Secure Coding Labs

Practice real-world secure coding scenarios through hands-on challenges and labs.

S3 Versioning Not Enabled

if S3 object versioning is not enabled, tampering of objects will not be recoverable. This increases likelihood of denial of...

low

S3 Bucket Unencrypted

low aws terraform

If S3 bucket does not have server side encryption enabled, files are unencrypted at rest. This increase likelihood of data...

high

S3 Public ACLs Allowed

high aws terraform

If a S3 bucket does not block public policy, users are able to add a policy that enables public access....

informational

S3 Encryption Does Not Use Customer Managed Keys

informational aws terraform

Using default S3 encryption does not provide fine grained access control. A customer managed key provide more granular control over...

low

Insufficient Session Expiration

low CWE-613 ruby go python javascript sinatra

An authenticated session, especially statefull tokens, must expire after a period of time. Otherwise an adversary has higher chance of...

low

Token Reply Attack

low CWE-307 CWE-799 CWE-287 CWE-384 ruby python go javascript typescript

Authorization tokens used to establish initial trust must have a one-time-use property. Examples include tokens for password reset, multi-factor authentication...

medium

Cross Site Scripting

medium CWE-79 CWE-80 CWE-83 CWE-116 ruby typescript java csharp go

Cross-Site Scripting (XSS) occurs when untrusted input is incorporated into a web page without proper validation or output encoding. This...

medium

Integer Overflow

medium CWE-190 CWE-128 CWE-680 CWE-682 CWE-839 csharp typescript ruby python go

An integer (or numeric) overflow occurs when an arithmetic operation produces a value outside the representable range of the target...

No matching labs found

Try adjusting your search keywords or language filter.