Challenge: OWASP Bug Hunt

Below is a small, deliberately-vulnerable Flask app (a mini link-sharing site). It contains four planted OWASP bugs. Your job: find each, identify its category, exploit it locally to confirm, then patch it.

• 🥉 Bronze — find and name all four bugs.
• 🥈 Silver — confirm each with a local proof-of-concept.
• 🥇 Gold — patch all four correctly and re-test to prove the fixes hold.

Save and run this locally. Read it carefully — every bug maps to a lesson you've done (28-35).

# buggy_app.py — DELIBERATELY VULNERABLE. Run locally only. Find 4 bugs.
import sqlite3, hashlib
from flask import Flask, request, session

app = Flask(__name__)
app.secret_key = "hardcoded-secret-123"          # (bug?)

db = sqlite3.connect(":memory:", check_same_thread=False)
db.execute("CREATE TABLE users (id INTEGER, name TEXT, pw TEXT, role TEXT)")
db.execute("INSERT INTO users VALUES (1,'aisha','5f4dcc3b5aa765d61d8327deb882cf99','user')")
db.execute("INSERT INTO users VALUES (2,'admin','21232f297a57a5a743894a0e4a801fc3','admin')")
db.execute("CREATE TABLE notes (id INTEGER, owner_id INTEGER, text TEXT)")
db.execute("INSERT INTO notes VALUES (1,1,'aisha note'),(2,2,'admin secret')")

@app.post("/login")
def login():
    u, p = request.form["user"], request.form["pw"]
    pw_hash = hashlib.md5(p.encode()).hexdigest()        # (bug?)
    row = db.execute(
        f"SELECT id, role FROM users WHERE name='{u}' AND pw='{pw_hash}'").fetchone()  # (bug?)
    if row:
        session["uid"], session["role"] = row[0], row[1]
        return "ok"
    return "no", 401

@app.get("/note/<int:note_id>")
def get_note(note_id):
    row = db.execute("SELECT text FROM notes WHERE id=?", (note_id,)).fetchone()
    return row[0] if row else ("not found", 404)         # (bug?)

@app.get("/search")
def search():
    q = request.args.get("q", "")
    return f"<h1>Results for {q}</h1>"                    # (bug?)

if __name__ == "__main__":
    app.run(debug=True)                                  # (bug?)

The /login route builds its query with an f-string. Confirm the auth bypass, then fix it.

# BUG: A03 SQL Injection (L8-30/31) — f-string query.
# PoC (local): POST /login with user="admin'--" & pw=anything → logs in as admin.

# FIX: parameterised query
row = db.execute(
    "SELECT id, role FROM users WHERE name = ? AND pw = ?",
    (u, pw_hash)).fetchone()
# Re-test: admin'-- now returns None (no such literal user). ✓

Event 2 · Broken Access Control / IDOR (8 min)

The /note/<id> route returns any note by id — no ownership check. Confirm aisha can read admin's secret note, then fix it.

# BUG: A01 Broken Access Control / IDOR (L8-28).
# PoC: logged in as aisha (uid 1), GET /note/2 → returns "admin secret".

# FIX: check ownership against the session user (and role for shared access)
@app.get("/note/<int:note_id>")
def get_note(note_id):
    if "uid" not in session:
        return "login required", 401
    row = db.execute("SELECT text, owner_id FROM notes WHERE id=?",
                     (note_id,)).fetchone()
    if not row or (row[1] != session["uid"] and session.get("role") != "admin"):
        return "not found", 404           # 404, don't reveal it exists
    return row[0]

Event 3 · Reflected XSS (8 min)

The /search route reflects q into HTML unescaped. Confirm a harmless payload runs, then fix it.

# BUG: A07/A03 Reflected XSS (L8-32/33).
# PoC: GET /search?q=<script>alert(1)</script> → script runs in the browser.

# FIX: escape output (and/or render via an auto-escaping template)
import html
@app.get("/search")
def search():
    q = request.args.get("q", "")
    return f"<h1>Results for {html.escape(q)}</h1>"   # <script> → text
# (plus: set a CSP header and HttpOnly cookies for defence in depth)

Two more bugs hide in plain sight: a deployment misconfiguration and a cryptographic failure. Find both.

# BUG: A05 Security Misconfiguration (L8-34) — debug=True in "production".
#   Risk: Werkzeug console = remote code execution; tracebacks leak secrets.
#   FIX: app.run(debug=False)  (control via env: FLASK_DEBUG)

# BUG: A02 Cryptographic Failures (L8-12/13/29):
#   (a) hard-coded secret_key  → load from os.environ["SECRET_KEY"]
#   (b) MD5, UNSALTED password hashes → use bcrypt (salted, slow):
import bcrypt
# store:  bcrypt.hashpw(pw.encode(), bcrypt.gensalt())
# verify: bcrypt.checkpw(pw.encode(), stored_hash)
# MD5 here also means the seeded "passwords" (md5 of 'password'/'admin')
# are instantly reversible via rainbow tables.

You did the full loop of application security on one app: find the bugs by reading code with the OWASP lens, classify each by category, exploit locally to confirm, and patch with the correct defence — then re-test to prove the fix. The four headline bugs were A03 (SQLi → parameterise), A01 (IDOR → ownership check), A07 (XSS → escape + CSP), and A05 (debug → off), with A02 (hard-coded key + MD5 → env + bcrypt) underneath. This is exactly what a security code review and a pentest report look like. Tally your medals and note which category you almost missed — that's where to sharpen.