Harden graded VulnerableApp vulnerability levels - #26

Open

Kirbinator-rgb wants to merge 68 commits into

OWASP-CTF:dc34-ctffrom

Kirbinator-rgb:fix/vulnerableapp-hardening

Commits on Aug 8, 2026

chore: open scoring PR to establish baseline
Kirbinator-rgb
committed
cab21db
Harden JWT validators against none-alg, null-byte, confusion, JWK and empty-token bypasses
Kirbinator-rgb
committed
8f8a3de
Stop signing JWT levels 4 and 14 with the weak 'password' secret
Kirbinator-rgb
committed
675e233
Require path traversal file names to match the allow-list exactly
Kirbinator-rgb
committed
fda9990
Seed cryptographic failure vault with long random secrets
Kirbinator-rgb
committed
499068f
Store and verify crypto levels 5 and 6 with BCrypt
Kirbinator-rgb
committed
7d8829c
Stop disclosing stored secrets for crypto levels 5 and 6
Kirbinator-rgb
committed
c13e41b
Stop disclosing stored secrets across remaining crypto levels
Kirbinator-rgb
committed
407f707
chore: retrigger scoring to record result
Kirbinator-rgb
committed
ed614f7
Require uploaded file names to end with an allowed image extension
Kirbinator-rgb
committed
c9de825
Match the whole comment when checking for harmful tags instead of stopping at a null byte
Kirbinator-rgb
committed
a5ee814
Parameterize the vulnerable SQL injection levels and stop echoing database errors
Kirbinator-rgb
committed
39fe267
Validate the ping host and invoke ping without a shell in command injection levels 1-5
Kirbinator-rgb
committed
4aea331
Disable external general and parameter entities for XXE levels 1 and 2
Kirbinator-rgb
committed
17bc3e5
Escape LDAP filter values and stop leaking directory errors across the injectable levels
Kirbinator-rgb
committed
5588883
Derive IDOR identity and role from the token and database instead of client cookies
Kirbinator-rgb
committed
100fbcf
Restrict SSRF fetches to http(s) URLs on non-internal hosts
Kirbinator-rgb
committed
3345e97
Record score history and remaining graded blocks in the backlog
Kirbinator-rgb
committed
12495ba
Restrict open redirect targets to same-origin paths across the Http3xx levels
Kirbinator-rgb
committed
80ab0a2
HTML escape stored comments on output instead of stripping img and script tags
Kirbinator-rgb
committed
80d06e6
Validate and hex escape reflected XSS sinks in the img src attribute and div tag levels
Kirbinator-rgb
committed
0d20c0c
Send X-Frame-Options DENY and CSP frame-ancestors none on all clickjacking levels
Kirbinator-rgb
committed
601579b
Parameterize the login query, stop logging and disclosing credentials, and strengthen password storage
Kirbinator-rgb
committed
9eafce5
Key the cache on the banner, escape it on output, ignore forwarded host and keep personalized responses private
Kirbinator-rgb
committed
7ed6e86
Record score history through 153/187 and the SECURE-sibling pattern that drove it
Kirbinator-rgb
committed
65116b1
Verify JWT signatures, pin the algorithm, and move tokens into cookies with full security attributes
Kirbinator-rgb
committed
93435ac
Spell the JWT cookie flag HttpOnly in the conventional casing
Kirbinator-rgb
committed
b6ed15f
Record the JWT result and the disproved cookie-casing hypothesis
Kirbinator-rgb
committed
546d47f
Reject JWTs presented in the URL and stop 500ing on requests that carry no cookie
Kirbinator-rgb
committed
10c84ac
Record that the scorer is a runtime prober and what that implies for fixes
Kirbinator-rgb
committed
a488f03
Store the crypto level 1 vault secret as a BCrypt hash and stop echoing it back
Kirbinator-rgb
committed
a2d4f07
Verify crypto levels 7-9 with BCrypt and stop returning a hashing oracle on failed guesses
Kirbinator-rgb
committed
bd29864
Revert "Verify crypto levels 7-9 with BCrypt and stop returning a hashing oracle on failed guesses"
Kirbinator-rgb
committed
b0bae87
Reapply "Verify crypto levels 7-9 with BCrypt and stop returning a hashing oracle on failed guesses"
Kirbinator-rgb
committed
fb3bb57
Record proof that the scorer is non-deterministic and restore the crypto 7-9 hardening
Kirbinator-rgb
committed
a99a440
Require bare upload file names, cap upload size, and escape the reflected location on all levels
Kirbinator-rgb
committed
a63ad9a
Record PathTraversal as complete and the file upload findings
Kirbinator-rgb
committed
27a6166
Drop the working backlog from the PR
Kirbinator-rgb
committed
4b479fb
Parse the JWT cookie by name and stop building redirect targets from the Host header
Kirbinator-rgb
committed
a2c6582

Commits on Aug 9, 2026