Aster Market: Profile Access Control
FreeFix a customer profile authorization bug inside a normal multi-page shopping application.
Break it. Fix it. Prove it.
A secure-coding lab where every learner gets a private, running copy of a vulnerable application and a code editor in the browser. They fix the code and rebuild the app; hidden tests then attack it from the outside, the way an attacker would, to prove the hole is closed and the app still works.
OrderRepository.javaBuilt and restarted
41public List<Order> find(String q) {
42 var sql = "... WHERE no = '" + q + "'";
42 var sql = "... WHERE no = ?";
43 return db.query(sql, ORDER, q);
44}Order searchAttempt 2
100%
- Search finds an order by number
- A quote in the search is treated as text
- A UNION payload returns no extra rows
- Database errors stay hidden
- Missing sign-in still returns 401
How a lab works
- ExploreUse the running app and find the flaw.
- FixChange the code in the browser editor.
- ApplyRebuild and restart your private copy.
- ValidateHidden tests decide whether the fix holds.
Four outcomes. One counts.
The hidden tests attack the running app from the outside with real payloads, and use it the way a customer would. A fix passes only when the hole is closed and the app still works.
Each lab also names checks that must pass whatever the score, so a high score cannot hide a missing fix. Changing a test or hiding the bug does not count.
| The app still works | The app is broken | |
|---|---|---|
| The hole is closed | SolvedThe flag is yours. | Broke the featureSafe, but nobody can use it. |
| The hole is still open | Still vulnerableThe attack still works. | Worse than beforeOpen, and broken too. |
Private by default
Learners attack and break their own copy of the application, so every copy is fenced off from the others.
A copy of your own
Every session runs in its own containers and network, with its own files. Nobody else's changes reach it.
Links that only work for you
Your lab and editor open only for your account, even if someone else gets hold of the address.
Fair for everyone
Processor, memory and disk are shared fairly, so one heavy build does not slow the other learners.
The OWASP Top 10, lab by lab
9 of 10 categories have a lab today- A01 Broken access control Aster Market: Profile Access Control, Ledgerline: Invoice Import Review, Parcel Post: Orders API Review, Darkroom: Photo Uploads Review
- A02 Cryptographic failures Keyhole: Password Reset Review
- A03 Injection Trailhead: Review Comments Review, Bookshelf: Search Injection, Darkroom: Photo Uploads Review
- A04 Insecure design Darkroom: Photo Uploads Review, Postcard: Link Preview Review
- A05 Security misconfiguration Trailhead: Review Comments Review, Ledgerline: Invoice Import Review, Postcard: Link Preview Review
- A06 Vulnerable and outdated components No lab yet
- A07 Identification and authentication failures Keyhole: Password Reset Review, Parcel Post: Orders API Review, Darkroom: Photo Uploads Review
- A08 Software and data integrity failures Ledgerline: Invoice Import Review, Parcel Post: Orders API Review
- A09 Security logging and monitoring failures Keyhole: Password Reset Review
- A10 Server-side request forgery Postcard: Link Preview Review
Made for teaching
Organizations and cohorts
Instructors group their members into cohorts and assign labs with due dates.
Progress at a glance
Who solved each lab on time, late, or not yet, and every member's session one click away.
Insights by vulnerability
Which flaws learners fix, how many tries a full fix takes, and the check where they get stuck.
Fall 2026, group A3 members, 2 labs assigned
Labs
See all 8 labsTrailhead: Review Comments Review
FreeReview how a Node.js trail site turns reviews, names and searches into HTML, and mark every place a visitor's text could become part of the page.
Bookshelf: Search Injection
FreeClose the SQL injections in a book catalogue's search, filter and sort without breaking them.
Ready for your first lab?
Your instructor or administrator gives you an account. Sign in and start a session.