SwiftShop — Security Lab

🎯 Mission Control

SwiftShop was built fast and shipped with security as an afterthought. Twenty classes of weakness are hiding in this app. Find them, exploit them, then explain how a security-first design would stop each one.

⭐ Start here (easy wins)

👀

17. Secrets in page source

Right-click → View Page Source (Ctrl+U), search "password".

🔑

18. Password "recovery"

Account → Forgot password? shows the real password on screen.

💰

19. Editable price tag

Click a product's price, change it, then add to cart.

🤫

20. Hidden staff link

Press Ctrl+A to reveal the white-on-white admin link in the footer.

Input & Injection

⌨️

1. Input Manipulation

Feed the system values it should never accept (negative qty, decimals).

💉

2. Stored XSS

Inject HTML/JS via reviews that runs for every visitor.

🔗

3. Reflected XSS

Craft a URL with a ?promo= param that renders unsanitised HTML.

Auth & Access

🔓

4. Broken Authentication

No rate limit, no lockout, plaintext passwords in the source.

👑

5. Privilege Escalation

Edit your session role in storage to reach the admin panel.

📋

6. Mass Assignment

The profile update takes every field — including role and balance.

Data & Storage

📤

7. Data Theft

Hardcoded API keys, credentials, and card numbers in the source.

🗄️

8. Direct Storage Tampering

Edit localStorage directly — change prices, balances, roles.

📦

9. Insecure Deserialization

Import a cart from base64 JSON — the app trusts whatever you send.

🔢

10. IDOR

Order IDs are sequential — view any order by changing the number.

💬

11. Information Disclosure

Console.log leaks secrets; verbose errors expose internals.

Business Logic

🪙

12. Resource Misappropriation

Unlimited loyalty bonus, staff coupon in the code.

🔁

13. Self-Referral Abuse

Refer yourself or reuse the same referral code endlessly.

⚡

14. Race Condition

Rapid-fire the bonus button — no mutex means multiple credits.

Sabotage & Tampering

🧬

15. Program Alteration

Change GLOBAL_DISCOUNT or cart functions from the console.

💣

16. Sabotage

nukeStore() wipes everything — no auth, no confirmation needed.

💡 Tip: Open DevTools (F12) → Console / Application / Sources. The source code IS the vulnerability surface.