Your lab skills

Weaknesses: CWE-285, CWE-639, CWE-862, CWE-915

1. FoundationIDOR lab: Repair an invoice authorization bugJavaScript · CWE-639
2. FoundationMass assignment lab: Update only the fields users may editJavaScript · CWE-915
3. PractitionerRAG access control lab: Stop a retriever from returning another tenant’s documentsJavaScript · CWE-285
4. AdvancedExcessive agency lab: Bind an agent’s action to the approved argumentsJavaScript · CWE-862

Weaknesses: CWE-352, CWE-942, CWE-1021

1. FoundationCSRF lab: Protect an account change from a forged requestJavaScript · CWE-352
2. FoundationCORS policy lab: Grant CORS to the right origins onlyJavaScript · CWE-942
3. PractitionerCSP builder lab: Build a strict Content-Security-PolicyJavaScript · CWE-1021

Weaknesses: CWE-79

1. FoundationXSS lab: Render a model’s answer as text instead of active markupJavaScript · CWE-79
2. PractitionerHTML sanitization lab: Configure a sanitizer for user commentsJavaScript · CWE-79

Weaknesses: CWE-78, CWE-88, CWE-89, CWE-94

1. FoundationSQL injection lab: Separate SQL structure from data with sqlite3Python · CWE-89
2. PractitionerActions injection lab: Flag GitHub Actions expression injectionJavaScript · CWE-94, CWE-78
3. PractitionerOS command injection lab: Run git without a shellJavaScript · CWE-78, CWE-88

Weaknesses: CWE-22

1. PractitionerPath traversal lab: Keep archive entries inside their extraction directoryJavaScript · CWE-22
2. PractitionerPath traversal lab: Serve an uploaded file without path traversalPython · CWE-22

Weaknesses: CWE-918

1. PractitionerSSRF validation lab: Validate a fetch URL with ipaddressPython · CWE-918
2. AdvancedSSRF lab: Guard an outbound fetch against SSRFJavaScript · CWE-918

Weaknesses: CWE-362, CWE-367, CWE-472, CWE-640, CWE-837, CWE-1284

1. PractitionerRace condition lab: Repair a balance check that racesJavaScript · CWE-362, CWE-367
2. PractitionerPassword reset token lab: Make a recovery credential single-useJavaScript · CWE-640
3. PractitionerBusiness logic lab: Price an order without trusting the clientJavaScript · CWE-472, CWE-1284, CWE-837

Weaknesses: CWE-287, CWE-347

1. PractitionerJWT validation lab: Validate the purpose and audience of a tokenJavaScript · CWE-287
2. AdvancedJWT verification lab: Verify a JWT before trusting itJavaScript · CWE-347

Weaknesses: CWE-294, CWE-323, CWE-345

1. AdvancedAES-GCM nonce reuse lab: Fix a nonce allocator that breaks after restartJavaScript · CWE-323
2. AdvancedWebhook signature and replay lab: Repair a webhook handler that pays twiceJavaScript · CWE-345, CWE-294

Weaknesses: CWE-345, CWE-1395

1. FoundationSBOM completeness lab: Find the dependencies missing from a release SBOMJavaScript · CWE-1395
2. PractitionerSigned artifact provenance lab: Reject a release from the wrong producerJavaScript · CWE-345
3. AdvancedRelease evidence lab: Keep stale test evidence out of a release decisionJavaScript · CWE-345

Weaknesses: CWE-250, CWE-284, CWE-668

1. PractitionerPrivileged container lab: Reject a privileged workload before deploymentJavaScript · CWE-250
2. PractitionerNetworkPolicy lab: Lock down a shop namespaceJavaScript · CWE-668, CWE-284

Weaknesses: CWE-73, CWE-434, CWE-646, CWE-770

1. PractitionerFile upload lab: Accept avatars without publishing pagesJavaScript · CWE-434, CWE-646, CWE-73, CWE-770

Weaknesses: CWE-287, CWE-601

1. FoundationOpen redirect lab: Return users to this site onlyJavaScript · CWE-601
2. AdvancedOAuth redirect and PKCE lab: Match redirect URIs and verify PKCEJavaScript · CWE-601, CWE-287

Weaknesses: CWE-330, CWE-331, CWE-338

1. PractitionerInsecure randomness lab: Generate unguessable API keysJavaScript · CWE-338, CWE-330, CWE-331

Weaknesses: CWE-125, CWE-130

1. PractitionerBuffer over-read lab: Stop a heartbeat over-readJavaScript · CWE-125, CWE-130

Weaknesses: CWE-94, CWE-95, CWE-1336

1. PractitionerSSTI lab: Render a welcome banner without template injectionPython · CWE-1336, CWE-94, CWE-95

Weaknesses: CWE-611, CWE-776

1. PractitionerXXE lab: Parse an uploaded invoice without resolving external entitiesPython · CWE-611, CWE-776

Weaknesses: CWE-502

1. PractitionerPickle deserialization lab: Load a session token without picklePython · CWE-502

Weaknesses: CWE-327, CWE-759, CWE-916

1. PractitionerPassword hashing lab: Verify and upgrade an Argon2 password hash on loginPython · CWE-916, CWE-759, CWE-327

Weaknesses: CWE-284, CWE-863

1. PractitionerIAM trust policy lab: Evaluate a role trust policy against the confused deputyPython · CWE-863, CWE-284