Gruyere Learn Web Application Exploits | Defenses Top

When analyzing Gruyere to learn defenses, you learn that a "good" profile feature must separate Data from Code.

To fix the Gruyere profile feature, a developer would look at:

Gruyere is a deliberately vulnerable web application created by Google engineers. It’s designed as a self-paced, interactive “capture the flag” style tutorial to teach common web vulnerabilities and how to fix them. gruyere learn web application exploits defenses top

Once you finish the main "Holes," Gruyere offers advanced modules.

| Defense Layer | How It Works | Stops Which Exploits | |---------------|--------------|----------------------| | Input Validation (allowlist) | Reject anything not explicitly allowed | SQLi, Command Injection, Path Traversal | | Output Encoding | Convert < to < etc. | XSS | | Parameterized Queries | Separate SQL code from data | SQL Injection | | CSRF Tokens | Unique, unpredictable tokens per request | CSRF | | SameSite Cookies | Restrict cookie sending to same site | CSRF | | CSP (Content Security Policy) | Control which scripts can run | XSS (Stored/Reflected) | | AuthN/AuthZ Checks | Verify identity and permissions | IDOR | | Allowlist of Outbound IPs | Restrict server-initiated requests | SSRF | | WAF (Web App Firewall) | Signature & anomaly blocking | Many, but not all (bypassable) | When analyzing Gruyere to learn defenses, you learn

Key insight: An attacker only needs one hole in one layer. Defenders must cover all layers continuously.

Date: April 12, 2026
Author: Security Research Unit
Subject: Structured learning of web app vulnerabilities (OWASP Top 10) and corresponding defensive layers. Key insight : An attacker only needs one hole in one layer

| Exploit | Description | Real-World Analogy | |---------|-------------|---------------------| | XSS (Cross-Site Scripting) | Injecting malicious scripts into trusted websites | A sticky note left on a cash register that tricks the next cashier | | SQL Injection | Manipulating database queries via unsanitized input | Calling a hotel front desk and pretending to be the manager to get a master key | | CSRF (Cross-Site Request Forgery) | Tricking authenticated users into unwanted actions | A signed check you didn’t write but your bank accepts | | Command Injection | Running OS commands through a vulnerable app | Yelling “open sesame” and the door obeys without checking | | Path Traversal | Reading arbitrary files on the server | Using ../../ to climb out of the guest folder into the vault | | IDOR (Insecure Direct Object Reference) | Accessing unauthorized data by changing an ID | Changing ?invoice=123 to ?invoice=124 to see someone else’s bill | | SSRF (Server-Side Request Forgery) | Making the server attack internal systems | Tricking a receptionist into calling a locked room for you |

The Swiss cheese model of accident causation, introduced by James Reason, posits that disasters occur when holes in multiple defensive layers align. In web security:

Thus, the Gruyère Learning Path organizes web security education by: