Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's guide explains that XML entities represent data within a document, with built-in entities like < and > standing in for the metacharacters < and >, and custom entities defined in the document type definition (DTD). External entities,...
This PortSwigger lab has users attach avatars to comments, with the Apache Batik library processing the uploaded avatar image files. The lab requires uploading an image that displays the contents of the /etc/hostname file after processing, then submitting...
PortSwigger's lab presents a "Check stock" feature that embeds user input inside a server-side XML document that is then parsed. Because the attacker does not control the whole document and cannot define a DTD for a classic XXE attack, the lab requires...
PortSwigger's Web Security Academy lab targets a "Check stock" feature that parses XML input and reflects unexpected values in its response. The solution defines an external entity pointing to file:///etc/passwd between the XML declaration and the...
PortSwigger's lab presents a "Check stock" feature that parses XML input and reflects unexpected values in its response, alongside a simulated EC2 metadata endpoint at the default URL http://169.254.169.254/. Solving the lab requires exploiting an XXE...
This PortSwigger lab features a "Check stock" feature that parses XML input but displays no unexpected values and blocks requests containing regular external entities. The exercise requires using a parameter entity to make the XML parser issue a DNS lookup...
PortSwigger's lab presents a "Check stock" feature that parses XML input but does not display the result, making the XXE vulnerability blind. The lab is solved by defining an external entity between the XML declaration and the stockCheck element that makes...
PortSwigger's lab presents a stock-check feature that parses XML input without displaying the result, and the exercise is to exfiltrate the contents of the /etc/hostname file. Because the Academy firewall blocks interactions between labs and arbitrary...
PortSwigger's lab presents a stock-check feature that parses XML input but does not display the result. The exercise is solved by hosting a malicious external DTD on a separate exploit server, which reads the contents of /etc/passwd into a file entity and...
This PortSwigger lab presents a "Check stock" feature that parses XML input without displaying the result, and asks the solver to trigger an error message containing the contents of the /etc/passwd file. The solution requires referencing an existing DTD on...
WebSockets are a bi-directional, full duplex communications protocol initiated over HTTP, commonly used in modern web applications for streaming data and other asynchronous traffic. Connections are established through a WebSocket handshake over HTTP, with...
PortSwigger's WebSockets lab presents an online shop whose live chat runs over WebSockets, with messages viewed by a support agent in real time. The client HTML-encodes a typed '<' character before sending, but intercepting the WebSocket message in Burp...
PortSwigger's lab presents an online shop whose live chat runs over WebSockets and whose XSS filter is described as aggressive but flawed. The exercise is to edit and resend a WebSocket message carrying a basic XSS payload, add a header to the handshake...
Cross-site WebSocket hijacking is a cross-site request forgery vulnerability on a WebSocket handshake, arising when the handshake relies solely on HTTP cookies for session handling and contains no CSRF tokens or other unpredictable values. An attacker's...
PortSwigger's lab demonstrates web cache poisoning where the query string is unkeyed, so arbitrary query parameters can be changed without causing a cache miss. The solution injects a payload through a reflected parameter, replays until the response is...
PortSwigger's lab demonstrates web cache poisoning on a site that excludes a certain parameter from the cache key, and notes that sites often exclude UTM analytics parameters such as utm_content. The exercise is solved by sending a request with a...
PortSwigger's lab demonstrates parameter cloaking against a site vulnerable to web cache poisoning because it excludes a UTM analytics parameter from the cache key, combined with inconsistent parameter parsing between the cache and the back-end. Appending...
This PortSwigger lab presents an XSS vulnerability that is not directly exploitable because of browser URL-encoding. Solving it requires abusing the cache's normalization process to deliver a payload that executes alert(1) in the victim's browser. What's...
PortSwigger's lab demonstrates web cache poisoning against a site that uses multiple layers of caching, with a victim user regularly visiting the home page in Chrome. The exercise requires poisoning the internal cache so the home page executes...
This PortSwigger lab demonstrates web cache poisoning through a fat GET request: the site accepts GET requests that carry a body, but the cache key is derived only from the original callback parameter in the request line, not the body. Because a duplicate...
PortSwigger's Web Security Academy lab presents a site with multiple independent vulnerabilities, including cache key injection, where a user regularly visits the home page using Chrome. Solving it requires combining the vulnerabilities to execute alert(1)...
PortSwigger Research documents how flaws in cache key generation let attackers poison caches through inputs normally considered unexploitable, including transformations that strip the port from the Host header or exclude the entire query string from the...
PortSwigger's lab demonstrates a web cache poisoning vulnerability that is only exploitable when multiple headers are used to craft a malicious request, and it supports both the X-Forwarded-Host and X-Forwarded-Scheme headers. A user visits the home page...
PortSwigger's lab demonstrates web cache poisoning through an unkeyed header, where the application handles input from that header unsafely. The lab supports the X-Forwarded-Host header, and solving it requires poisoning the cache with a response that...
PortSwigger's Web Security Academy lab demonstrates web cache poisoning where cookies are excluded from the cache key: the site sets a fehost=prod-cache-01 cookie and reflects its value inside a double-quoted JavaScript object in the response. The solution...
This PortSwigger lab presents a DOM-based vulnerability that can be exploited through web cache poisoning, in which a user visits the home page roughly once a minute. The lab's cache applies stricter criteria for deciding which responses are cacheable, so...
PortSwigger's lab demonstrates targeted web cache poisoning, in which a response is poisoned so it executes alert(document.cookie) in a visitor's browser, and the poisoned response must be served only to the specific subset of users the intended victim...
PortSwigger's lab presents a web cache poisoning exercise that requires constructing a complex exploit chain, where a user visits the home page roughly once a minute with their language set to English. Solving it requires poisoning the cache with multiple...
PortSwigger Research describes web cache poisoning as arising when a site handles unkeyed input unsafely and caches the resulting response, with the simplest case being unkeyed input reflected in a cacheable response without sanitization. It walks through...
Web cache poisoning is a technique in which an attacker exploits the behavior of a web server and cache so that a harmful HTTP response is served to other users, in two phases: first eliciting a response from the back-end server that contains a dangerous...