sectrain9.6

sectrain lets learners compare vulnerable and corrected web-application examples while observing how common security flaws behave. It demonstrates cross-site scripting (XSS) and buffer overflows through examples written in PHP and Python, including techniques for preventing them. Developed by Joe McManus, this open-source Linux education program suits students, instructors, and developers examining compact code examples.

Running sectrain startweb opens its web mode, while sectrain stopweb shuts that mode down. Users then open a browser to their host on port 1984 and choose secure or insecure links to compare the results. Entering the sample payload ">alert('xss'); exposes the XSS behavior, while the sanitized input or output shows how the issue can be addressed.

The Python lesson includes pybuffbad and pybuffgood, illustrating how an overlong string can break the vulnerable example but be handled safely by the corrected one. For example, users can run sectrain pybuffbad abcdefghijkl and sectrain pybuffgood abcdefghijkl to see the contrast directly. The demonstrations are deliberately small and intended to encourage developers to find and fix similar problems in their own code.

The current 9.6 release requires Linux with snapd and runs on x86_64 (amd64) systems. JavaScript, SQL injection, and C++ buffer-overflow examples are planned additions, so the present lessons remain focused on PHP and Python.