There's a certain website designed so that junior QAs learn to find bugs. Trouble is:

  • it's http://
  • there's no IP filtering
  • users are very junior so they use their real names as user names and probably reuse their only password.

I do not intend to attack it nor do I have anything to gain from that; furthermore I've informed the owner of the security flaws - this should put Your moral compass at rest.

Imagine I want to attack it, but I am reluctant to exploit vulnerabilities of the server, router or ISP for fear of being legally liable. Nor am I on the same LAN. Can the traffic be somehow observed remotely?

  • The first half of this question seems utterly irrelevant....
    – schroeder
    Jan 13 at 16:44
  • 5
    In order to MITM ... you need to be ... in the middle.
    – schroeder
    Jan 13 at 16:47
  • Why do you want to attack someone else's connection to the server? Why not just intercept your own connection?
    – schroeder
    Jan 13 at 16:48

For training purposes you can take some VMs at some cloud provider, organize them into an internal network, so that the whole traffic remains within this network. Then you can do there whatever you want within this network. If you need it repeatedly, take tools like Terraform, so that every time after executing the scripts you get identical environment. After training you can delete it and next time re-create exactly the same one. It is much easier and much more secure than disabling some real security measures in your real network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.