A Beginners Guide to Security Exploits in Action
summary
A fake MySpace clone called TeamSpace demonstrates five live vulnerabilities and their fixes: SQL injection via raw() string formatting is used to delete a post by injecting a semicolon payload and is fixed by using ORM filters or passing params to raw; unsanitized HTML uses the Bleach library for sanitization to allow safe links/images while blocking scripts; a wildcard ALLOWED_HOSTS plus an open redirect lets attacker-crafted Host headers and next parameters phish logins and hijack password reset links; a hard-coded SECRET_KEY enables forged password-reset tokens and is fixed by rotating secrets and not embedding keys in code.
AI-written summary · about
chapters (8)
- 0:00Introduction and setup
- 1:50Introducing TeamSpace platform
- 2:31SQL injection vulnerability
- 6:32HTML sanitization issues
- 9:05Allowed hosts misconfiguration
- 11:35Open redirect vulnerability
- 13:20Exposed secret key exploit
- 15:54Summary and fixes
