Skip to content
Trust no request
Security series · stage 2

The chapters

One chapter per lab case, in order. Run each case with uv run python -m trust run N and check your fix with check N.

01

Foundations

Untrusted input becomes code: injection and cross-site scripting.

  1. 01 · SQL injection25 min

    The quote that rewrote the query

    One crafted email signs in as the admin with no password: 200, user u_1099.

    uv run python -m trust run 1

  2. 02 · Reflected XSS22 min

    The search box that ran its input

    A <script> in the query comes straight back in the page, ready to run.

    uv run python -m trust run 2

  3. 03 · Stored XSS22 min

    The comment that ran on every visit

    A saved comment carries an onerror payload that runs for every later visitor.

    uv run python -m trust run 3

02

Access and identity

Who may touch what: object and function access, forged requests, over-posting.

  1. 04 · IDOR22 min

    The invoice with someone else's name on it

    u_1041 reads u_1042's confidential invoice by changing the number in the URL.

    uv run python -m trust run 4

  2. 05 · Broken access control22 min

    The admin page with no lock on the door

    A member gets the admin user list, with every API token, by typing the URL.

    uv run python -m trust run 5

  3. 06 · CSRF24 min

    The form that any site could submit

    A forged POST with no token changes the account email to attacker@evil.test.

    uv run python -m trust run 6

  4. 07 · Mass assignment22 min

    The profile update that granted admin

    A display-name edit that also sends role=admin makes a member an admin.

    uv run python -m trust run 7

03

Server-side and redirects

The server acting on a request: its network, its files, and where it sends you.

  1. 08 · SSRF26 min

    The fetch that reached the metadata service

    The avatar importer fetches an internal URL and returns a root token.

    uv run python -m trust run 8

  2. 09 · Path traversal22 min

    The download that climbed out of its folder

    A name of ../secret.key reads a file beside the reports folder.

    uv run python -m trust run 9

  3. 10 · Open redirect22 min

    The login link that pointed off-site

    A trusted login link with next=//acme.evil.test redirects the user off-site.

    uv run python -m trust run 10