Algeria 2.0 /// Workshop B /// Thu 19 Nov

Crack Three Cases in Fifty Minutes.

A live web pentesting lab. Break into a fake investigation platform, find the hidden flags, then learn how to fix every bug. No experience needed.

Start the Lab See the Cases

SQLI DETECTED

LIVE LAB

The Casefile Breach

Bugs to find3

Flags hidden3

/// DO NOT CROSS /// CONFIDENTIAL CASE FILE /// AUTHORIZED INVESTIGATORS ONLY /// DO NOT CROSS /// CONFIDENTIAL CASE FILE /// AUTHORIZED INVESTIGATORS ONLY /// DO NOT CROSS /// CONFIDENTIAL CASE FILE /// AUTHORIZED INVESTIGATORS ONLY ///

EventAlgeria 2.0, 13th edition

WhenThu 19 Nov, 09:00 to 09:50

WhereWorkshop B, Algiers

SpeakerAyoub Bezai

Meet your lead investigator.

Ayoub Bezai builds web products and knows how they break. Today he hacks a fake investigation platform live, and you follow along from your own phone or laptop.

You will learn to spot and fix critical web and API bugs, think in Zero-Trust terms, and understand what Algeria’s Law 18-07 on personal data expects from you.

Fingerprint scan

Three cases. Three bugs.

Case 01 / 10 min

The Login That Believed Everything

You lie to the front desk and it follows your words as orders.

Bug: SQL injection

Case 02 / 10 min

Someone Else’s File

You change the number in the address bar and open another investigator’s case file.

Bug: IDOR

Case 03 / 10 min

The Door Only the Server Can Open

You trick the front desk into opening a door that is locked to you but not to it.

Bug: SSRF

How the session runs.

Break It

See the attack live, then try it yourself.

Understand It

Find out why the app trusted the wrong thing.

Fix It

Compare the broken code with the patched code.

Now defend it.

Only test systems you own or have written permission to test. Everything in this lab is fake.

Parameterized queries: Stop SQL injection by keeping user input out of the query text.
Ownership checks: Stop IDOR by checking on the server that the record belongs to the person asking.
Allow-lists: Stop SSRF by letting the server fetch only addresses you approved.
Law 18-07: Treat user data as personal data. Collect less, protect more.

Ready to Break CASEFILE 404?

Join the Lab

/// NEW CLUE /// CASE FILE OPEN /// DO NOT CROSS /// NEW CLUE /// CASE FILE OPEN /// DO NOT CROSS /// NEW CLUE /// CASE FILE OPEN /// DO NOT CROSS /// NEW CLUE /// CASE FILE OPEN ///