AppSec Blog: Category - Spot the Vuln

Spot the Vuln - Sleep

It is a common experience that a problem difficult at night is resolved in the morning after a committee of sleep has worked on it. - John Steinbeck Spot the Vuln uses code snippets from open source applications to demonstrate vulnerabilities in real world web applications. Every Monday morning a vulnerable code snippet is posted. … Continue reading Spot the Vuln - Sleep


Spot the Vuln - Banks

I have always been afraid of banks. - Andrew Jackson Spot the Vuln uses code snippets from open source applications to demonstrate vulnerabilities in real world web applications. Every Monday morning a vulnerable code snippet is posted. Take a look at the vulnerable code and try to identify where the security vulnerability is. Every Friday, … Continue reading Spot the Vuln - Banks


Spot the Vuln - Tougher - SQL Injection

Details Affected Software: PunBB Fixed in Version: 1.3 Issue Type: SQL Injection (SQLi) Original Code: Found Here Description This week's bug was an old SQL injection bug that affected PunBB versions < 1.3. In short, a value is taken from an attacker/user controlled POST request and is used to build a SQL statement. This bug … Continue reading Spot the Vuln - Tougher - SQL Injection


Spot the Vuln - Tougher

I survived because I was tougher than anybody else. - Bette Davis Spot the Vuln uses code snippets from open source applications to demonstrate vulnerabilities in real world web applications. Every Monday morning a vulnerable code snippet is posted. Take a look at the vulnerable code and try to identify where the security vulnerability is. … Continue reading Spot the Vuln - Tougher


Spot the Vuln - Price - Cross Site Scripting

Details Affected Software: PunBB Fixed in Version: 2.1 Issue Type: Cross Site Scripting (XSS) Original Code: Found Here Description This week's vulnerability was a XSS bug in PunBB. PunBB was taking an un-trusted value directly from the POST parameter ($_POST[''prune_sticky']) and echoing the un-trusted value directly into a value attribute for a hidden form input … Continue reading Spot the Vuln - Price - Cross Site Scripting