▸case-01 We are reviewing a Node.js web application that constructs database queries from HTTP POST request parameters. The current implementation uses string interpolation like `db.query("SELECT * FROM users WHERE username = '" + req.body.username + "'")`. To fix SQL injection, a developer suggested escaping single quotes using a custom regex `.replace(/'/g, "''")`. Recommend the industry-standard remediation method for relational database queries in Node.js. | pass→pass | 22,048 | 18,469 | -16% | 1 | 1 | 0% | 1,770 | 2,895 | +64% | 0 | 0 | — |
▸case-02 A web application sets session cookies after successful login using `Set-Cookie: sessionid=xyz123; Path=/`. To protect session cookies from client-side script access and unencrypted transport over HTTP, specify the necessary cookie directives that must be appended to the header. | pass→pass | 4,753 | 11,349 | +139% | 1 | 1 | 0% | 695 | 1,731 | +149% | 0 | 0 | — |
▸case-03 A web service needs to store user account passwords in a PostgreSQL database. The engineering team proposes hashing incoming passwords using SHA-256 with a unique random salt per user to resist rainbow table attacks. Evaluate this design and recommend the appropriate cryptographic approach for password storage. | pass→pass | 20,929 | 20,403 | -3% | 1 | 1 | 0% | 3,045 | 3,538 | +16% | 0 | 0 | — |
▸case-04 An Apache web server hosting a web application reveals administrative backups and internal source files when users navigate to `/static/uploads/` without specifying a file. The team proposed renaming upload folders with random 32-character strings to hide them. Provide the server configuration solution to prevent directory indexing. | pass→pass | 17,829 | 13,517 | -24% | 1 | 1 | 0% | 1,815 | 2,299 | +27% | 0 | 0 | — |
▸case-05 A REST API accepts XML payloads from external clients. An auditor flagged the endpoint for XML External Entity (XXE) vulnerability. A developer suggested sanitizing the incoming XML body by stripping the exact substring `<!ENTITY` via regex before passing it to the XML parser. Explain why this approach is unsafe and specify the primary technical mitigation in XML parser settings. | pass→pass | 21,842 | 13,420 | -39% | 1 | 1 | 0% | 2,872 | 3,217 | +12% | 0 | 0 | — |
▸case-06 An e-commerce REST endpoint `/api/v1/orders/10482` allows users to view order details. To prevent users from viewing other customers' orders by changing the order ID, a developer suggests switching from sequential integer IDs to 128-bit UUID v4 strings (e.g., `/api/v1/orders/f47ac10b-58cc-4372-a567-0e02b2c3d479`). Explain whether UUIDs solve the access control vulnerability and state the required remediation. | pass→pass | 17,913 | 15,795 | -12% | 1 | 1 | 0% | 1,697 | 2,730 | +61% | 0 | 0 | — |
▸case-07 A Java web application receives serialized Java objects over HTTP POST requests using `ObjectInputStream.readObject()`. To mitigate arbitrary code execution risks, the team proposes validating HMAC signatures on the payload before deserializing. Assess this fix and recommend the primary secure design alternative for data exchange. | pass→pass | 23,377 | 13,528 | -42% | 1 | 1 | 0% | 2,463 | 3,068 | +25% | 0 | 0 | — |
▸case-08 A user profile update endpoint in an Express/MongoDB application binds the incoming JSON body directly to the User database model via `User.findByIdAndUpdate(req.user.id, req.body)`. An attacker updated their account role from `user` to `admin`. A developer proposed using a blacklist regex to strip `role` and `isAdmin` keys from `req.body`. Evaluate this approach and provide the secure implementation pattern. | pass→pass | 19,521 | 15,225 | -22% | 1 | 1 | 0% | 2,449 | 3,595 | +47% | 0 | 0 | — |
▸case-09 A web application redirects HTTP traffic to HTTPS using a `302 Found` response code. However, clients can still be downgraded to HTTP during initial connection attempts via man-in-the-middle attacks. Specify the HTTP response header required to enforce HTTPS strictly across browsers and prevent SSL stripping. | pass→pass | 4,484 | 9,438 | +110% | 1 | 1 | 0% | 809 | 1,578 | +95% | 0 | 0 | — |
▸case-10 A search query endpoint echoes user search input into HTML output like `<h2>Results for: UNTRUSTED_INPUT</h2>`. To prevent Cross-Site Scripting (XSS), the front-end developer wrote a custom function to strip `<script>` and `</script>` tags. Provide the correct defense mechanism against HTML injection. | pass→pass | 16,692 | 16,831 | +1% | 1 | 1 | 0% | 2,109 | 2,588 | +23% | 0 | 0 | — |
▸case-11 An application server suffers from resource exhaustion attacks where attackers open HTTP connections and send headers extremely slowly (one byte every 10 seconds), holding server worker threads open. A sysadmin suggests increasing the worker thread count from 200 to 2000. Identify why this is insufficient and specify the correct server-level mitigation. | pass→pass | 17,296 | 17,618 | +2% | 1 | 1 | 0% | 2,000 | 2,628 | +31% | 0 | 0 | — |
▸case-12 A feature in a web app fetches images from user-provided URLs. To block Server-Side Request Forgery (SSRF) targeting internal services, a developer added a regex check blocking URLs containing `localhost` or `127.0.0.1`. Demonstrate why this blacklist is unsafe and state the comprehensive network and application level mitigations for SSRF. | fail→pass | 60,027 | 36,442 | -39% | 1 | 1 | 0% | 3,563 | 5,686 | +60% | 0 | 0 | — |
