secDevLabs - A laboratory for learning secure web and mobile de

项目说明

<p align="center">
<img src="images/secDe.png" allign="center" height=""/>
<!-- logo font: Agency FB Bold Condensed -->
</p>

<p align="center">
A laboratory for learning secure web and mobile de in a practical manner.
</p>

<p align="center">
<a href=" src="
<a href=" src="
</p>

Build your lab

By pro local en , you will learn how the most critical web application security risks are exploited and how these codes can be fixed to mitigate them. 👩‍💻

How do I start?

After forking this repository, you will find multiple intended apps based on real-life scenarios in languages such as Golang, Python and PHP. A good start would be installing the ones you are most familiar with. You can find instructions to do this on each of the apps. 💡

Each of them has an Attack Narrative section that describes how an attacker would exploit the corresponding . Before reading any code, it may be a good idea following these steps so you can better understand the attack itself. 💉

Now it's time to shield the application up! Imagine that this is your application and you need to fix these flaws! Your mission is writing new codes that mitigate them and sending a new Pull Request to deploy a secure app! 🔐

How secure is my new code?

After mitigating a , you can send a Pull Request to gently ask the secDevLabs community to review your new secure codes. If you're feeling a bit lost, try having a look at this mitigation solution, it might help! 🚀

OWASP Top 10 (2021) apps: 💻

Disclaimer: You are about to install apps in your machine! 🔥

| | Language | Application |
| --------------------------------------------- | -------------- | ------------------------------------------------------------------------------- |
| A1 - Broken Access Control | Golang | Ecommerce API |
| A1 - Broken Access Control | NodeJS | Tic-Tac-Toe |
| A1 - Broken Access Control | Golang | Camplake-API |
| A2 - Cryptographic Failures | Golang | SnakePro |
| A3 - Injection | Golang | CopyNPaste API |
| A3 - Injection | NodeJS | Mongection |
| A3 - Injection | Python | SSType |
| A3 - Injection (XSS) | Python | Gossip World |
| A3 - Injection (XSS) | React | Comment Killer |
| A3 - Injection (XSS) | Angular/Spring | Streaming |
| A4 - Insecure Design | React/Go | Super Recovery Password App |
| A5 - Security Misconfiguration (XXE) | PHP | Blog |
| A5 - Security Misconfiguration | PHP | Wordpress Misconfig |
| A5 - Security Misconfiguration | NodeJS | Stegonography |
| A6 - and Outdated Components | PHP | Cimentech |
| A6 - and Outdated Components | Python | Golden Hat Society |
| A7 - Identity and Authentication Failures | Python | Saidajaula Monster Fit |
| A7 - Identity and Authentication Failures | Golang | Insecure go project |
| A8 - Software and Data Integrity Failures | Python | Amarelo Designs |
| A9 - Security Logging and Monitoring Failures | Python | GamesIrados.com |

OWASP Top 10 (2016) Mobile apps: 📲

Disclaimer: You are about to install mobile apps in your machine! 🔥

| | Language | Application |
| ------------------------------ | ------------ | --------------------------------------------------- |
| M2 - Insecure Data Storage | Dart/Flutter | Cool Games |
| M4 - Insecure Authentication | Dart/Flutter | Note Box |
| M5 - Insufficient Cryptography | Dart/Flutter | Panda Zap |

Contributing

We encourage you to contribute to SecDevLabs! Please check out the Contributing to SecDevLabs section for guidelines on how to proceed! 🎉

License

This project is licensed under the BSD 3-Clause "New" or "Revised" License - read LICENSE.md file for details. 📖

项目信息

开发语言：PHP

Star 数：979

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A laboratory for learning secure web and mobile development in a practical manner.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。