Skip to content

v1.0.1 - Fixed lab

Latest
Latest

Choose a tag to compare

View all tags
@galoget galoget released this 05 Nov 15:15
v1.0.1
This tag was signed with the committer’s verified signature.
galoget
SSH Key Fingerprint: 9+viClYP/HtyLoWknwSUVDDXu0Ad0RmBeTIyO0xoVzQ
Verified
Learn about vigilant mode.
aea0e0b
This commit was signed with the committer’s verified signature.
galoget
SSH Key Fingerprint: 9+viClYP/HtyLoWknwSUVDDXu0Ad0RmBeTIyO0xoVzQ
Verified
Learn about vigilant mode.

Fixed version of the lab (fixed branch), derived from v1.0.0 with every
vulnerability mitigated:

  • SQLi -> parameterized query
  • Command injection -> shell-free subprocess + ipaddress validation
  • Path traversal / LFI -> send_from_directory
  • XXE -> defusedxml
  • Reflected XSS -> template with autoescaping
  • SSTI -> input passed as a variable to a fixed template
  • Insecure deserialization -> signed cookie (itsdangerous) and yaml.safe_load
  • SSRF -> explicit allowlist + internal-IP blocking + no redirects
  • Broken access control / IDOR -> note ownership enforced from the signed session

Run exploits/poc.py against it: it must report 0/10 findings. Why each fix works,
what SAST catches/misses, and the source->sink model: see the docs/ folder.
See every fix in one diff: git diff v1.0.0 v1.0.1 -- app/app.py. The DNS-rebinding
hardening is left as a documented advanced exercise.

Assets 2
Loading