DOM injection
This function inserts a greeting into the page. What is the vulnerability? Assume the input comes from an untrusted user.
Preview challenge → Free account required to solveJAVASCRIPT IN PRACTICE
Spot the vulnerability
Read a code snippet and identify a vulnerability, such as XSS or a data leak. Practice spotting security issues.
- Untrusted data
- Trust boundaries
- Code vulnerabilities
Solving requires a free account.
Selected challenges to get started
Pick a challenge and explore the rules through a concrete example.
Calculator
This calculator runs on a Node.js server. expr comes from an untrusted user. What is the main consequence of passing it to eval?
Preview challenge → Free account required to solveConcatenated query
A backend builds an SQL query. Where is the vulnerability? Assume the input comes from an untrusted user.
Preview challenge → Free account required to solveReady for more?
Available challenges: 5.
See all challenges →The full catalogue requires a free account.
How should you approach these challenges?
Code security challenges practise recognising vulnerabilities such as XSS and mistakes in handling untrusted data. You develop a habit of examining trust boundaries during code reviews. Choosing an answer is a first step; also try to explain which control would prevent the problem.
Trace data from its input to where it is used. Identify what the user controls and whether the application processes it safely before display or an operation. Compare answer options with the actual code; distinguish input validation, output encoding and authorisation checks.
Explore an example: DOM injection →
Read the description without logging in. Solving requires a free account.