Skip to content

Laboratory for those who are interested in learning about web security

License

Notifications You must be signed in to change notification settings

italovalcy/secDevLabs

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

secDevLabs

The main goal of this project is to provide a laboratory for those who are interested in learning about web security development in a practical manner.

Build your own lab

By provisioning local environments via docker-compose, you will learn how the most critical web application security risks are exploited and how these vulnerable code can be fixed to mitigate them. 👩‍💻

How do I start?

After forking this repository, you will find multiple intended vulnerable apps based on real life cenarios in various languages such as Golang, Python and PHP. A good start would be installing the ones you are most familiar with. 💡

Each of them has an Attack Narrative section that describes how an attacker would exploit the corresponding vulnerability. Before reading any code, it may be a good idea following these steps so you can better understand the attack itself. 💉

Now it's time to shield the application up! Imagine that this is your application and you need to fix these flaws! Your mission is writing new code that mitigates them and sending a new Pull Request to deploy a secure app! 🔐

How secure is my new code?

After mitigating a vulnerability, you can send a Pull Request to gently ask secDevLabs community to review your new secure code. If you're feeling a bit lost, try having a look at this mitigation solution, it might help! 🚀

OWASP Top 10 (2017) apps:

Disclaimer: You are about to install vulnerable apps in your machine! 🔥

Vulnerability Language Application
A1 - Injection Golang CopyNPaste API
A2 - Broken Authentication Python Saidajaula Monster Fit
A2 - Broken Authentication Golang Insecure go project
A3 - Sensitive Data Exposure Golang SnakePro
A4 - XML External Entities (XXE) PHP ViniJr Blog
A5 - Broken Access Control Golang Vulnerable Ecommerce API
A6 - Security Misconfiguration PHP Vulnerable Wordpress Misconfig
A6 - Security Misconfiguration NodeJS Stegonography
A7 - Cross-Site Scripting (XSS) Python Gossip World
A8 - Insecure Deserialization Python Amarelo Designs
A9 - Using Components With Known Vulnerabilities PHP Cimentech
A10 - Insufficient Logging & Monitoring Python GamesIrados.com

Contributing

We encourage you to contribute to SecDevLabs! Please check out the Contributing to SecDevLabs section for guidelines on how to proceed! 🎉

License

This project is licensed under the BSD 3-Clause "New" or "Revised" License - read LICENSE.md file for details. 📖

About

Laboratory for those who are interested in learning about web security

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • PHP 58.2%
  • JavaScript 16.2%
  • CSS 14.2%
  • HTML 9.6%
  • Shell 0.7%
  • Go 0.5%
  • Other 0.6%