Getting Started

Prerequisites

• Docker
• Docker Compose

Setup

git clone https://github.com/<repo>.git
cd <repo>
docker compose up -d

The lab will be available at:

• Frontend (React app): http://localhost:3001
• Backend (API): http://localhost:3000

Usage

• Register a new user and log in through the frontend.
• Explore features like profile management and admin promotion.
• Identify sources and sinks that can be chained to perform CSPT and simulate CSRF attacks.

For a full walkthrough of the attack and detailed explanations, check out the accompanying blog post:

• https://blog.kulkan.com/client-side-path-traversal-exploiting-csrf-in-header-based-auth-scenarios-31c26a1baece