🐍

Python for AppSec Engineers

Explore common and subtle security issues in Python web applications through hands-on labs, code review exercises, and real CVEs from popular frameworks.

37 exercises

4 chapters

Unlock PRO Access ← All Tracks

Chapter 1

Code Execution & Deserialization

Exploit unsafe deserialization in Pickle and PyYAML, then review Python code for command injection, insecure deserialization patterns, and remote code execution flaws.

Pickle Code Execution Pro

Exploitation

CVE-2020-14343: PyYAML unsafe loader Pro

Exploitation

Python Code Review 01 Pro

Code Review · Code Execution

Python Snippet #09 Pro

Code Review · Command Execution

Python Snippet #03 Pro

Code Review · Insecure Deserialization

CVE-2021-37xxx Pro

Code Review · Insecure Deserialization

CVE-2025-0X6X Pro

Code Review · Code Execution

CVE-2025-XXX57 Pro

Code Review · Code Execution

Chapter 2

Injection & XML Attacks

Find and review SQL injection, XPath injection, log injection, and XML external entity vulnerabilities in Python applications and real CVEs.

Python Snippet #05 Pro

Code Review · SQL Injection

CVE-2026-X189X Pro

Code Review · SQL Injection

CVE-2025-XX662 Pro

Code Review · SQL Injection

Python Code Review 06 Pro

Code Review · XPath Injection

CVE-2024-X68X Pro

Code Review · Log Injection

CVE-2025-6X85 Pro

Code Review · XML External Entity

Recommended: Complete Chapter 1 first

Chapter 3

Paths, Redirects & Server-Side Requests

Review directory traversal, open redirect, SSRF, and host header injection vulnerabilities across Python code review exercises and real-world CVEs.

Python Snippet #04 Pro

Code Review · Directory Traversal

Python Code Review 02 Pro

Code Review · Directory Traversal

Python Code Review 09 Pro

Code Review · Directory Traversal

Code Review 02 Pro

Code Review · Directory Traversal

CVE-2026-XX871 Pro

Code Review · Directory Traversal

CVE-2025-XX149 Pro

Code Review · Directory Traversal

Python Code Review 04 Pro

Code Review · Open Redirect

CVE-2024-419XX Pro

Code Review · Open Redirect

Python Snippet #02 Pro

Code Review · Server-Side Request Forgery

Python Code Review 07 Pro

Code Review · Server-Side Request Forgery

CVE-2025-6X5X7 Pro

Code Review · Host Header Injection

Recommended: Complete Chapters 1 & 2 first

Chapter 4

XSS, Filters, Crypto & Application Security

Review cross-site scripting, filter bypass techniques, timing attacks, padding oracle, and transport security issues in Python applications and real CVEs.

Python Code Review 03 Pro

Code Review · Cross-Site Scripting

CVE-2024-XX3X9 Pro

Code Review · Cross-Site Scripting

Python Code Review 05 Pro

Code Review · Filter Bypass

Python Snippet #06 Pro

Code Review · Filter Bypass

CVE-2024-433XX Pro

Code Review · Filter Bypass

CVE-2025-6X9X2 Pro

Code Review · Improper Encoding