Vulnerable code snippets with fixes for Web2, Web3, API, iOS, Android and Infrastructure-as-Code (IaC)
- Do you have a great vulnerable code example? Open a PR
♥️
- Top exploitable 2020-2022
-
OWASP Top-10 2021
- A01 - Broken Access Control
- A02 - Cryptographic Failures
- A03 - Injection
- A04 - Insecure Design
- A05 - Security Misconfiguration
- [A06 - Vulnerable and Outdated Components]
- [A07 - Identification and Authentication Failures]
- [A08 - Software and Data Integrity Failures]
- [A09 - Security Logging and Monitoring Failures]
- [A10 - Server-Side Request Forgery]
-
Per vulnerability
- SQL Injection
- NoSQL Injection
- LDAP Injection
- XSS
- SSTI
- XXE
- SSRF
- CSRF
- Code Execution
- Code Injection
- Command Injection
- XPATH Injection
- Insecure Deserialization
- Authentication Bypass
- Broken Access Control
- IDOR
- Directory traversal
- Prototype Pollution
- Insecure File Uploads
- Buffer Overflow
- Integer Overflow
- Denial Of Service
- Sensitive Data Exposure
- Improper Error Handling
- Race Condition
- OWASP API Security Top-10 2019
- API1 - Broken Object Level Authorization
- API2 - Broken User Authentication
- API3 - Excessive Data Exposure
- API4 - Lack of Resources & Rate Limiting
- API5 - Broken Function Level Authorization
- API6 - Mass Assignment
- API7 - Security Misconfiguration
- API8 - Injection
- API9 - Improper Assets Management
- API10 - Insufficient Logging & Monitoring
- Per vulnerability
- OWASP Top 10 Mobile 2016
- Per vulnerability
- Ingress from public internet
- Access keys for the root is present
- Load balancer does not use HTTPS
- Token is not required for instance IMDS access
- Root block device is not encrypted
- IAM policy use of wildcard
- Load balancer is not drop invalid headers
- Load balancer is exposed publicly
- Subnet associates public IP address
- S3 Access block should block public ACL
- S3 Access block should block public policy
- Unencrypted S3 bucket
- CMK is not used for S3 encryption
- VPC Flow Logs is not enabled for VPC
- Bucket does not have logging enabled
- Bucket does not have versioning enabled
- Instance has very low backup retention period
- Log group is not encrypted
- Cluster does not have container insights enabled
- Security group rule does not have a description
All suggestions write to yevhsec1@gmail.com