Table of Contents

1. Challenge

   Getting Started in the Lab Environment

   Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!

2. Challenge

   Sanitize User Input for C#: Concept Review

   You'll review core web vulnerabilities: SQL Injection, XSS, and CSRF. Learn how untrusted input, unencoded output, and missing request validation expose risks—and how to mitigate them in ASP.NET Core MVC apps.

3. Challenge

   SQL Injection Vulnerability and Mitigation

   You'll analyze a C# console app with a SQL injection vulnerability caused by string concatenation. You'll then refactor it using parameterized queries with SqlCommand and test it with both valid and malicious inputs to confirm the fix.

4. Challenge

   Cross-Site Scripting (XSS) Vulnerability and Prevention

   You'll build a Razor view in ASP.NET Core MVC that initially renders unencoded input, exposing an XSS risk. You'll then apply WebUtility.HtmlEncode and test with script payloads to confirm the secure version renders the input as harmless text.

5. Challenge

   Cross-Site Request Forgery (CSRF) Prevention

   You'll create an ASP.NET Core MVC app with a state-changing form that lacks CSRF protection. You'll then add anti-forgery tokens and apply the ValidateAntiForgeryToken attribute to secure it and ensure POST requests come from trusted sources.

6. Challenge

   Knowledge Check for Sanitize User Input for C# Applications

   In this challenge, you will answer some assessment questions that will test your understanding of the concepts you learned throughout this lab.