Hackers are watching. Spot vulnerabilities, secure APIs, and protect user data.

Think like a hacker to secure your system. This quiz covers OWASP Top 10, XSS, CSRF, SQL Injection, Auth flaws, and secure coding practices.

Scenario: User input reflected directly in HTML without escaping?

Scenario: Query string concatenated with user input?

Scenario: State-changing request triggered by image tag in email?

Scenario: Saving passwords in plain text?

Scenario: Error message revealing stack trace to user?

Scenario: Missing 'HttpOnly' flag on session cookie?

Scenario: Missing 'Secure' flag on cookie?

Scenario: Direct Object Reference (ID=123) without auth check?

Scenario: Accepting 'http://' links for sensitive data?

Scenario: Using outdated library with known CVE?

Scenario: XML parser resolving external entities?

Scenario: Redirecting to user-supplied URL without validation?

Scenario: JWT signed with 'none' algorithm?

Scenario: Logging sensitive user data (PII)?

Scenario: CORS 'Access-Control-Allow-Origin: *' with credentials?

Scenario: Keeping default CMS admin path?

Scenario: SSRF (Server Side Request Forgery)?

Scenario: Race Condition in coupon usage?

Security Scenarios

What You'll Learn