Home Fix cards Find it, then fix it Fix cards Find it, then fix it Drills built from the tested fix cards: find the vulnerable lines, choose the real fix over a plausible wrong one, and name the test that catches it.
Each drill is one fix card: 188 drills in 10 stacks. The answers come from the card’s own code and its recorded test run, in which the fix passed every test and the wrong fix failed some. The code of the fix stays hidden until you answer the question before it. Your answers stay in this browser.
Weakness and stackCross-site request forgery (CSRF) · Node.js and Express Cross-site request forgery (CSRF) · Python and Flask Cross-site request forgery (CSRF) · Java and Spring Boot Cross-site request forgery (CSRF) · C# and ASP.NET Core Cross-site request forgery (CSRF) · Python and Django Cross-site request forgery (CSRF) · Ruby on Rails Cross-site request forgery (CSRF) · PHP and Laravel Missing object-level authorization (IDOR and BOLA) · Node.js and Express Missing object-level authorization (IDOR and BOLA) · Python and Flask Missing object-level authorization (IDOR and BOLA) · Java and Spring Boot Missing object-level authorization (IDOR and BOLA) · C# and ASP.NET Core Missing object-level authorization (IDOR and BOLA) · TypeScript and Next.js Missing object-level authorization (IDOR and BOLA) · Python and FastAPI Missing object-level authorization (IDOR and BOLA) · Python and Django Missing object-level authorization (IDOR and BOLA) · Go and net/http Missing object-level authorization (IDOR and BOLA) · Ruby on Rails Missing object-level authorization (IDOR and BOLA) · PHP and Laravel Open redirect · Node.js and Express Open redirect · Python and Flask Open redirect · Java and Spring Boot Open redirect · C# and ASP.NET Core Open redirect · TypeScript and Next.js Open redirect · Python and FastAPI Open redirect · Python and Django Open redirect · Go and net/http Open redirect · Ruby on Rails Open redirect · PHP and Laravel Path traversal · Node.js and Express Path traversal · Python and Flask Path traversal · Java and Spring Boot Path traversal · C# and ASP.NET Core Path traversal · TypeScript and Next.js Path traversal · Python and FastAPI Path traversal · Python and Django Path traversal · Go and net/http Path traversal · Ruby on Rails Path traversal · PHP and Laravel Server-side request forgery (SSRF) · Node.js and Express Server-side request forgery (SSRF) · Python and Flask Server-side request forgery (SSRF) · Java and Spring Boot Server-side request forgery (SSRF) · C# and ASP.NET Core Server-side request forgery (SSRF) · TypeScript and Next.js Server-side request forgery (SSRF) · Python and FastAPI Server-side request forgery (SSRF) · Python and Django Server-side request forgery (SSRF) · Go and net/http Server-side request forgery (SSRF) · Ruby on Rails Server-side request forgery (SSRF) · PHP and Laravel CORS misconfiguration on credentialed APIs · Node.js and Express CORS misconfiguration on credentialed APIs · Python and Flask CORS misconfiguration on credentialed APIs · Java and Spring Boot CORS misconfiguration on credentialed APIs · C# and ASP.NET Core XML external entity (XXE) processing · Python and Flask XML external entity (XXE) processing · Java and Spring Boot XML external entity (XXE) processing · C# and ASP.NET Core Insecure randomness for security tokens · Node.js and Express Insecure randomness for security tokens · Python and Flask Insecure randomness for security tokens · Java and Spring Boot Insecure randomness for security tokens · C# and ASP.NET Core Insecure randomness for security tokens · Go and net/http Weak password hashing · Node.js and Express Weak password hashing · Python and Flask Weak password hashing · Java and Spring Boot Weak password hashing · C# and ASP.NET Core Weak password hashing · Python and FastAPI Weak password hashing · Python and Django Weak password hashing · Go and net/http Weak password hashing · PHP and Laravel Code injection · Node.js and Express Code injection · Python and Flask Code injection · Java and Spring Boot Code injection · C# and ASP.NET Core Code injection · Python and FastAPI Cross-site scripting (XSS) · Node.js and Express Cross-site scripting (XSS) · Python and Flask Cross-site scripting (XSS) · Java and Spring Boot Cross-site scripting (XSS) · C# and ASP.NET Core Cross-site scripting (XSS) · TypeScript and Next.js Cross-site scripting (XSS) · Python and Django Cross-site scripting (XSS) · Go and net/http Cross-site scripting (XSS) · Ruby on Rails Cross-site scripting (XSS) · PHP and Laravel CSV formula injection · Node.js and Express CSV formula injection · Python and Flask CSV formula injection · Java and Spring Boot CSV formula injection · C# and ASP.NET Core CSV formula injection · Python and Django CSV formula injection · Ruby on Rails LDAP filter injection · Python and Flask LDAP filter injection · Java and Spring Boot NoSQL operator injection · Node.js and Express NoSQL operator injection · Python and Flask OS command and argument injection · Node.js and Express OS command and argument injection · Python and Flask OS command and argument injection · Java and Spring Boot OS command and argument injection · C# and ASP.NET Core OS command and argument injection · TypeScript and Next.js OS command and argument injection · Go and net/http