CyberVulnLab

A deliberately vulnerable web application built with Flask for learning offensive and defensive web security.

⚠️ For educational purposes only. Never deploy on a public server.

---

What's inside

Lab	Vulnerability	OWASP	Severity
VULN-01	SQL Injection	A03:2021	Critical
VULN-02	Stored XSS	A03:2021	High
VULN-03	Insecure Direct Object Reference	A01:2021	High

Each lab has:

• A vulnerable route you can attack
• A fixed route showing the correct patch side by side
• A full writeup explaining root cause, attack steps, and defences

---

Quick start

git clone https://github.com/msiuser47/cybervulnlab
cd cybervulnlab
pip install flask
python app.py
# Open http://localhost:5000

No Docker, no setup scripts — runs with a single command.

---

Project structure

cybervulnlab/
├── app.py              # Flask app — all routes
├── templates/          # Jinja2 HTML templates
│   ├── base.html
│   ├── index.html
│   ├── sqli.html
│   ├── xss.html
│   ├── xss_safe.html
│   ├── login.html
│   ├── idor_dashboard.html
│   └── note.html
├── writeups/           # Full vulnerability writeups
│   ├── 01_sqli.md
│   ├── 02_xss.md
│   └── 03_idor.md
└── instance/
    └── cybervulnlab.db      # Auto-created SQLite database

---

Labs walkthrough

VULN-01 — SQL Injection (/sqli)

The search form concatenates user input directly into a SQL query.

Try: ' OR '1'='1 → dumps the entire users table including passwords.

Fix: parameterised queries — the DB driver separates code from data.

VULN-02 — Stored XSS (/xss)

Comments are stored raw and rendered with Jinja2's |safe filter disabled.

Try: <script>alert(document.cookie)</script> as a comment.

Fix: remove |safe; Jinja2 escapes HTML by default. Add CSP headers.

VULN-03 — IDOR (/notes/<id>)

Note IDs are sequential integers. The route checks authentication but not ownership.

Try: Login as alice, then navigate to /notes/1 (admin's private note).

Fix: Add AND user_id = ? to the query so the DB enforces ownership.

---

Learning goals

After completing all labs you should be able to:

• Explain why string-interpolated SQL queries are dangerous
• Describe the difference between reflected and stored XSS
• Distinguish authentication from authorisation
• Write the correct fix for each vulnerability class
• Read OWASP Top 10 entries and map them to real code

---

Licence

MIT — use freely for learning, teaching, and CTF prep.