SecureCode Studio

Labs

Two kinds of lab. In a fix lab you get a running application with a real vulnerability: fix it in the browser editor, and hidden tests decide whether the fix holds. In a code review you read a feature before it ships, mark each line where a weakness lives and name it; an answer key grades the review and explains every finding.

Aster Market: Profile Access Control

Free

Fix the app in Java, easy, 75 minutes

Fix a customer profile authorization bug inside a normal multi-page shopping application.

  • Access control
  • CWE-639
  • CWE-284
  • A01:2021

What you will learn

  • Recognise an insecure direct object reference, an ID in the URL that the server trusts as permission.
  • Enforce ownership in the backend from the signed-in identity, not from what the client sends.
  • Keep the right status codes (401, 404) while closing the hole.
Open in the Studio

Trailhead: Review Comments Review

Free

Code review in JavaScript, easy, 25 minutes

Review how a Node.js trail site turns reviews, names and searches into HTML, and mark every place a visitor's text could become part of the page.

  • Injection
  • CWE-79
  • CWE-693
  • A03:2021
  • A05:2021

What you will learn

  • Trace untrusted values to every place they are written into HTML.
  • Tell encoding apart from formatting and filtering, and apply them in the right order.
  • Judge which link schemes are safe and what a Content-Security-Policy adds as a second line.
Open in the Studio

Keyhole: Password Reset Review

Free

Code review in Go, medium, 30 minutes

Review a Go password-reset service and mark every place where a reset link could be guessed, leaked or abused.

  • Authentication
  • CWE-338
  • CWE-640
  • CWE-208
  • CWE-204
  • CWE-532
  • CWE-521
  • A07:2021
  • A02:2021
  • A09:2021

What you will learn

  • Judge whether a secret token is unpredictable, short-lived and compared safely.
  • Spot a reset form that reveals which accounts exist.
  • Keep secrets out of logs, and apply password rules on every path that sets a password.
Open in the Studio

Ledgerline: Invoice Import Review

Pro

Code review in Java, hard, 40 minutes

Review a Java invoice importer and mark every place where an uploaded file, a cookie or a form field is trusted too far.

  • Parsing
  • CWE-611
  • CWE-22
  • CWE-409
  • CWE-502
  • CWE-1333
  • CWE-601
  • A05:2021
  • A08:2021
  • A01:2021

What you will learn

  • Configure an XML parser so a document cannot reach files or URLs through entities.
  • Extract archives safely, keeping every entry inside its folder and within a size budget.
  • Recognise why Java deserialization of client data, nested regex repetition and open redirects are dangerous.
Open in the Studio

Parcel Post: Orders API Review

Free

Code review in JavaScript, easy, 30 minutes

Review a Node.js orders API before it ships and mark every place where one customer could act as another.

  • Access control
  • CWE-639
  • CWE-862
  • CWE-347
  • CWE-915
  • A01:2021
  • A07:2021
  • A08:2021

What you will learn

  • Review an API route by route for authorization, not just authentication.
  • Spot a token that is decoded but never verified.
  • Recognise mass assignment in an update that copies the request body.
Open in the Studio

Darkroom: Photo Uploads Review

Free

Code review in Python, medium, 30 minutes

Review a Flask photo-upload feature and mark every place where an uploaded file could escape its folder, run as a command or be served as a page.

  • File handling
  • CWE-22
  • CWE-434
  • CWE-78
  • CWE-798
  • A01:2021
  • A03:2021
  • A04:2021
  • A07:2021

What you will learn

  • Follow an uploaded file name from the request to the disk and spot path traversal.
  • See why an upload must be checked by content and served so it cannot run as a page.
  • Find where a file name reaches a shell and where secrets live in code.
Open in the Studio

Postcard: Link Preview Review

Free

Code review in TypeScript, hard, 35 minutes

Review a TypeScript link-preview service and mark every way a pasted link could make the server reach where it should not.

  • Request forgery
  • CWE-918
  • CWE-367
  • CWE-400
  • CWE-209
  • A10:2021
  • A04:2021
  • A05:2021

What you will learn

  • Recognise server-side request forgery wherever a server fetches an address a user chose.
  • Check every hop and every resolved address, at the moment of connecting, not once beforehand.
  • Bound outbound requests in time and size, and keep network errors out of answers.
Open in the Studio