Practice assessment: Lunarbay Market (e-commerce)
You assess the fictional Lunarbay Market’s lab application under a signed authorisation from plan to report, fix the findings with its developers, write detection rules and retest.
Level 301 · 15 lessons · 13 practice labs
Lessons
Preparation
- Engagement briefing: the company, scope and authorisation letter
- Rules of engagement: hours, contacts and emergencies
- Mapping the app: roles, flows and APIs
- Short task: hand in the test plan and checklist
Testing
- Authentication and session testing
- Access tests across customer, seller and admin roles
- Injection and XSS in search, reviews and product pages
- Logic testing in the basket, coupons and checkout
- Seller-panel file upload and API testing
- Short task: send the first interim findings with severities
Fixing and reporting
- Fix session with developers: root cause and lasting solution
- Detection rules and WAF measures for the findings
- Retest and closure evidence
- Final report and executive presentation
- Capstone: deliver the Lunarbay Market assessment with report and retest note
Practice labs
- The Lunarbay test plan and checklist: Derive a test plan and checklist by roles and flows from Lunarbay Market's scope document.
- The Lunarbay application map: Map the endpoints of the shop, seller panel and API together with their roles.
- User enumeration in the Lunarbay login: Prove user enumeration in Lunarbay's login and sign-up flow and close it on the fix branch.
- The Lunarbay session: lifetime in the seller panel: Find the logout and timeout weaknesses in the seller panel, fix them and retest.
- IDOR on customer orders in Lunarbay: Prove one customer can see another's order and add the ownership check.
- Product editing across sellers: Prove one seller can edit another seller's product and enforce seller ownership in the data layer.
- Stored XSS in Lunarbay product reviews: Prove the stored XSS in product reviews, encode the output and add a regression test.
- Injection in the Lunarbay search: Prove the injection in the search filter, switch to a parameterised query and write a rule that catches attempts in the log.
- The seller panel file upload: Prove the weak checks in the seller panel's product image upload and rebuild it with safe storage.
- The Lunarbay interim findings note: Put the first three findings with severities into a short interim note for the client.
- Lunarbay coupon logic: Prove coupons can be stacked in the basket to reach a negative total and close it with a server-side rule.
- WAF and detection measures for the findings: Write a virtual patch and a detection rule for two of the Lunarbay findings and test them by replay.
- Lunarbay retest and closure: Retest every finding on the fix branch and deliver the retest note with closure evidence.
About this course
You assess the fictional Lunarbay Market’s lab application under a signed authorisation from plan to report, fix the findings with its developers, write detection rules and retest.
What you will learn
- Preparation
- Testing
- Fixing and reporting
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.