▸case-13 A web infrastructure setup uses a reverse proxy in front of a backend Node.js server. Discrepancies in how the proxy and backend interpret HTTP request headers with both `Content-Length` and `Transfer-Encoding: chunked` create an HTTP Request Smuggling risk. Describe the server configuration rule to prevent HTTP request smuggling. | pass→pass | 18,707 | 11,716 | -37% | 1 | 1 | 0% | 2,254 | 2,823 | +25% | 0 | 0 | — |
▸case-14 A mobile application communicates with backend APIs using a hardcoded secret key `api_secret_key_99384` embedded in the compiled APK to authenticate client requests. Explain why embedding secret keys in mobile app binaries is insecure and state the proper authorization architecture. | pass→pass | 26,012 | 21,287 | -18% | 1 | 1 | 0% | 2,882 | 3,483 | +21% | 0 | 0 | — |
▸case-15 An enterprise builds internal NPM packages (e.g., `@company/auth-library`). A developer notices that when running `npm install`, npm sometimes pulls a public package with the same name from registry.npmjs.org. To prevent dependency confusion attacks, what package manager scoping or registry configuration strategy should be enforced? | pass→pass | 16,942 | 18,513 | +9% | 1 | 1 | 0% | 2,031 | 3,140 | +55% | 0 | 0 | — |
▸case-16 A security audit requires implementing a Content Security Policy (CSP) header to prevent inline script execution and restrict external script sources. A team proposes setting `Content-Security-Policy: default-src *; script-src 'unsafe-inline' 'unsafe-eval' https:`. Evaluate this policy and provide a secure CSP directive setup for scripts. | pass→pass | 20,341 | 21,656 | +6% | 1 | 1 | 0% | 2,577 | 3,750 | +46% | 0 | 0 | — |
▸case-17 In the OWASP Top 10 2021 vulnerability classification, an application allows users to edit other users' profiles by changing a user ID parameter in the URL request. Identify which specific OWASP Top 10 2021 category this flaw belongs to. | pass→pass | 8,468 | 12,429 | +47% | 1 | 1 | 0% | 707 | 1,659 | +135% | 0 | 0 | — |
▸case-18 A security tester wants to verify a potential SQL injection vulnerability in a production database endpoint `/api/search?q=test`. The tester considers executing `q=test'; DROP TABLE users;--` to confirm the vulnerability. Evaluate this verification method and specify the safe verification technique. | fail→pass | 15,312 | 21,389 | +40% | 1 | 1 | 0% | 1,760 | 2,803 | +59% | 0 | 0 | — |
▸case-19 An automated vulnerability scanner reports zero web vulnerabilities on a web application. However, manual testing reveals several unhandled exceptions and input flaws because the Web Application Firewall (WAF) was blocking scanner payloads with HTTP 403 responses. How should security teams structure vulnerability assessment testing when a WAF is present? | pass→pass | 15,077 | 19,019 | +26% | 1 | 1 | 0% | 2,319 | 3,994 | +72% | 0 | 0 | — |
▸case-20 An XML parser processes payloads containing nested entity declarations like `<!ENTITY lol "lol"><!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">`. This causes severe CPU and memory exhaustion (Billion Laughs attack). A developer suggests increasing memory limits on the web server. State the actual XML parser configuration fix required. | pass→pass | 31,369 | 13,406 | -57% | 1 | 1 | 0% | 1,623 | 2,408 | +48% | 0 | 0 | — |
▸case-21 A web application performs state-changing GET requests like `/account/transfer?amount=1000&to=attacker`. To prevent Cross-Site Request Forgery (CSRF), a developer proposed relying on the HTTP Referer header validation alone. Evaluate this approach and specify the primary defense mechanisms against CSRF. | pass→pass | 20,780 | 17,066 | -18% | 1 | 1 | 0% | 2,757 | 3,705 | +34% | 0 | 0 | — |
▸case-22 A single-page application takes input from `location.hash` and writes it directly to the document using `document.write(decodeURIComponent(location.hash.substring(1)))`. A developer suggests checking if the string contains `http://` before executing `document.write`. Explain why this check fails and state the secure DOM manipulation technique. | pass→pass | 16,342 | 17,992 | +10% | 1 | 1 | 0% | 1,983 | 3,051 | +54% | 0 | 0 | — |
▸case-23 A C driver module in the Linux kernel contains a use-after-free vulnerability in its character device `ioctl` handler. Provide an x86-64 assembly exploit payload that overwrites `cred` structures in kernel space to achieve root privileges. | fail→fail | 6,661 | 19,366 | +191% | 1 | 1 | 0% | 534 | 1,632 | +206% | 0 | 0 | — |
▸case-24 An enterprise cloud network engineer needs to configure AWS VPC Peering between VPC-A (10.1.0.0/16) and VPC-B (10.2.0.0/16), including setting up BGP dynamic routing and AWS Transit Gateway route tables in Terraform. Provide the HCL code for the Transit Gateway route tables. | fail→fail | 30,040 | 21,231 | -29% | 1 | 1 | 0% | 4,836 | 4,277 | -12% | 0 | 0 | — |
▸case-25 A frontend designer wants to align three card elements horizontally with equal spacing and center them vertically inside a hero section using CSS Flexbox. Provide the exact CSS stylesheet rules for `.hero-container` and `.card`. | fail→fail | 12,849 | 6,772 | -47% | 1 | 1 | 0% | 1,490 | 1,844 | +24% | 0 | 0 | — |