Score0 pts
👤 Profile 📊 Instructor Dashboard
🏠 Overview 🗺️ Reference Maps 🔐 Crypto Lab 🛡️ Security Device Lab
🧯 IR Playbook
🔍 Vulnerability Lab
🧬 Digital Forensics
📄 CERT Report
🔴 Red Team 📋 CMM Assessment 🏛️ CII Evaluation

Find, Analyze & Fix Vulnerabilities

Identify security flaws across web, network, system, and API targets. Submit findings with evidence and remediation.

🌐 SC-1 Web Application 0/5
🔌 SC-2 Network 0/4
🖥️ SC-3 System 0/3
⚡ SC-4 API 0/4
🛒 ShopSec — Web Application Vulnerability Assessment
Five vulnerabilities are hidden in this simulated e-commerce site. Select a vulnerability, investigate the app on the right, then submit your findings in the Report panel.
🌐 ShopSec — Simulated E-Commerce Site
Home Login Search My Account 📁 /backup API Response
http://shopsec.local/

Welcome to ShopSec — Secure Shopping

ProductPriceStock
Laptop Pro X$1,299In Stock
Wireless Mouse$35In Stock
USB Hub 7-Port$18Out of Stock

Login

ℹ️ Server query: SELECT * FROM users WHERE id='[input]' AND pw='[input]'

Product Search

Enter a search term above.

ℹ️ The search term is reflected directly in the HTML response without encoding.

My Account — Session Info

Check your browser: DevTools → Application → Cookies

Cookie NameValueHttpOnlySecureSameSite
session_id user_1001 Missing Missing None
cart_id c8e7f3a1 Missing Missing None

⚠️ session_id is sequential and predictable (user_1001, user_1002…). HttpOnly and Secure flags are absent.

📁 Index of /backup/

⚠️ Server directory listing is enabled — this directory should not be browsable.

NameSizeModified
db_backup_2024.sql.gz2.3 MB2024-11-30
config_old.php4.1 KB2024-10-15
users_export.csv18 KB2024-11-01

API Response — GET /api/v1/user/me

This is what the API returns for the currently logged-in user:

{"id":1,"username":"admin","email":"[email protected]","role":"admin","password_hash":"5f4dcc3b5aa765d61d8327deb882cf99","ssn":"900-10-1234","credit_card":"4111-1111-1111-1111","balance":9999999,"last_login":"2024-11-30T10:23:41Z","is_deleted":false,"internal_notes":"VIP customer, no charge-back policy"}

⚠️ The API response includes sensitive fields that should not be exposed (password_hash, ssn, credit_card).

Submit Finding
Score
Submitted
Select a vulnerability from the checklist (left panel), then fill in your analysis:
← Select a vulnerability from the checklist
Vulnerability Name provided
—
OWASP Category * Severity *
Evidence — where did you find it? * Recommended Fix *
Total Score
0
out of 196 pts
By Scenario
No submissions yet.