Secure Coding Labs

Practice real-world secure coding scenarios through hands-on challenges and labs.

DOM Based Cross Site Scripting

medium CWE-79 python php javascript django laravel

DOM XSS occurs when untrusted input is read from a client-side source (e.g., document.location, document.referrer, window.name, or query parameters) and...

medium

Time of Check Time of Use

medium CWE-367 CWE-362 CWE-366 java go python typescript javascript

Time-of-Check to Time-of-Use (TOCTOU) is a race condition vulnerability that occurs when a resource is checked for a particular state,...

medium

HTTP Parameter Pollution

medium CWE-88 CWE-115 CWE-20 CWE-444 CWE-436 typescript javascript go python ruby

HTTP Parameter Pollution (HPP) is an instance of the broader Parser Differential vulnerability class. This occurs when different implementations of...

critical

Server Side Template Injection

critical battle CWE-96 CWE-74 CWE-94 go python java typescript javascript

Server-Side Template Injection (SSTI) occurs when untrusted input is embedded directly into a server-side template, causing the template engine to...

high

Mass Assignment

high CWE-915 CWE-639 CWE-285 CWE-471 typescript go csharp python java

Mass Assignment occurs when untrusted input is automatically bound or deserialised into program objects without properly restricting which fields can...

low

Missing Throttlling

low CWE-770 CWE-400 CWE-307 typescript java csharp python javascript

When applications fail to enforce throttling or rate limiting on incoming requests, adversaries can issue a large number of repetitive...

medium

Timing Attack

medium exploitation CWE-208 typescript java csharp python javascript

A timing attack is a side-channel vulnerability where an adversary gains information by measuring differences in the time an application...

low

Information Disclosure via Error Message

low CWE-209 CWE-204 CWE-210 CWE-200 typescript java csharp python javascript

Verbose Error Messages Excessively detailed error messages disclosed to end users may reveal sensitive information or enable secondary attacks. For...

low

Lack of Rate Limiting

low CWE-770 CWE-400 javascript go java csharp python

Without the use of rate limiting, an adversary can make numerous repetitive requests and quickly deplete the available resources. This...

No matching labs found

Try adjusting your search keywords or language filter.