Server-side template injection · Node.js and Express Server-side template injection · Python and Flask Server-side template injection · Java and Spring Boot Server-side template injection · C# and ASP.NET Core SQL injection · Node.js and Express SQL injection · Python and Flask SQL injection · Java and Spring Boot SQL injection · C# and ASP.NET Core SQL injection · TypeScript and Next.js SQL injection · Python and FastAPI SQL injection · Python and Django SQL injection · Go and net/http SQL injection · Ruby on Rails SQL injection · PHP and Laravel XPath injection · Python and Flask XPath injection · Java and Spring Boot XPath injection · C# and ASP.NET Core Clickjacking · Node.js and Express Clickjacking · Python and Flask Clickjacking · TypeScript and Next.js Clickjacking · Python and Django Regular-expression denial of service (ReDoS) · Node.js and Express Regular-expression denial of service (ReDoS) · Python and Flask Regular-expression denial of service (ReDoS) · Java and Spring Boot Regular-expression denial of service (ReDoS) · C# and ASP.NET Core Unbounded resource consumption · Node.js and Express Unbounded resource consumption · C# and ASP.NET Core Unbounded resource consumption · Python and FastAPI Unbounded resource consumption · Go and net/http Unrestricted file upload · Node.js and Express Unrestricted file upload · Python and Flask Unrestricted file upload · Java and Spring Boot Unrestricted file upload · C# and ASP.NET Core Unrestricted file upload · TypeScript and Next.js Unrestricted file upload · Python and FastAPI Unrestricted file upload · Python and Django Unrestricted file upload · Go and net/http Unrestricted file upload · Ruby on Rails Unrestricted file upload · PHP and Laravel Hard-coded secrets · Node.js and Express Hard-coded secrets · Python and Flask Hard-coded secrets · Java and Spring Boot Hard-coded secrets · C# and ASP.NET Core Improper TLS certificate validation · Node.js and Express Improper TLS certificate validation · Python and Flask Improper TLS certificate validation · Java and Spring Boot Improper TLS certificate validation · C# and ASP.NET Core Improper TLS certificate validation · Go and net/http JWT validation in APIs (bearer tokens) · Node.js and Express JWT validation in APIs (bearer tokens) · Python and Flask JWT validation in APIs (bearer tokens) · Java and Spring Boot JWT validation in APIs (bearer tokens) · C# and ASP.NET Core JWT validation in APIs (bearer tokens) · TypeScript and Next.js JWT validation in APIs (bearer tokens) · Python and FastAPI JWT validation in APIs (bearer tokens) · Go and net/http Missing authentication for a critical function · Node.js and Express Missing authentication for a critical function · Python and Flask Missing authentication for a critical function · Java and Spring Boot Missing authentication for a critical function · C# and ASP.NET Core Missing authentication for a critical function · TypeScript and Next.js Missing authentication for a critical function · Python and FastAPI Missing authentication for a critical function · Python and Django Missing authentication for a critical function · Go and net/http Missing authentication for a critical function · Ruby on Rails Missing authentication for a critical function · PHP and Laravel Session fixation and session cookies · Node.js and Express Session fixation and session cookies · Python and Flask Session fixation and session cookies · Java and Spring Boot Session fixation and session cookies · C# and ASP.NET Core Session fixation and session cookies · Ruby on Rails Session fixation and session cookies · PHP and Laravel Insecure deserialization · Node.js and Express Insecure deserialization · Python and Flask Insecure deserialization · Java and Spring Boot Insecure deserialization · C# and ASP.NET Core Insecure deserialization · Python and FastAPI Insecure deserialization · Ruby on Rails Insecure deserialization · PHP and Laravel Mass assignment (over-posting) · Node.js and Express Mass assignment (over-posting) · Python and Flask Mass assignment (over-posting) · Java and Spring Boot Mass assignment (over-posting) · C# and ASP.NET Core Mass assignment (over-posting) · TypeScript and Next.js Mass assignment (over-posting) · Python and FastAPI Mass assignment (over-posting) · Python and Django Mass assignment (over-posting) · Go and net/http Mass assignment (over-posting) · Ruby on Rails Mass assignment (over-posting) · PHP and Laravel CRLF injection in logs and response headers · Node.js and Express CRLF injection in logs and response headers · Python and Flask CRLF injection in logs and response headers · Java and Spring Boot
Start this drill Random drill
The drills need JavaScript. Each fix card shows the same code and tests.
1. Find it: which lines does the fix change? Select every line of the vulnerable code that the fix changes. When the fix only adds code, select the line the new code protects.
Lines of the vulnerable code Check my lines
2. Fix it: which version fixes it? One version is the card’s fix. The others look safe but fail its tests.
Versions of the code Check my choice
3. Prove it: which test catches the wrong fix? In the card’s recorded run, one of these tests failed for the wrong fix. The others catch the vulnerable code but pass for the wrong fix.
Tests from the card Check my choice