# open-education-hub/web-security architecture

> Architecture diagram of the GitHub repository open-education-hub/web-security, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/open-education-hub/web-security
- Repository: https://github.com/open-education-hub/web-security

## Overview

This repository is an educational collection of web-security lessons and runnable challenge applications, rather than a single end-user product. A learner interacts with individual drill endpoints or forms to observe security behaviors; the examples span web basics, sessions, injection, framework/API flaws, and exotic attacks. The graph highlights sampled challenge implementations and the central shared C utilities. Many listed drills were not sampled, so their internal flows are omitted; the README does not document a broader runtime workflow.

Main entry points: [`common/utils/sock/sock_util.c`](https://github.com/open-education-hub/web-security/blob/main/common/utils/sock/sock_util.c) (Socket Helpers), [`chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/index.php`](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/index.php) (High Score App), [`common/utils/utils.h`](https://github.com/open-education-hub/web-security/blob/main/common/utils/utils.h) (Error Macros), [`common/utils/log/log.h`](https://github.com/open-education-hub/web-security/blob/main/common/utils/log/log.h) (Logging API)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_basics["Web Basics"]
  node_web_basics["Web Basics Drills"]
  node_name_challenge["Name Lookup<br/>[main.template.py]"]
  node_surprise_challenge["Surprise Endpoint<br/>[main.template.py]"]
end

subgraph group_security["Security Drills"]
  node_session_challenges["Session Challenges"]
  node_mind_business["Invoice Access<br/>[index.php]"]
  node_chef_hacky["Session Management<br/>[index.php]"]
  node_traverse["Path Traversal<br/>[index.php]"]
  node_sql_challenges["SQL Injection Drills"]
  node_nightmare_store["Nightmare Store<br/>[main.template.py]"]
  node_sqlite_store[("Store Database<br/>[main.template.py]")]
  node_blacklist_search["Search Challenge<br/>[index.php]"]
  node_blacklist_db[("Search DB Setup<br/>[db_conn.php]")]
  node_secret_diary["Secret Diary<br/>[index.php]"]
  node_secret_config[("Diary DB Setup<br/>[conf.php]")]
  node_exotic_challenges["Exotic Attacks"]
end

subgraph group_framework["Framework Challenges"]
  node_high_score["High Score App<br/>[index.php]"]
  node_high_score_db[("Score DB Setup<br/>[db.php]")]
  node_xss_challenges["XSS Challenges"]
end

subgraph group_utilities["C Utilities"]
  node_socket_helpers["Socket Helpers<br/>[sock_util.c]"]
  node_utility_macros["Error Macros<br/>[utils.h]"]
  node_logging["Logging Library<br/>[log.c]"]
  node_logging_api["Logging API<br/>[log.h]"]
  node_socket_api["Socket API<br/>[sock_util.h]"]
end

node_learner(("Learner"))

node_learner -->|"requests name"| node_name_challenge
node_learner -->|"sends JSON"| node_surprise_challenge
node_learner -->|"registers or logs in"| node_high_score
node_nightmare_store -->|"reads and writes"| node_sqlite_store
node_blacklist_search -->|"requires setup"| node_blacklist_db
node_secret_diary -->|"requires config"| node_secret_config
node_high_score -->|"requires database"| node_high_score_db
node_socket_helpers -->|"uses macros"| node_utility_macros
node_utility_macros -->|"calls logging"| node_logging_api
node_logging -->|"implements API"| node_logging_api
node_socket_helpers -->|"implements API"| node_socket_api

