This is a simple Golang API that contains an example of an Injection vulnerability.
Definition from OWASP:
Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
To build this lab you will need Docker and Docker Compose.
After cloning this repository, you can type the following command to start the vulnerable application:
$ make installThen simply visit localhost:3000 !
To understand how this vulnerability can be exploited, check this section!
(Spoiler alert 🧐) To understand how this vulnerability can be mitigated, check this other section!
Yes, please. ⚡