About the Lab
Authorized · EducationalPurpose
The Cybersecurity Demonstration Lab is a self-contained teaching tool for a university workshop. It shows three major web-security topics — SQL Injection, Cross-Site Scripting, and API security — as working demonstrations, pairing each vulnerable implementation with its secure counterpart so students can see both the attack and the fix.
Scope & safety
- This is a hosted copy of the lab. It holds only fictional data, and each attack is contained to that data or a sandboxed preview.
- All accounts, records and credentials are fictional. The
.envvalues are fake demonstration placeholders, not real cloud IAM credentials. - Attack payloads are controlled and harmless (a SQL auth-bypass against a
local table, a JavaScript
alert()inside a sandboxed iframe). - Secrets are read only on the backend and never sent to the browser; there is no endpoint that returns the full environment.
This is an intentionally vulnerable environment for authorized learning. Do not run the techniques against systems you don't own.
What each lab covers
Unsafe query construction vs. parameterized queries; the
' OR '1'='1 auth bypass.
Raw HTML rendering vs. output encoding; sandboxed, CSP-locked preview of script execution.
Broken auth, BOLA/IDOR, RBAC, rate limiting and API-key exposure — each with a secure mode.
Insecure HTTP interception vs. HTTPS/TLS transport encryption; certificate verification and confidentiality in transit.
How excess traffic exhausts server capacity and how layered defenses restore service, using a local mathematical simulation only.
Fictional lab accounts
| Username | Password | Role | Use |
|---|---|---|---|
| admin | admin123 | admin | SQLi login · API admin token |
| student | Student@12345 | user | API non-admin token |
| alice | wonderland | user | IDOR target record |
| bob | builder | user | IDOR target record |
All fictional and local. Shown here for the workshop only.
Tech stack
Frontend: HTML · CSS · vanilla JS | Backend: Python FastAPI | DB: SQLite | Config: python-dotenv | Architecture: Frontend → FastAPI → SQLite