A full-day hands-on workshop where developers identify, exploit, and fix common injection vulnerabilities in web apps. Examples provided in Python, JavaScript, and .NET so participants can work in their preferred language.

Workshop Structure

Hour 1: SQL Injection (~50 min)

Intro, vulnerable app demo, exploitation lab, remediation implementation, Q&A.

Hour 2: Command Injection (~50 min)

Intro, vulnerable app demo, exploitation lab, remediation implementation, Q&A.

Hour 3: Command Injection & Cross-Site Scripting (XSS) (~55 min)

Intro, vulnerable app demo, "Eval is Evil" segment, exploitation lab, remediation implementation, Q&A.

Hour 4: Deserialization Vulnerabilities (~50 min)

Intro, vulnerable app demo, exploitation lab, remediation implementation, Q&A.

Hours 5–6: JWT Token Manipulation (~110 min)

Build it: JWT overview, common use cases, integrate a JWT in a web app. Break it: Exploit flaws like decode vs. verify, bad signing, token expiration, denial of service, wrong storage, leaking secrets. Fix it: Step-by-step remediation of exploited flaws.

Hour 7 (Bonus, time permitting)

Other injection techniques, including AI tooling injection.

Exercise Format:

Each section includes pre-configured app code in multiple languages, step-by-step exploitation instructions, example attack payloads, secure code templates, and verification methods.

Requirements

Laptop required. All exercises run locally. Participants should complete pre-distributed setup instructions beforehand; at minimum, Docker and git must be installed and functioning and one language interpreter should be installed and functioning (ideally Python or JavaScript).