Project · Ethical Hacking and Penetration Testing (legal labs)
Project: web attacks and their fixes
The brief
Against DVWA and OWASP Juice Shop in your lab you demonstrate SQL injection, reflected XSS and an insecure direct object reference (IDOR). For each one you write the defensive code that stops it (parameterised queries, output encoding, object-level authorisation), then re-test to prove the fix works.
Why it matters
SQL injection, XSS and broken access control are perennial entries in the OWASP Top 10 and the most common serious bugs found in web pentests and bug bounties. Employers want testers who can both find a flaw and explain the exact fix a developer should apply.
Skills you practise
- SQL injection
- cross-site scripting (XSS)
- IDOR and broken access control
- parameterised queries
- output encoding
- object-level authorisation
- retesting
You need
- Your isolated lab with DVWA (set to security level "low" to start) and OWASP Juice Shop
- A browser and curl in Kali; Burp Suite optional
What you will have at the end
webfix.py (tested defensive code for SQLi, XSS and IDOR) and web-findings.txt (each flaw with lab evidence, the fix, and a retest result).
How it is marked (rubric, 100 points)
| Defensive codeis_safe_query, escape_html and can_access pass every check, including the encoding order and the logged-out case. | 35 |
|---|---|
| Flaws demonstratedSQLi, XSS and IDOR each have real lab evidence from your own targets. | 30 |
| Fixes are correctEach flaw is paired with the right fix (parameterised query, output encoding and CSP, object-level authorisation). | 20 |
| RetestThe SQLi fix is proven by retesting at security level high. | 15 |
0/6 steps done
Step 1 of 6
The fix for SQLi, in code
is_safe_query(code) is True only for SQL that uses a placeholder and does not build the query by joining strings.
SQL injection happens when user input is glued straight into a query. The fix is a parameterised query: a fixed SQL string with a ? or %s placeholder, and the value passed separately so it can never change the query. Write is_safe_query(code): True when the code uses a placeholder and shows no string building (+ joining, f-strings or .format).
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.