Security Lab Notes — Authorised lab work explained

Security lab notes

Explanations, not answer keys

Notes from authorised training platforms and my own isolated lab. Each note covers why the vulnerability exists, how it is remediated and how the fix is verified.

Access control Cross-site scripting SQL injection

Access control

Access control: the four patterns that keep reappearing

Notes from authorised access-control labs — what causes horizontal and vertical bypasses, how each is remediated and how to verify the fix holds.

Access control IDOR Authorisation

2 min read

Cross-site scripting

XSS: the context decides the encoding

Why a single escaping helper is not enough — HTML body, attribute, JavaScript and URL contexts each need different handling, with notes on remediation and verification.

XSS Output encoding CSP

1 min read

SQL injection

SQL injection: parameterisation is the fix, not filtering

Lab notes on why escaping and blocklists fail, where prepared statements do not apply, and how to verify a remediation properly.

SQL injection Prepared statements Secure coding

1 min read