Lab 03: Cross-site WebSocket hijacking
1. Executive Summary Vulnerability: Cross-Site WebSocket Hijacking (CSWSH). Description: The application’s WebSocket handshake relies solely on HTTP cookies for session handling and lacks CSRF pr...
Kh4n Security
Lab 02: Manipulating the WebSocket handshake to exploit vulnerabilities
1. Executive Summary Vulnerability: XSS Filter Bypass & IP Ban Circumvention (via Handshake Manipulation). Description: The application employs a Web Application Firewall (WAF) or server-side...
Lab 01: Manipulating WebSocket messages to exploit vulnerabilities
1. Executive Summary Vulnerability: Client-Side Bypassed Cross-Site Scripting (XSS) via WebSockets. Description: The application implements a live chat feature using the WebSocket protocol. While ...
Lab 13: Referer-based access control
1. Executive Summary Vulnerability: Broken Access Control (Insecure Header Validation). Description: The application attempts to verify authorization by checking the HTTP Referer header. It assum...
Lab 12: Multi-step process with no access control on one step
1. Executive Summary Vulnerability: Broken Access Control in Multi-Step Logic. Description: The application splits a sensitive action (promoting a user) into a multi-step workflow: Selection ->...
Lab 11 : Insecure direct object references
1. Executive Summary Vulnerability: Insecure Direct Object Reference (IDOR) with Static File Enumeration. Description: The application saves sensitive user data (chat transcripts) to the server’s...
Lab 10: User ID controlled by request parameter with password disclosure
1. Executive Summary Vulnerability: Insecure Direct Object Reference (IDOR) leading to Sensitive Data Exposure. Description: The application uses an insecure ID parameter to retrieve user profile...
Lab 09: User ID controlled by request parameter with data leakage in redirect
1. Executive Summary Vulnerability: IDOR with Data Leakage in Redirect. Description: The application detects an authorization failure (e.g., User A trying to access User B’s data) and issues a 30...
Lab 08: User ID controlled by request parameter, with unpredictable user IDs
1. Executive Summary Vulnerability: Insecure Direct Object Reference (IDOR) with GUIDs. Description: The application uses long, complex GUIDs (e.g., 59b3...) to identify users instead of sequentia...
Lab 07: User ID controlled by request parameter
1. Executive Summary Vulnerability: Insecure Direct Object Reference (IDOR). Description: The application exposes a direct reference to an internal database object (the User ID) in the URL. When ...