Security Lab: Injection + Password Hashing

Free Review to certify

Security Lab: Injection + Password Hashing

Break a vulnerable login, then fix it — learn SQL injection and why passwords must be hashed.

Skills you'll learn

SQL injection defense Password hashing Input validation Secure coding HTTP security basics

~100 min · +50 pts

AI can generate working login code that is still unsafe. This lab trains your security instincts.

Starter: /assets/templates/node-security-lab/

You will:
1) Reproduce SQL injection on /login/unsafe (classic ' OR '1'='1)
2) Switch to parameterized /login/safe
3) Compare plaintext vs bcrypt password storage
4) Register a user with hashed password; verify login works
5) Write a short threat note: what AI code often gets wrong

Submit: demo notes (what payload worked) + reflection (120+ chars).

Environment setup (start here)

Same Node setup as SQL lab. Run ONLY on localhost — never point scripts at real websites.

Node.js required

Pick your OS and follow from step 1:

Windows macOS

1) Node.js LTS + folder C:\Users\YourName\node-security-lab
2) npm install (see SQL lab if better-sqlite3 fails)
3) npm run db:init && npm start
4) Open http://localhost:3002 — use the demo login form only on this URL.

1) ~/Documents/node-security-lab with starter files
2) npm install && npm run db:init && npm start
3) http://localhost:3002

How do I know it worked?

Unsafe login demo shows injection; after your fix, parameterized queries block the attack.

Common issues

Wrong port → check console output. Never commit real passwords in screenshots.

Starter pack

Local security lab: reproduce SQL injection, switch to safe login, store passwords with bcrypt (never attack real sites).

README server.js passwords.js index.html package.json

/assets/templates/node-security-lab/ · npm run db:init && npm start · Local practice only