45. Practice Exercises with Hints
45.7 OWASP Top 10 – Fix What You Break (DVWA / Juice)
SQLi, XSS, IDOR, command injection, SSRF – break on OWN DVWA/Juice, then fix and re-verify.
| Exercise | Task | Hint |
|---|---|---|
| E1 | DVWA SQLi low: prove injection, then patch with prepared statement sketch | Own VM only; never sqlmap a live shop |
| E2 | Reflected XSS: alert proof → output encoding + CSP note | Encoding context matters (HTML vs attr) |
| E3 | IDOR: change id= to another user in lab app → fix authZ check |
Server-side ownership check every request |
| E4 | Command injection on ping field (DVWA) → allow-list args / no shell | Never pass user input to shell |
| E5 | SSRF idea: why cloud metadata is juicy; IMDSv2 as fix theme | Cap One lesson; block link-local from app where possible |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| SQLi / XSS / IDOR on OWN Juice / DVWA | Prepared statements; encoding+CSP; authZ; allow-lists |
| Chains SSRF toward metadata | IMDSv2; egress controls; least-privilege role |
Ravindra Bagale's Tip
Students screenshot alert(1) ani stop. Interview wants fix. Break → Fix → Re-verify. He lakshat theva.
Lab
OWN DVWA: set security low → SQLi module → capture proof → raise to high / apply prepared statement on your fork → prove payload fails. Two screenshots in notes.