Pygoat - Learn django security the hard way with Adarsh Divakaran
summary
Pygoat is an intentionally vulnerable Django app that gets deployed and attacked live, demonstrating concrete fixes for SQL injection via raw queries, command execution from user input via subprocess, and remote code execution through unsafe yaml load versions. Demos show leaking secrets when DEBUG=True, brute forcing a three‑digit OTP because of no rate limiting, and replacing raw SQL with parameterized ORM calls and patched dependencies so the vulnerabilities are actually closed.
AI-written summary · about
chapters (9)
- 0:00PyGoat and web security
- 3:52SQL injection in Django
- 7:54Shell injection and command execution
- 10:50XSS and code execution
- 14:51Django security misconfiguration
- 17:00Outdated dependencies vulnerabilities
- 20:09Brute-forcing OTP access
- 24:42Real-world mitigation examples
- 25:43Resources and closing
related talks
29mSecuring Django Applications
48mPractical Django Secuirty
30mThink Like a Hacker
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
01h 02mLive Hacking: Breaking into your Web App
26mMaking Django Really, Really, Ridiculously Secure (CW)
26mTesting Python Security
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You