Notes / Labs
Interactive security labs
Simulated POSIX-ish shells for three engineering failures. Explore the tree, fail the test, fix the code, make it green. No live production API calls.
Labs
-
SafeMarkdown · protocol-relative
See //evil.example accepted, then rejected after the fix.
-
Function URL · still public
Curl CloudFront vs the raw Function URL, enable the origin check, learn why CORS is not the control.
-
Session BFF · refresh leak
Fetch the session, show HttpOnly cookies, steal via XSS, then fix the BFF.