Lab: Inconsistent handling of exceptional input
Summary: PortSwigger's lab presents a web application that does not adequately validate user input, and a logic flaw in its account registration process can be exploited to reach administrative functionality. The lab directs the tester to register with an email address over 200 characters long, then register again using dontwannacry.com as a subdomain positioned so that its final "m" lands exactly on character 255.
Key Takeaway: The exploit hinges on a single boundary - character 255 - where a truncation or normalization mismatch lets an attacker's address be read as belonging to the dontwannacry.com domain, and the lab's goal is to reach the admin panel and delete the user carlos.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026