Web Race Conditions: Coupons, Balances, and Workflows
Lab Go counter without a mutex, then with one; HTTP coupon handler; lost-update logs — no inventory-drain exploit script.
Web
SQL Injection Probing Methodology for Analysts
Lab Flask+SQLite app: concatenated vs parameterized queries, SQL logs, WAF noise, ASAN-irrelevant crash on the concat path — no production DB dump.
JWT Failure Modes Defenders Still See
Lab JWT verifier in Go: decoded header/payload dumps, alg=none rejected, wrong aud rejected, HS256 with a lab secret — no forged production tokens.