Exploit and Remediate Eight Web Flaws on a FinTech Practice Range
Overview
What this challenge is about.
Exploit eight web flaws on a FinTech practice range and propose fixes. Complete the challenge to earn a verifiable certificate.
The scenario
Northgate Lending is a 320-person New York City financial-technology firm (about USD 90 million in annual recurring revenue) that underwrites business-to-business loans for small and medium-sized enterprises, so its Rails application handles sensitive borrower and banking data under regulatory scrutiny.
The Brief
What you'll do, and what you'll demonstrate.
Identify, exploit, and propose root-cause fixes for eight graded web vulnerabilities on a practice range that mirrors Northgate Lending's real Rails production stack.
Earning criteria — what you'll demonstrate
- Map real application behavior to OWASP Top 10 vulnerability classes and confirm each with a working proof-of-concept.
- Write reproducible exploits in curl and Burp Suite that reliably extract a target value.
- Diagnose the root cause of each flaw in Rails source and write a fix that closes the class of bug, not just the instance.
- Score vulnerabilities consistently using CVSS v3.1 and defend the chosen vector.
- Communicate findings in the structure and tone of a professional engagement report.
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Web Security
Apply web security to solve real industry problems and demonstrate production-level capability.
- Owasp Top 10
Apply owasp top 10 to solve real industry problems and demonstrate production-level capability.
- Penetration Testing
Apply penetration testing to solve real industry problems and demonstrate production-level capability.
- Burp Suite
Apply burp suite to solve real industry problems and demonstrate production-level capability.
- Secure Coding
Apply secure coding to solve real industry problems and demonstrate production-level capability.
- Documentation
Apply documentation to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
Security Engineer
This challenge mirrors the core day-to-day of an application security engineer: finding flaws in a real stack, proving them with reproducible exploits, and shipping root-cause fixes. The engagement-style report is exactly the artifact teams expect when communicating risk to engineering and leadership.
This challenge sharpens
- web-security
- penetration-testing
- secure-coding
Penetration Tester
The work replicates a focused web-application pentest: scoping against a specification, exploiting OWASP Top 10 classes, scoring severity, and packaging findings into a client-ready report. It demonstrates the exploitation and reporting discipline consulting firms hire for.
This challenge sharpens
- owasp-top-10
- burp-suite
- documentation
Application Security Analyst
Bridging exploitation and remediation, this challenge shows you can read Rails source, explain why a flaw exists, and propose a fix developers can merge. That triage-and-advise loop is the heart of an application security analyst's role on a product team.
This challenge sharpens
- web-security
- secure-coding
- documentation