Web Application Security Lab: Find, Exploit & Fix SQL Injection, Authentication Bypass & Privilege Escalation (Flask, SQL Server, Burp Suite)

This kit is a hands-on web application security lab report that walks through the full cycle of build it weak, attack it, assess it, then fix it. It uses a two-machine setup: a Kali Linux VM running a Python/Flask app with Burp Suite, and a Windows host running Microsoft SQL Server. It aligns with OWASP guidance and with ISO/IEC 27001 secure-development controls.

What is inside:

Introduction and aim: why injection and broken authentication rank among the most serious risks in the OWASP Top 10, with the four lab topics: SQL injection, authentication bypass, privilege escalation and request tampering. Lab environment and architecture: the attacker and web tier (Kali, Flask, Python 3 venv, Burp Suite proxy, pyodbc) connected over a host-only LAN to the data tier (SQL Server, SSMS, lab_db and its Users table). Phase 1, Build (Tasks 1–4): Python environment setup, database creation, the base Flask app with a protected /dashboard, and the login form.

Phase 2, Attack (Tasks 5–12)

SQL injection that skips the login, rated Critical. Authentication bypass where any password works, rated High. Privilege escalation through a one-line URL edit, rated High. Request tampering with Burp Suite, rated Medium. Vulnerability assessment (Task 13): four findings (1 Critical, 2 High, 1 Medium) with impact ratings, plus six recommendations: parameterised queries, hashed passwords, session-held roles, input validation, HTTPS with secure cookies, and rate limiting. Secure coding (Task 14): before-and-after fixes for each weakness, three hardened code snippets, and six controls: parameterised queries, session-based login, server-decided roles, input validation, safe logout and salted hashed passwords. Verification (Tasks 15–16): six re-tests that all pass, plus a findings dashboard with colour-coded severity and a CSV report export. Conclusion: five lessons (treat all input as hostile, always use parameters, enforce access on the server, get sessions right, layer your defences) and real-world SQL-injection breaches (Heartland, Sony Pictures, TalkTalk).

Who it is for: cybersecurity students, aspiring penetration testers and AppSec engineers, web developers learning secure coding, trainers running security labs, and security teams building developer awareness.

How to use it: use it as a step-by-step lab workbook, a secure-coding teaching aid, a sample vulnerability assessment report template and a re-test checklist. Run the attacks only in the isolated lab described in the kit. It shows how a few basic flaws can lead to full compromise, and how a handful of server-side fixes close them.