SENG406 Unsecure (Django) App - 2025 edition

This app has been developed in an unsecure way on purpose for SENG406 students to identifying common vulnerabilities and design issues in software systems.

All vulnerabilities hidden in the app are instances of OWASP Top 10 2021.

Initial app - NoteNote

This app is a Note sharing app, with registration, login, sharing and commenting on notes.

How to use it

Download and unzip from Learn

$ unzip seng406-asg3-25.zip

Set Up for Unix, MacOS and Windows Subsystem for Linux

Create a virtual environment

$ cd seng406-asg3-25
$ python3 -m venv .venv
$ . .venv/bin/activate
$ pip install -r requirements.txt

Database initialisation (not needed!)

Set up the database. This is not necessary for this project as we provide you with a pre-filled database, but this is typically part of Django first-time run.

$ python manage.py makemigrations myauth notes 
$ python manage.py migrate

Collect static files. This is necessary for some Django deployment magic.

$ python manage.py collectstatic

Run the SMTP server

Start the (console) SMTP server (mock email)

$ python3 -m aiosmtpd -n -l localhost:8025

Emails will print to the console instead of being sent out. See the bottom of settings.py for more details.

Start the app

$ python3 manage.py runserver_plus  --cert-file cert.pem --key-file key.pem

At this point, the app runs at https://127.0.0.1:8000/.

Because we run the server on a self-signed certificate, we have to use the runserver_plus helper script which starts a development server. You can ignore that message and consider the server deployed in a secured way.

Credits

This code was created from an initial template generated by Claude Sonnet 4.