click node_web_basics "https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/web-basics/drills"
click node_name_challenge "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/web-basics/drills/my-special-name/src/main.template.py"
click node_surprise_challenge "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/web-basics/drills/surprise/src/main.template.py"
click node_session_challenges "https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/cookies-and-session-management/drills"
click node_mind_business "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/cookies-and-session-management/drills/mind-your-own-business/src/index.php"
click node_chef_hacky "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/cookies-and-session-management/drills/chef-hacky-mchack/src/index.php"
click node_traverse "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/cookies-and-session-management/drills/traverse-universe/src/index.php"
click node_sql_challenges "https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/sql-injection/drills"
click node_nightmare_store "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/nightmare-store/src/main.template.py"
click node_sqlite_store "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/nightmare-store/src/main.template.py"
click node_blacklist_search "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/blacklist/src/index.php"
click node_blacklist_db "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/blacklist/src/db_conn.php"
click node_secret_diary "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/t0p_s3cr3t/src/index.php"
click node_secret_config "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/t0p_s3cr3t/src/conf.php"
click node_high_score "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/index.php"
click node_high_score_db "https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/db.php"
click node_xss_challenges "https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/cross-site-scripting/drills/05-XSS-challenges"
click node_exotic_challenges "https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/exotic-attacks/drills"
click node_socket_helpers "https://github.com/open-education-hub/web-security/blob/main/common/utils/sock/sock_util.c"
click node_utility_macros "https://github.com/open-education-hub/web-security/blob/main/common/utils/utils.h"
click node_logging "https://github.com/open-education-hub/web-security/blob/main/common/utils/log/log.c"
click node_logging_api "https://github.com/open-education-hub/web-security/blob/main/common/utils/log/log.h"
click node_socket_api "https://github.com/open-education-hub/web-security/blob/main/common/utils/sock/sock_util.h"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_web_basics,node_name_challenge,node_surprise_challenge toneBlue
class node_session_challenges,node_mind_business,node_chef_hacky,node_traverse,node_sql_challenges,node_nightmare_store,node_sqlite_store,node_blacklist_search,node_blacklist_db,node_secret_diary,node_secret_config,node_exotic_challenges toneAmber
class node_high_score,node_high_score_db,node_xss_challenges toneMint
class node_socket_helpers,node_utility_macros,node_logging,node_logging_api,node_socket_api toneRose
class node_learner toneIndigo
```

## Components

### Web Basics

- [Web Basics Drills](https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/web-basics/drills): `chapters/web-application-security/web-basics/drills`
- [Name Lookup](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/web-basics/drills/my-special-name/src/main.template.py): `chapters/web-application-security/web-basics/drills/my-special-name/src/main.template.py`
- [Surprise Endpoint](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/web-basics/drills/surprise/src/main.template.py): `chapters/web-application-security/web-basics/drills/surprise/src/main.template.py`

### Security Drills

- [Session Challenges](https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/cookies-and-session-management/drills): `chapters/web-application-security/cookies-and-session-management/drills`
- [Invoice Access](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/cookies-and-session-management/drills/mind-your-own-business/src/index.php): `chapters/web-application-security/cookies-and-session-management/drills/mind-your-own-business/src/index.php`
- [Session Management](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/cookies-and-session-management/drills/chef-hacky-mchack/src/index.php): `chapters/web-application-security/cookies-and-session-management/drills/chef-hacky-mchack/src/index.php`
- [Path Traversal](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/cookies-and-session-management/drills/traverse-universe/src/index.php): `chapters/web-application-security/cookies-and-session-management/drills/traverse-universe/src/index.php`
- [SQL Injection Drills](https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/sql-injection/drills): `chapters/web-application-security/sql-injection/drills`
- [Nightmare Store](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/nightmare-store/src/main.template.py): `chapters/web-application-security/sql-injection/drills/nightmare-store/src/main.template.py`
- [Store Database](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/nightmare-store/src/main.template.py): `chapters/web-application-security/sql-injection/drills/nightmare-store/src/main.template.py`
- [Search Challenge](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/blacklist/src/index.php): `chapters/web-application-security/sql-injection/drills/blacklist/src/index.php`
- [Search DB Setup](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/blacklist/src/db_conn.php): `chapters/web-application-security/sql-injection/drills/blacklist/src/db_conn.php`
- [Secret Diary](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/t0p_s3cr3t/src/index.php): `chapters/web-application-security/sql-injection/drills/t0p_s3cr3t/src/index.php`
- [Diary DB Setup](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/sql-injection/drills/t0p_s3cr3t/src/conf.php): `chapters/web-application-security/sql-injection/drills/t0p_s3cr3t/src/conf.php`
- [Exotic Attacks](https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/exotic-attacks/drills): `chapters/web-application-security/exotic-attacks/drills`

### Framework Challenges

- [High Score App](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/index.php): `chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/index.php`
- [Score DB Setup](https://github.com/open-education-hub/web-security/blob/main/chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/db.php): `chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/db.php`
- [XSS Challenges](https://github.com/open-education-hub/web-security/tree/main/chapters/web-application-security/cross-site-scripting/drills/05-XSS-challenges): `chapters/web-application-security/cross-site-scripting/drills/05-XSS-challenges`

### C Utilities

- [Socket Helpers](https://github.com/open-education-hub/web-security/blob/main/common/utils/sock/sock_util.c): `common/utils/sock/sock_util.c`
- [Error Macros](https://github.com/open-education-hub/web-security/blob/main/common/utils/utils.h): `common/utils/utils.h`
- [Logging Library](https://github.com/open-education-hub/web-security/blob/main/common/utils/log/log.c): `common/utils/log/log.c`
- [Logging API](https://github.com/open-education-hub/web-security/blob/main/common/utils/log/log.h): `common/utils/log/log.h`
- [Socket API](https://github.com/open-education-hub/web-security/blob/main/common/utils/sock/sock_util.h): `common/utils/sock/sock_util.h`

### Other components

- **Learner**

## Connections

- Learner → Name Lookup: requests name (evidence: `chapters/web-application-security/web-basics/drills/my-special-name/src/main.template.py`)
- Learner → Surprise Endpoint: sends JSON (evidence: `chapters/web-application-security/web-basics/drills/surprise/src/main.template.py`)
- Learner → High Score App: registers or logs in (evidence: `chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/index.php`)
- Nightmare Store → Store Database: reads and writes (evidence: `chapters/web-application-security/sql-injection/drills/nightmare-store/src/main.template.py`)
- Search Challenge → Search DB Setup: requires setup (evidence: `chapters/web-application-security/sql-injection/drills/blacklist/src/index.php`)
- Secret Diary → Diary DB Setup: requires config (evidence: `chapters/web-application-security/sql-injection/drills/t0p_s3cr3t/src/index.php`)
- High Score App → Score DB Setup: requires database (evidence: `chapters/web-application-security/framework-api-vulnerabilities/drills/high-score/src/index.php`)
- Socket Helpers → Error Macros: uses macros (evidence: `common/utils/sock/sock_util.c`)
- Error Macros → Logging API: calls logging (evidence: `common/utils/utils.h`)
- Logging Library → Logging API: implements API (evidence: `common/utils/log/log.c`)
- Socket Helpers → Socket API: implements API (evidence: `common/utils/sock/sock_util.c`)