source-Code-Review

Practice source code review through realistic vulnerable code snippets.

source-Code-Review is built for security researchers, bug bounty hunters, and learners who want to improve their ability to identify vulnerabilities by reading and understanding source code.

Instead of exploitation-focused labs, this repository helps build a core skill many researchers overlook:

manual source code review.

---

Why This Repository Exists

Many learners focus heavily on payloads and automated tooling.

But strong security researchers often find impactful vulnerabilities by simply reviewing code and spotting:

• Broken trust assumptions
• Authorization flaws
• Logic mistakes
• Unsafe input handling

This repository helps develop that review mindset.

---

What You'll Learn

Through these challenges, you'll practice identifying:

• Broken Access Control
• Authentication Bypass
• IDOR
• SQL Injection
• Session Management Issues
• Privilege Escalation
• Business Logic Flaws
• Token Validation Mistakes
• Trust Boundary Failures

---

How It Works

Each challenge follows a simple review flow.

1. Read the Code

Review the provided vulnerable source code snippet.

---

2. Analyze It Yourself

Before revealing the answer, ask:

• What input is attacker-controlled?
• Where is trust granted?
• Is authorization enforced correctly?
• Can application state be manipulated?
• What assumptions does this code make?

---

3. Reveal the Solution

Each file contains a hidden solution section explaining:

• The vulnerability
• Why it exists
• Security impact
• Reviewer mindset

---

Challenge Format

Each challenge is uploaded as an individual markdown file.

code-1.md
code-2.md
code-3.md
...

Every file includes:

• Vulnerable source code
• Solution walkthrough

---

Note: Found an error or inconsistency in any solution? Feel free to open an issue.

Example

fromflaskimportFlask, request, session, jsonifyimportsqlite3app=Flask(__name__)
app.secret_key="secret"defget_db():
conn=sqlite3.connect("users.db")
conn.row_factory=sqlite3.Rowreturnconn@app.route("/profile")defprofile():
if"user_id"notinsession:
return"Unauthorized", 403uid=request.args.get("id", session["user_id"])
db=get_db()
user=db.execute(
"SELECT id, username, email FROM users WHERE id=?",
(uid,)
).fetchone()
returnjsonify(dict(user))

Reveal Solution

Finding

Insecure Direct Object Reference (IDOR)
The application checks whether the user is authenticated:

if"user_id"notinsession:

However, it does not verify whether the requested profile belongs to the authenticated user. An authenticated attacker can access another user's profile by changing the ID: /profile?id=2