🔐 Web Security Teaching Lab

A fully interactive React + FastAPI lab for teaching real web vulnerabilities with live exploitation demos.

⚠️ FOR LOCAL / ISOLATED USE ONLY — All endpoints are intentionally vulnerable.

---

📦 Vulnerabilities Covered

#	Attack	Severity	CWE
1	SQL Injection	CRITICAL	CWE-89
2	XSS (Reflected)	HIGH	CWE-79
3	XSS (Stored)	CRITICAL	CWE-79
4	IDOR	HIGH	CWE-639
5	Command Injection	CRITICAL	CWE-78
6	Directory Traversal	HIGH	CWE-22
7	CSRF	HIGH	CWE-352
8	Unrestricted File Upload	CRITICAL	CWE-434
9	Session Hijacking	HIGH	CWE-384
10	Clickjacking	MEDIUM	CWE-1021

---

🚀 Setup

Backend

cd backend

# Create virtual env (recommended)
python -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Run server
uvicorn main:app --reload --port 8000

Backend runs at: https://secapibackend.gadzit.lol
API docs at: https://secapibackend.gadzit.lol/docs

---

Frontend

cd frontend

# Install dependencies
npm install

# Start dev server
npm run dev

Frontend runs at: http://localhost:3000

---

🎓 Teaching Flow

Recommended order:

1. XSS Reflected → Instant visual impact (alert popup)
2. XSS Stored → Escalation: affects ALL users
3. SQL Injection → Logic manipulation, data exfiltration
4. IDOR → Most common real-world API flaw
5. Session Hijacking → Connects XSS to account takeover
6. CSRF → Social engineering + auth abuse
7. Command Injection → Scariest one — full server access
8. Directory Traversal → Server file exposure
9. File Upload → RCE via file system
10. Clickjacking → UI deception

For each attack:

• Show the vulnerable side → exploit it live
• Then switch to secure → show it blocked
• Read the code diff side by side

---

🔑 Test Credentials

Username	Password	Role
alice	hunter2	user
bob	password123	user
charlie	charlie99	user
admin	Sup3rS3cr3t!	admin

---

🛡 Features

• Live exploitation — all attacks work against the real backend
• Vulnerable vs Secure toggle — see exactly what changes
• Code diffs — side-by-side comparison
• Quick payloads — one-click injection presets
• Lab reset — restore to initial state anytime
• API status indicator — shows backend connectivity

---

⚙️ Structure

security-lab/
├── backend/
│   ├── main.py              # FastAPI with all vulnerable endpoints
│   ├── requirements.txt
│   ├── users.db             # SQLite (auto-created)
│   ├── lab_files/           # Files for traversal demo
│   └── uploads/             # Upload destination
└── frontend/
    ├── src/
    │   ├── App.jsx          # All pages in one file
    │   └── main.jsx
    ├── index.html
    ├── package.json
    └── vite.config.js