Implementing 4 vulnerabilities in an already created project (WEB site)
Budget: $10 – $25 USD
Implementing 4 vulnerabilities in an already created project (WEB site), which should be difficult for other people to detect. The vulnerabilities should not be discoverable by AI tools, or LLMs
More details:
What kind of vulnerabilities do you want to implement? SQL Injection, Server-Side Request Forgery (SSRF)
Examples for two Vulnerabilities (vulnerabilities must be of different types)
Timing Attack — The safeCompare function looks like a proper implementation of secure comparison, but the if (a.length !== b.length) return false line immediately short-circuits when the lengths differ. An attacker can measure the differences in response time to first determine the exact length of the password, then deduce it character by character.
Prototype Pollution — The deepMerge function does not filter the _proto_ key from the received object. An attacker can send {"_proto_": {"isAdmin": true}} in the request, modifying the global Object.prototype and injecting properties into all objects created later in the application.
How soon do you need your project completed? ASAP
More details:
What kind of vulnerabilities do you want to implement? SQL Injection, Server-Side Request Forgery (SSRF)
Examples for two Vulnerabilities (vulnerabilities must be of different types)
Timing Attack — The safeCompare function looks like a proper implementation of secure comparison, but the if (a.length !== b.length) return false line immediately short-circuits when the lengths differ. An attacker can measure the differences in response time to first determine the exact length of the password, then deduce it character by character.
Prototype Pollution — The deepMerge function does not filter the _proto_ key from the received object. An attacker can send {"_proto_": {"isAdmin": true}} in the request, modifying the global Object.prototype and injecting properties into all objects created later in the application.
How soon do you need your project completed? ASAP