)
- Eval Injection
- Unsafe Reflection
- XSLT Injection
- NoSQL Injection
- ...
- ...
- ...
- ...