Object Lessons is a deliberately vulnerable Django + Django REST Framework app. Find and exploit the broken access control, then dig into the code to fix the bugs.
"Broken Access Control" is #1 in OWASP's Top 10. It's a broad category. Object Lessons focuses on object-level and action-level authorisation bugs: BOLA, IDOR, organisation/tenant scoping mistakes, unsafe custom actions.
Inspired by OWASP Juice Shop and the preprint BOLA in the Wild by Kaur. The name comes from Elizabeth Mayo's book Lessons on Objects (1840), the idea being that you learn by examining objects. And Django has a lot of objects.
v0.1.0, trying to find out if this is even fun and useful
I focused on putting together the initial scenarios. The code was initially LLM generated, checked by me and with some modifications done by hand (e.g. removed repetition). I'm not going to claim it's great Django/DRF code, though the style is pretty similar to apps I've seen in the wild.
Current focus is the scenarios and learning experience. If people find the code really hard to patch, I'll focus on that instead. Feel free to open an issue to let me know.
uv sync
uv run python manage.py migrate
uv run python manage.py reset_demo_data
uv run python manage.py runserverFor a spoiler-free experience, open http://127.0.0.1:8000/api/ and have fun!
For a guided experience, open http://127.0.0.1:8000/ and sign in as mallory. There's a minimal challenge UI with 6 scenarios.
The password for every seeded account is:
objectlessons
Starter users:
| User | Tenant | Purpose |
|---|---|---|
mallory |
Mallory Labs | Main learner/attacker account |
bob |
Beta Retail | Victim ticket requester |
alice |
Acme Support | Normal user |
manager |
Acme Support | Manager user |
admin |
Acme Support | Admin/staff user, can access Django admin |
Click here to see the scenarios (on another page to avoid accidental spoilers).
uv run pytest
uv run ruff check .Some tests are marked xfail because they check the correct, patched behaviour for the initially vulnerable scenarios.