ServerLabs Digest: October 23, 2026

Challenge: Harden a Django GraphQL API: Five Classic Flaws

By Adam Leskis • Published on October 23, 2026

You've inherited Acme Social, a small Django app whose API is served by Strawberry. It works — and it ships with five weaknesses that show up again and again in real GraphQL services. The code is a perfectly ordinary Strawberry/Django setup; the defaults are the problem.

Here's the path a request takes through this lab:

curl / browser
    │  HTTP GET or POST /graphql/ with a GraphQL query or mutation
    ▼
Uvicorn server (port 8000)
    ▼
Django: route request, apply the POST rate limit
    ▼
Strawberry GraphQL view: parse and validate against the schema
    ▼
Execute fields → resolvers → Django ORM → SQLite database
    │
    └── JSON response (data or errors) ──→ curl / browser

…

Challenge: Intercept and Analyze Encrypted Traffic of a Suspicious Container

By Ivan Velichko • Published on October 22, 2026

A suspicious container image turned up in the corporate container registry. It is called node-telemetry-agent:2.1, it ships with no documentation, and it keeps making outbound HTTPS calls to destinations on the internet. You have been asked to analyze it - find out where it connects and to read what it is sending.

The image is already loaded on your workstation, and a copy is running right now as the agent container. The trouble is that it never logs where it connects, and its traffic is encrypted.

To read that traffic you have a MITM proxy standing by on…

Challenge: Redirect a Container's Requests Without Modifying the App

By Ivan Velichko • Published on October 22, 2026

The billing team has spotted odd requests in the logs of the company's billing API at billing.acme.corp, and they suspect the old invoices dashboard of the finance team. Nobody remembers much about this app. There is only its container image, invoices:2.0, and you do not know whether the address of the billing API can be changed in the app, or how.

To study the app's requests without touching the real API, the billing team has set up a request sink. The sink answers like the billing API, with test data, and records every request that it receives.

http://billing-sink.acme.corp

…