Review Project 2 ingestion

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R10 — OWASP File Upload & SSRF Cheat Sheets

   R40 — WSTG input testing

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Audit P2 ingestion: file upload limits, isolated parsers, SSRF allowlists, path traversal, and job idempotency. Complete `C3` (Schema drift detection & pipeline recovery) (detect added/missing/type-changed fields against versioned fixtures; validate proposed mappings before retry/rollback) and `C7` (Structured extraction & business-rule reconciliation) (extract document fields into validated schemas, reconcile across records, route mismatches to human review queue).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Test malicious file uploads, SSRF redirects, unvalidated schema-repair injection, and business-rule bypasses.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   P2 parser/SSRF test suite + C3 schema-drift recovery tests + C7 reconciliation exception-queue tests.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

• R40OWASP WSTG↗ owasp.org

  Web Security Testing Guide: hands-on test cases for authentication, authorization, session, input, and API security.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP · cheat sheet
  File Upload - OWASP Cheat Sheet Series

  Gives the upload controls — extension allowlist, content-type and magic-byte validation, stored-outside-webroot, size limits, and filename handling — that the P2 ingestion audit checks one by one.

  R10checked 2026-11-11
• videoIntigriti · 8 min
  Web Shell Upload via Path Traversal

  Chains an upload filter bypass with path traversal to land an executable outside the intended directory, which is the exact ingestion weakness pair (upload limit + traversal) the audit targets.

  R10R40checked 2026-11-11
• videoAikido Security · 9:06
  What is SSRF? Server-Side Request Forgery Explained (With Real Attack Example)

  Shows how a server-side fetch reaches cloud metadata and internal services, which is why the document-loader URL fetch needs a scheme/host allowlist plus redirect and DNS-rebinding handling.

  R10checked 2026-11-11
• articleVaadata · blog post
  File Upload Vulnerabilities and Security Best Practices

  Separates client-side (stored XSS in rendered documents) from server-side (web shell execution) exploitation modes, so the ingestion audit covers the parser output path as well as the upload path.

  R10moved 2026-11-11
• labPortSwigger · free labs
  File uploads | Web Security Academy

  Free interactive labs for filter bypass via extension, content-type, and magic bytes, giving concrete payloads to encode as regression fixtures for parser isolation and upload validation.

  R40R10checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.