ArticleUser ID controlled by param with password disclosure
User ID controlled by param with password disclosure: This lab’s account page prefilled the current user’s password in a masked input. The goal was t…
Blog topic
PortSwigger security writeups
Practical PortSwigger Web Security Academy notes, labs, exploitation techniques, and remediation guidance.
- 21
- Matching posts
Article
ArticleUser ID controlled by request parameter, with unpredictable user IDs
User ID controlled by request parameter, with unpredictable user IDs: This lab contains a blind SQL injection vulnerability. The application uses a t…
ArticleUser role controlled by request parameter
User role controlled by request parameter: This lab has an admin panel at /admin, which identifies administrators using a forgeable cookie. • PortSwi…
ArticleDOM XSS using web messages and a JavaScript URL
DOM XSS using web messages and a JavaScript URL: This lab demonstrates a DOM based redirection vulnerability that is triggered via web messaging. • P…
ArticleDOM XSS using web messages and a JavaScript URL
DOM XSS using web messages and a JavaScript URL: This lab demonstrates a DOM based redirection vulnerability triggered by web messaging. • PortSwigge…
ArticleCSRF with broken Referer validation
CSRF with broken Referer validation: This lab's email change functionality is vulnerable to CSRF. It attempts to detect and block cross domain reques…
ArticleCSRF where token is duplicated in cookie
CSRF where token is duplicated in cookie: This lab’s email change functionality is vulnerable to CSRF. It uses the insecure "double submit" CSRF prev…
ArticleCSRF where token is tied to non-session cookie
CSRF where token is tied to non session cookie: This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF at…
ArticleCSRF where token is duplicated in cookie
CSRF where token is duplicated in cookie: This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics…
ArticleCSRF where token validation depends on request method
CSRF where token validation depends on request method: This lab's email change functionality is vulnerable to CSRF. It attempts to block CSRF attacks…
ArticleCSRF vulnerability with no defenses
CSRF vulnerability with no defenses: This lab's email change functionality is vulnerable to CSRF. • PortSwigger • CSRF • csrf, lab1
ArticleBasic clickjacking with CSRF token protection
Basic clickjacking with CSRF token protection: To solve the lab, craft some HTML that frames the account page and fools the user into deleting their…
ArticleClickjacking with a frame buster script
Clickjacking with a frame buster script: This lab is protected by a frame buster which prevents the website from being framed. • PortSwigger • Clickj…
ArticleExploiting XXE via image file upload
Exploiting XXE via image file upload: This lab lets users attach avatars to comments and uses the Apache Batik library to process avatar image files.…
ArticleBlind SQL injection with conditional responses part 2
Blind SQL injection with conditional responses part 2: The TrackingId cookie is vulnerable to boolean‑based blind SQL injection. The app leaks a sign…
ArticleDOM XSS sink using location.search
DOM XSS sink using location.search: Exploit the search endpoint’s reflected output to achieve XSS by breaking out of the single‑quoted context and in…
ArticleStored XSS into HTML context with nothing encoded
Stored XSS into HTML context with nothing encoded: Experiment with XSS filter evasion techniques to achieve JavaScript execution without user interac…
ArticleReflected XSS into HTML context with most tags and attributes blocked
Reflected XSS into HTML context with most tags and attributes blocked: Perform a reflected XSS in the search feature that is protected by a WAF, and…
ArticleSQL injection UNION attack, finding a column containing text
SQL injection UNION attack, finding a column containing text: Exploit a SQL injection in the product category filter to perform a UNION based attack…
ArticleSQL injection vulnerability allowing login bypass
SQL injection vulnerability allowing login bypass: Exploit a SQL injection in the product category filter using a boolean condition to return uninten…
ArticleSQL injection attack, listing the database contents on Oracle
SQL injection attack, listing the database contents on Oracle: Exploit an SQL injection in the product category filter to enumerate the database, ide…