python-code-review

Python-focused code review for offensive security. 20 exercises on fictional web services, 6 theory modules, and full solutions with PoCs.

The goal is to read Python code and identify exploitable vulnerabilities - the kind found in API pentests, bug bounties, and source code audits.

---

Structure

.
├── theorie/          # 6 progressive modules + review methodology
├── exercices/        # 20 Python files to audit
└── solutions/        # Solutions with PoC and references

---

Where to start

No Python code review experience: read theory modules in order (theorie/00 -> theorie/06), then work through exercises 01 to 10.

Already know the basics: read theorie/06-outils-et-methode.md for methodology, then jump straight to exercises.

Targeting specific topics: see the exercises table below, Themes column.

---

Theory modules

File	Content	Level
00 - Visible patterns	eval/exec, subprocess, hardcoded secrets, TLS, debug, bind	Beginner
01 - Classic injections	SQLi, argument injection, weak crypto, timing attack	Intermediate
02 - Deserialization and parsing	pickle, yaml.load, path traversal, SSRF, SSTI, XXE	Intermediate
03 - Access control	IDOR, mass assignment, missing auth, ReDoS, CORS/CSRF	Advanced
04 - Concurrency and Python traps	async/await, TOCTOU, race conditions, supply chain	Expert
05 - Crypto, JWT and sessions	AES-GCM, padding oracle, JWT confusion, ML deserialization	Expert
06 - Tools and methodology	Bandit, Semgrep, CodeQL, review method, reporting	Reference

---

Exercises

20 Python code snippets representing fictional web services. For each: read the docstring for context, identify vulnerabilities, propose fixes - then open the solution.

#	File	Difficulty	Framework	Themes
01	user-file-service	Beginner	Flask	SQLi, path traversal, pickle, hardcoded secrets
02	avatar-fetcher	Beginner	FastAPI	SSRF, bypassable validation
03	email-preview	Beginner	Flask	SSTI Jinja2
04	pipeline-config	Intermediate	Worker	yaml.load RCE, bypassable guard
05	invoice-import	Intermediate	Flask	XXE, bypassable filter
06	jwt-download	Intermediate	FastAPI	JWT, path traversal
07	account-api	Advanced	Django REST	IDOR, mass assignment
08	wallet-coupon	Advanced	Flask	Race condition, two-step SQLi
09	ingest-validator	Expert	FastAPI	ReDoS, hidden cost DoS
10	support-agent	Expert	LLM agent	Prompt injection, LLM taint
11	async-correctness	Advanced	asyncio	Missing await, blocked event loop, gather
12	auth-and-reset	Expert	Flask	Account takeover chain, crypto, JWT
13	webhook-ingest	Expert	FastAPI	Signature verification, operation ordering
14	model-registry	Expert	Flask	ML supply chain, pickle RCE, deserialization
15	search-api	Expert	FastAPI + MongoDB	NoSQL injection, cross-tenant IDOR
16	dos-amplification	Expert	Flask	ReDoS x2, zip bomb, unbounded recursion
17	payment-transfer	Expert	FastAPI	Wallet IDOR, TOCTOU, SQLi in logs
18	model-serving	Expert	Flask + JWT	JWT alg confusion, pickle/torch/yaml RCE
19	rag-agent	Expert	Flask + RAG	Stored prompt injection, exfiltration
20	team-api	Expert	Django CBV	Mass assignment, IDOR x2, ORDER BY SQLi

---

Workflow

1. Open the exercise, read the docstring context.
2. Read the code once without taking notes to understand what the service does.
3. Identify sources (where do untrusted inputs come from?) and trace them to sinks (execute, subprocess, eval, open, pickle.loads...).
4. For each finding: concrete impact + minimal payload + fix + priority.
5. Write a prioritized closing: what is immediately exploitable vs what is hardening.
6. Open the solution and compare.

---

References

• CWE Top 25 2024 - MITRE
• OWASP Top 10 2021 - OWASP Foundation
• OWASP Top 10 2025 RC - OWASP Foundation
• Bandit - PyCQA
• Semgrep Python rules - Semgrep
• Python Security
• HackTricks Python