Security Lab

Brute Force

A brute force attack tries many passwords until one succeeds. Weak passwords are easy to guess, so protecting login forms is critical to stop attackers from gaining access.

SQL Injection

SQL injection allows malicious input to alter the database query. It matters because attackers can bypass filters and retrieve all records from the system.

SELECT * FROM users WHERE username = '';

XSS (Cross Site Scripting)

XSS injects script into a web page so it runs in another user's browser. It matters because it can hijack sessions and manipulate page content without server permission.

Command Injection

Command injection occurs when user input is run by the server shell. It matters because attackers can execute system commands and access sensitive server data.

File Upload

Unsafe file upload handling lets attackers store executable files on the server. It matters because those files can be accessed and run later as if they were trusted content.

What I Learned

Built in a real Kali Linux home lab using Docker, Nmap, Python and Burp Suite.

• Brute Force: No rate limiting means any password can be cracked automatically. Defence: account lockout + MFA.
• SQL Injection: Unsanitised input breaks database queries. Defence: parameterised queries only.
• XSS: User input rendered as HTML gives attackers full browser control. Defence: encode all output.
• Command Injection: Shell commands built from user input lead to full server compromise. Defence: never pass user input to system calls.
• File Upload: Accepting any file type lets attackers upload and execute server-side code. Defence: validate file type server-side and rename all uploads.