- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Security
Sanitize User Input for Python
In this lab, you will step into the role of an Application Security Engineer tasked with auditing and securing a web application portal for an enterprise platform. The application relies on a Python Flask backend, manages database authentication, and handles user profile management features such as updating personal bios and changing passwords. During a routine security review, you discover critical vulnerabilities across the application's input processing and rendering pipelines. Unsanitized string concatenation in database queries permits login bypass via SQL Injection (SQLi), disabled output encoding in templates introduces Cross-Site Scripting (XSS), and unvalidated state-changing endpoints expose user sessions to Cross-Site Request Forgery (CSRF). Your objective is to investigate these input handling flaws, safely demonstrate how they can be exploited, and implement remediations using parameterized database queries, Jinja2 contextual auto-escaping, Content Security Policy (CSP) headers via Flask-Talisman, and anti-CSRF middleware via Flask-WTF. ### What you'll learn By the end of this lab, you will be able to: - Identify and exploit SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) vulnerabilities in a Python application stack. - Explain why raw string concatenation and explicit auto-escape bypasses break execution boundaries between code and data. - Replace insecure string-formatted database queries with parameterized queries. - Enforce contextual output encoding and restrict script execution using Content Security Policy (CSP) headers. - Implement the Synchronizer Token Pattern using CSRF protection middleware to secure state-changing `POST` requests.
Lab Info
Table of Contents
-
Challenge
Prevent SQL injection
SQL injection (SQLi) is a common vulnerability that occurs when developers do not handle sensitive user input properly. It can occur when data from an untrusted source is inserted directly into a database query. In this exercise, you will learn how to identify SQL injection vulnerabilities in code and prevent them using well-established techniques.
-
Challenge
Prevent Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks
Cross-Site Scripting (XSS) occurs when an attacker injects malicious code into a website that executes in a user's browser, potentially exposing sensitive information such as passwords or session cookies. Cross-Site Request Forgery (CSRF) occurs when an attacker tricks an authenticated user's browser into sending an unauthorized request to a trusted website, which can result in unintended actions such as changing passwords or making unauthorized purchases. In this exercise, you will execute XSS and CSRF attacks and then implement countermeasures to prevent them.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.