Examples of security flaws

A form can send it's HTTP request anywhere. So a form on someone else's page can send a request to our app. If that page is running on our browser, it will have our session cookie attached.
Search:


If a hacker can fill in a form on our page, and get the user to submit it, it sends an apparently legitimate HTTP request to our server. This gets worse when forms are auto-filled from the command line. Try reloading this page with:
server162.site:[port]/flaw.html?name=dumpMySessionKey
Name:


This applies to text boxes as well. Pasting data from a textbox into the page using innerHTML could cause your page to run arbitrary code. Try typing <img src=x onerror="alert('XSS Attack')"> in the textbox below (make sure the angle brackets are real).