Unit 10: Capstone: review the shop · Lesson 2 of 4 · 26 min

Reproduce the findings

Each finding needs one command a developer can run to see it for themselves.

mission

You are
The analyst leading the shop's review.
Situation
You found the issues across the earlier units. Now you capture one clean reproduction for each, so nobody can wave it away.
Goal
Reproduce the highest severity findings in one command each.
Hand in
A command and its output for every high finding.

A finding that holds up

  1. CommandExactly what you ran
  2. OutputExactly what came back
  3. Why it mattersThe risk in one sentence
  4. Fix and retestThe same command after the fix
01

Orders API trusts any origin

learner@web-lab
curl -si -H 'Origin: https://anything.example' http://127.0.0.1:8000/api/orders | grep -i access-control
Access-Control-Allow-Origin: https://anything.example
Access-Control-Allow-Credentials: true

you should see The origin you sent, reflected, with credentials allowed.

02

API leaks the password hash

learner@web-lab
curl -s -d @shop-account.txt http://127.0.0.1:8000/api/token | jq -r .access_token > t.txt
curl -s -H "Authorization: Bearer $(cat t.txt)" http://127.0.0.1:8000/api/v1/me | jq 'has("password_hash")'
true

you should see true: the hash is in the response.

03

Expired token still works

learner@web-lab
curl -s -o /dev/null -w '%{http_code}\n' -H "Authorization: Bearer $(cat t.txt)" http://127.0.0.1:8000/api/v1/me
200

you should see 200, although the token's exp is 09:15 on 14 October 2026.

04

Session survives sign-out

learner@web-lab
curl -s -o /dev/null -c j.txt -d @shop-account.txt http://127.0.0.1:8000/login
curl -s -o /dev/null -b j.txt -c j.txt http://127.0.0.1:8000/logout
curl -s -o /dev/null -w '%{http_code}\n' -b 'shop_session=7f3a9c2e41d8b6a5' http://127.0.0.1:8000/account
200

you should see 200 after sign-out: the server still honours the old session.

05

Legacy password storage

learner@web-lab
grep -c '^[^,]*,[^,]*,md5' accounts-export.csv
3

you should see Three accounts still on unsalted MD5.

defender tip A reproduction is worth more than a description. Paste the command and its output straight into the finding.

What a defender takes away

  1. 1Every finding gets a one-command reproduction.
  2. 2Show the output, not just the command.
  3. 3Reproductions double as the retest script after a fix.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.