Practice / sec

Security practice

Every Security exercise, built from a topic you can open beside it.

26 exercises runs offline

26 exercises · 0 done

sort

Unsolved first Newest Hardest

sec Quiz new A request carries a correctly verified access token. What must the order endpoint still d… Protect API request boundaries by authenticating callers, constraining inputs and resource use, and authorizing every object, action, and response field. beginner 1 min · from API security sec Quiz new Which design keeps one authenticated user's quota consistent across four API instances? Protect API request boundaries by authenticating callers, constraining inputs and resource use, and authorizing every object, action, and response field. intermediate 1 min · from API security sec Predict the output new What does this object-level authorization policy print? Protect API request boundaries by authenticating callers, constraining inputs and resource use, and authorizing every object, action, and response field. beginner 2 min · from API security sec Review AI code new Review generated order updater Protect API request boundaries by authenticating callers, constraining inputs and resource use, and authorizing every object, action, and response field. advanced 6 min · from API security sec Spot the bug new Spot the bug in the order reader Protect API request boundaries by authenticating callers, constraining inputs and resource use, and authorizing every object, action, and response field. intermediate 4 min · from API security sec Quiz new Which response contract lets an allowed frontend read a cross-origin response to fetch wi… How browsers use CORS to share cross-origin responses, including origins, preflights, credentials, caching, and security boundaries. intermediate 1 min · from CORS sec Predict the output new What does this exact origin comparison print? How browsers use CORS to share cross-origin responses, including origins, preflights, credentials, caching, and security boundaries. beginner 2 min · from CORS sec Review AI code new Review generated CORS middleware How browsers use CORS to share cross-origin responses, including origins, preflights, credentials, caching, and security boundaries. advanced 6 min · from CORS sec Quiz new A cross-origin form-encoded POST is sent without a preflight, but its response has no Acc… How browsers use CORS to share cross-origin responses, including origins, preflights, credentials, caching, and security boundaries. intermediate 1 min · from CORS sec Spot the bug new Spot the bug in the CORS helper How browsers use CORS to share cross-origin responses, including origins, preflights, credentials, caching, and security boundaries. intermediate 4 min · from CORS sec Quiz new Which directive controls which parent pages may embed the current response? Security response headers turn browser behavior into reviewable policy across CSP, HSTS, MIME handling, embedding, permissions, and deployment. beginner 1 min · from Security response headers sec Quiz new What closes the first-visit HTTP window that an ordinary HSTS response cannot close by it… Security response headers turn browser behavior into reviewable policy across CSP, HSTS, MIME handling, embedding, permissions, and deployment. intermediate 1 min · from Security response headers sec Predict the output new What does this response-header builder print? Security response headers turn browser behavior into reviewable policy across CSP, HSTS, MIME handling, embedding, permissions, and deployment. beginner 2 min · from Security response headers sec Review AI code new Review generated dashboard response Security response headers turn browser behavior into reviewable policy across CSP, HSTS, MIME handling, embedding, permissions, and deployment. advanced 6 min · from Security response headers sec Spot the bug new Spot the bug in the CSP nonce middleware Security response headers turn browser behavior into reviewable policy across CSP, HSTS, MIME handling, embedding, permissions, and deployment. intermediate 4 min · from Security response headers sec Quiz new Code approves a DNS answer and then gives the original URL to an HTTP client that resolve… How untrusted destinations turn server-side fetches into SSRF, and how to bind validation, redirects, and egress to one policy. intermediate 1 min · from Server-side request forgery sec Quiz new An EC2 workload requires IMDSv2. Which statement about its SSRF posture is accurate? How untrusted destinations turn server-side fetches into SSRF, and how to bind validation, redirects, and egress to one policy. intermediate 1 min · from Server-side request forgery sec Predict the output new What authority fields does the URL parser print? How untrusted destinations turn server-side fetches into SSRF, and how to bind validation, redirects, and egress to one policy. beginner 2 min · from Server-side request forgery sec Review AI code new Review generated webhook delivery How untrusted destinations turn server-side fetches into SSRF, and how to bind validation, redirects, and egress to one policy. advanced 6 min · from Server-side request forgery sec Spot the bug new Spot the bug in the preview helper How untrusted destinations turn server-side fetches into SSRF, and how to bind validation, redirects, and egress to one policy. intermediate 4 min · from Server-side request forgery sec Quiz new A validated invoice ID is inserted into a SQL query. Which control protects the SQL inter… Understand browser-server trust boundaries and stop common web vulnerabilities with encoding, parameterization, authorization, and CSRF defenses. beginner 2 min · from Web security fundamentals sec Quiz new What does a correctly configured CORS policy primarily control? Understand browser-server trust boundaries and stop common web vulnerabilities with encoding, parameterization, authorization, and CSRF defenses. intermediate 2 min · from Web security fundamentals sec Quiz new Which statement best describes Content Security Policy in an XSS defense? Understand browser-server trust boundaries and stop common web vulnerabilities with encoding, parameterization, authorization, and CSRF defenses. intermediate 2 min · from Web security fundamentals sec Predict the output new What does this program print on its second line? Understand browser-server trust boundaries and stop common web vulnerabilities with encoding, parameterization, authorization, and CSRF defenses. beginner 2 min · from Web security fundamentals sec Review AI code new Review generated invoice updater Understand browser-server trust boundaries and stop common web vulnerabilities with encoding, parameterization, authorization, and CSRF defenses. advanced 10 min · from Web security fundamentals sec Spot the bug new Spot the bug in the profile handler Understand browser-server trust boundaries and stop common web vulnerabilities with encoding, parameterization, authorization, and CSRF defenses. intermediate 5 min · from Web security fundamentals