Cybersecurity · Guided project
Find and Fix Web Vulnerabilities in a Practice App — Guided Project
Run a deliberately vulnerable app on your own machine, find SQL injection, XSS and broken access control, then fix the same flaws in a small app you write — documented like a real security report.
- Intermediate
- ~6 hours
- 5 steps
The brief
Learn attacks the legal way. Run OWASP Juice Shop or DVWA locally, solve beginner challenges for SQL injection, XSS and broken access control, then write a small Flask or Node app that contains those three flaws on purpose — and fix each one. Present your work as a short security report with severity, evidence and fixes.
Skills you will use: OWASP Top 10 · Secure coding · Parameterised queries · Output encoding · Report writing
Build it
Step by step
Tick each step as you finish it. 0 of 5 done.
-
Step 1Set up the lab
Run Juice Shop or DVWA locally with Docker. Never test real websites.
-
Step 2Find three flaws
Complete beginner challenges for injection, XSS and broken access control; take notes and screenshots.
-
Step 3Build a vulnerable mini-app
Write a small app with a login, a search and a "my results" page containing the same three flaws.
-
Step 4Fix them
Parameterised queries, template auto-escaping, server-side ownership checks; verify each fix.
-
Step 5Write the report
For each issue: description, impact, steps to reproduce (in your lab), fix and how you verified it.
Self-review before you call it done
Tick each point once your project really meets it. These are the things an interviewer will look for.
Check all 4 points, then mark the project as finished.
Next