Time spent: 10 hours spent in total
Objective: Identify vulnerabilities in three different versions of the Globitek website: blue, green, and red.
The six possible exploits are:
- Username Enumeration
- Insecure Direct Object Reference (IDOR)
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Session Hijacking/Fixation
Each version of the site has been given two of the six vulnerabilities. (In other words, all six of the exploits should be assignable to one of the sites.)
-
Vulnerability 1: SQL Injection (SQLi)
-
Vulnerability 2: Session Hijacking/Fixation
-
Vulnerability 1: Username Enumeration
-
Vulnerability 2: Cross-Site Scripting (XSS)
-
Vulnerability 1: Insecure Direct Object Reference (IDOR)
-
Vulnerability 2: Cross-Site Request Forgery (CSRF)
