Exploit and Remediate Eight Web Flaws on a FinTech Practice Range
Overview
What this challenge is about.
Exploit and Remediate Eight Web Flaws on a FinTech Practice Range. Intermediate challenge in analysis. Analyzing real datasets and building models that drive...
The Brief
What you'll do, and what you'll demonstrate.
Identify, exploit, and propose root-cause fixes for eight graded web vulnerabilities on a practice range that mirrors Northgate Lending's real Rails production stack.
This is not a data exercise. It is the work an analyst does when stakeholders need answers from messy data. That distinction matters to every hiring manager who has seen candidates describe statistical methods and none who have extracted insight from messy, real-world data.
When you finish, you will have something most graduates do not: a real-world deliverable, verified by Ewance, that you can show to a hiring manager and say "I did this. Here is the proof."
Earning criteria — what you'll demonstrate
- Map real application behavior to OWASP Top 10 vulnerability classes and confirm each with a working proof-of-concept.
- Write reproducible exploits in curl and Burp Suite that reliably extract a target value.
- Diagnose the root cause of each flaw in Rails source and write a fix that closes the class of bug, not just the instance.
- Score vulnerabilities consistently using CVSS v3.1 and defend the chosen vector.
- Communicate findings in the structure and tone of a professional engagement report.
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Web Security
Apply web security to solve real industry problems and demonstrate production-level capability.
- Owasp Top 10
Apply owasp top 10 to solve real industry problems and demonstrate production-level capability.
- Penetration Testing
Apply penetration testing to solve real industry problems and demonstrate production-level capability.
- Burp Suite
Apply burp suite to solve real industry problems and demonstrate production-level capability.
- Secure Coding
Apply secure coding to solve real industry problems and demonstrate production-level capability.
- Documentation
Apply documentation to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
Security Engineer
This challenge mirrors the core day-to-day of an application security engineer: finding flaws in a real stack, proving them with reproducible exploits, and shipping root-cause fixes. The engagement-style report is exactly the artifact teams expect when communicating risk to engineering and leadership.
This challenge sharpens
- web-security
- penetration-testing
- secure-coding
Penetration Tester
The work replicates a focused web-application pentest: scoping against a specification, exploiting OWASP Top 10 classes, scoring severity, and packaging findings into a client-ready report. It demonstrates the exploitation and reporting discipline consulting firms hire for.
This challenge sharpens
- owasp-top-10
- burp-suite
- documentation
Application Security Analyst
Bridging exploitation and remediation, this challenge shows you can read Rails source, explain why a flaw exists, and propose a fix developers can merge. That triage-and-advise loop is the heart of an application security analyst's role on a product team.
This challenge sharpens
- web-security
- secure-coding
- documentation