Skip to main content

​
Auth Security Demo

Educational web security demonstration project showcasing common vulnerabilities and their secure implementations in Flask applications

Get StartedView on GitHub

​
What You’ll Learn

This project provides a safe, controlled environment to explore common web security vulnerabilities through side-by-side comparisons of vulnerable and secure code implementations.

SQL Injection

Learn how attackers bypass authentication and extract data through SQL injection attacks

Cross-Site Scripting

Understand XSS vulnerabilities and how to prevent malicious script injection

Access Control

Explore Insecure Direct Object Reference and proper authorization checks

Password Security

Compare plaintext storage with secure password hashing techniques

​
Key Features

Hands-On Learning

Two parallel Flask applications demonstrating vulnerable vs secure implementations

Real-World Examples

Actual exploits and fixes based on OWASP Top 10 vulnerabilities

Educational Focus

Designed for security students, developers, and penetration testers

Easy Setup

Quick installation with Python and SQLite - no complex infrastructure needed

Code Comparisons

Side-by-side vulnerable and secure code to understand the differences

Best Practices

Learn industry-standard security patterns and mitigation techniques

​
Vulnerabilities Covered

Authentication bypass through malicious SQL query manipulation. Learn how parameterized queries and prepared statements prevent this critical vulnerability.
JavaScript injection attacks that can steal cookies, hijack sessions, or deface websites. Understand output encoding and Content Security Policy.
Unauthorized access to other users’ data by manipulating object references. Learn proper authorization checks and access control.
Storing passwords in plaintext vs using bcrypt hashing with automatic salting. Critical for protecting user credentials.
Weak session handling, predictable session IDs, and missing security flags. Learn secure session configuration.
Cross-Site Request Forgery attacks that trick users into executing unwanted actions. Implement token-based CSRF protection.
Exposed error messages, debug mode in production, and hardcoded secrets. Learn security headers and environment management.
Leaking sensitive information through error messages, logs, or responses. Understand data minimization and error handling.
Educational Use OnlyThis project is designed exclusively for educational purposes in controlled environments. Never use these techniques on systems without explicit authorization. Unauthorized access is illegal and can result in criminal charges.

​
Quick Start

1

Clone the Repository

Get started by cloning the project and installing dependencies
git clone https://github.com/darkroot192-sudo/auth-security-project.git
cd auth-security-project
2

Run the Demos

Launch both vulnerable and secure versions to compare implementations
# Run vulnerable version
cd vulnerable && python app.py

# Run secure version (in separate terminal)
cd secure && python app.py
3

Explore Vulnerabilities

Follow the guided tutorials to test each vulnerability in a safe environment

​
Why This Matters

Web application security is critical in today’s digital landscape. According to OWASP, injection attacks and broken authentication remain among the most common and dangerous vulnerabilities. This project helps you:
  • Understand attacker mindset - See how vulnerabilities are exploited in practice
  • Write secure code - Learn defensive programming techniques and security patterns
  • Pass security audits - Apply best practices that meet industry standards
  • Protect user data - Implement proper authentication, authorization, and data protection

Ready to Learn?

Jump into the quickstart guide and run your first security demonstration

Build docs developers (and LLMs) love

Get started for freeTalk to us