Inkwell — Web Security & Vulnerability Mitigation Demo

Course: WEB PROGRAMMING & APPLICATIONS — 503073
Topic: Topic 6 — Web Security & Vulnerability Mitigation
Semester: 2, Academic Year 2025–2026
Instructor: Dr. Van-Vang Le

---

Project Overview

Inkwell is a blogging platform built in two versions to demonstrate common web security vulnerabilities and their mitigations:

File	Description
vulnerable.html	Intentionally insecure version — contains XSS, SQL Injection, CSRF, plaintext passwords, missing CSP
inkwell-hardened.html	Fully hardened version — all vulnerabilities mitigated

The vulnerable version is for educational demonstration only. Never deploy it on a real server.

---

Setup Instructions

No installation required. Both versions run entirely in the browser as static HTML files.

Steps

1. Download both HTML files from this repository
2. Open either file directly in your browser:
   • Windows: Double-click the file, or drag it into Chrome/Firefox/Edge
   • Mac: Double-click the file, or right-click → Open With → Browser
   • Linux: xdg-open vulnerable.html

Or use the address bar:

file:///C:/Users/YourName/Downloads/vulnerable.html
file:///C:/Users/YourName/Downloads/inkwell-hardened.html

Recommended Browser

Chrome or Firefox (latest version). Both files are tested on Chrome 124+.

---

Testing Credentials

Use these accounts to log in to either version:

Email	Password	Role
eleanor@inkwell.io	inkwell2024	Author (has existing posts)
marcus@example.com	writer123	Author (has existing posts)

You can also register a new account on either version.

---

Vulnerability Test Guide

Test 1 — XSS (Cross-Site Scripting)

Where: Register page → Full name field
Payload:

<img src=x onerror=alert('XSS!')>

• Vulnerable: Alert dialog fires — script executed ❌
• Hardened: Name displayed as plain text — attack blocked ✅

---

Test 2 — SQL Injection

Where: Sign in page → Email field
Payload:

' OR '1'='1' --

Password: (leave blank or type anything)

• Vulnerable: Logs in as Eleanor Voss with no valid credentials ❌
• Hardened: Returns "Incorrect email or password" ✅

---

Test 3 — Stored XSS via Comments

Where: Open any post → Responses box
Payload:

<script>alert('Stored XSS!')</script>

• Vulnerable: Alert fires every time the post is viewed ❌
• Hardened: Comment displays as literal text ✅

---

Test 4 — CSRF Token Bypass

Where: Sign in page → Browser DevTools (F12) → Elements tab
Steps:

1. Find the hidden input: <input type="hidden" id="login-csrf" value="...">
2. Change the value to anything: faktoken123
3. Click Sign in

• Vulnerable: No token exists — any request accepted ❌
• Hardened: Returns "Invalid CSRF token. Refresh and try again." ✅

---

Test 5 — Brute Force / Rate Limiting

Where: Sign in page
Steps: Enter the wrong password 5 times in a row

• Vulnerable: Unlimited attempts allowed ❌
• Hardened: Login locked for 15 seconds after 5 failed attempts ✅

---

Test 6 — Password Storage (Code Review)

Where: Open the HTML files in a text editor (VS Code, Notepad++)

• Vulnerable: Search for password: — passwords stored as plaintext strings ❌
• Hardened: Search for passwordHash: — stored as salt:hash(salt+password+pepper) ✅

---

Project Structure

web-security-demo/
├── vulnerable.html          # Vulnerable Inkwell app
├── inkwell-hardened.html    # Hardened Inkwell app
├── README.md                # This file
├── report.docx              # Full academic report (Word)
└── presentation.pptx        # Presentation slides (PowerPoint)

---

Security Fixes Summary (Hardened Version)

Vulnerability	Vulnerable Approach	Hardened Fix
XSS	element.innerHTML = userInput	element.textContent = userInput
SQL Injection	String concatenation into query	Parameterized query equivalent
CSRF	No token	Random 48-char session token validated on every form submit
Password Storage	Plaintext (password: 'abc123')	Salt + djb2 hash (simulating bcrypt)
Content Security Policy	No CSP header	Content-Security-Policy meta tag
Brute Force	Unlimited login attempts	Rate limit: lock after 5 failures for 15 seconds
Information Leakage	Specific error messages	Generic "Incorrect email or password" for all auth failures

---

References

• OWASP Top 10 (2021)
• OWASP XSS Prevention Cheat Sheet
• OWASP SQL Injection Prevention
• OWASP CSRF Prevention Cheat Sheet
• OWASP Password Storage Cheat Sheet
• MDN — Content Security Policy

---

Team Members

Name	Student ID
[Nguyen Le Quang Vinh]	[524H0205]
[Nguyen Van Minh Tri]	[523H0187]

---

Submission Date: [15/05/2026]

Web-Final