Skip to content
Trust no request
Security series · stage 2 of 2 · 10 chapters · 229 minutes

Trust no request

Stage 2 of a hands-on security series. One small Python service on your own machine, ten real web weaknesses, and a check that proves each fix: SQL injection, XSS, CSRF, IDOR, broken access control, SSRF, path traversal, mass assignment and open redirects.

Start chapter 01Get the lab on GitHub

New here? Stage 1, How systems talk, covers DNS, TLS, cookies and sessions. This stage is the application on top.

POST /loginone input, two readings: data or code

built from text

SELECT id FROM users WHERE email = 'x' OR '1'='1' -- ' AND password = 'anything'
Bypassed: signed in as u_10413 rows

bound parameters

SELECT id FROM users WHERE email = ? AND password = ? -- bound: [email, password]
Rejected0 rows

The same input. On the left it is pasted into the query text, so a quote can end the string and the rest becomes query. On the right it is bound as a value, so it only ever matches a row or does not.

The lab

Ten cases, one per chapter

Each case is one small service with one deliberate weakness, an attack that runs only on 127.0.0.1, a fix you write, and a check that rejects the lazy non-fix. Grouped from the foundations to what senior engineers still get wrong.

01

Foundations

Untrusted input becomes code: injection and cross-site scripting.

  1. 01 · SQL injection25 min

    The quote that rewrote the query

    One crafted email signs in as the admin with no password: 200, user u_1099.

    uv run python -m trust run 1

  2. 02 · Reflected XSS22 min

    The search box that ran its input

    A <script> in the query comes straight back in the page, ready to run.

    uv run python -m trust run 2

  3. 03 · Stored XSS22 min

    The comment that ran on every visit

    A saved comment carries an onerror payload that runs for every later visitor.

    uv run python -m trust run 3

02

Access and identity

Who may touch what: object and function access, forged requests, over-posting.

  1. 04 · IDOR22 min

    The invoice with someone else's name on it

    u_1041 reads u_1042's confidential invoice by changing the number in the URL.

    uv run python -m trust run 4

  2. 05 · Broken access control22 min

    The admin page with no lock on the door

    A member gets the admin user list, with every API token, by typing the URL.

    uv run python -m trust run 5

  3. 06 · CSRF24 min

    The form that any site could submit

    A forged POST with no token changes the account email to attacker@evil.test.

    uv run python -m trust run 6

  4. 07 · Mass assignment22 min

    The profile update that granted admin

    A display-name edit that also sends role=admin makes a member an admin.

    uv run python -m trust run 7

03

Server-side and redirects

The server acting on a request: its network, its files, and where it sends you.

  1. 08 · SSRF26 min

    The fetch that reached the metadata service

    The avatar importer fetches an internal URL and returns a root token.

    uv run python -m trust run 8

  2. 09 · Path traversal22 min

    The download that climbed out of its folder

    A name of ../secret.key reads a file beside the reports folder.

    uv run python -m trust run 9

  3. 10 · Open redirect22 min

    The login link that pointed off-site

    A trusted login link with next=//acme.evil.test redirects the user off-site.

    uv run python -m trust run 10

Measured by the lab

Numbers from real runs

The four try experiments measure the attacks and the defences on your own machine. These figures come from the runs the workshop was written from.

3
Tokens dumped through the login

every user token recovered in 3 requests and 581 bytes (try exfiltrate)

3 of 3
Rows a string-built query leaks

the OR-always-true email returns every user; bound parameters return 0 (try inject)

142,144
Collisions in 200,000 weak tokens

a predictable scheme repeats; token_urlsafe(24) repeats 0 times (try tokens)

3 of 6
Internal URLs a blocklist lets through

an allowlist lets 0 of 6 through on the same URLs (try ssrf)

Quick start

You need uv and git

uv installs Python for you, and the lab uses only Python's standard library. Every service binds to 127.0.0.1 and nothing leaves your machine.

shell
git clone https://github.com/jars-demo/web-security-demo.git
cd web-security-demo/lab
uv sync
uv run python -m trust run 1

The series

  1. Stage 1

    How systems talk

    Stage 1

  2. Stage 2

    Trust no request

    You are here