Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's lab demonstrates a CORS misconfiguration in which the application trusts all origins, allowing cross-origin requests to succeed. The exercise asks the user to craft JavaScript that retrieves the administrator's API key through CORS and upload...
PortSwigger's explainer describes the Access-Control-Allow-Origin response header as the core of CORS, the specification that provides controlled relaxation of the same-origin policy so one website domain can request resources from another. The header...
PortSwigger's lab extends its basic clickjacking exercise by having the attacker prepopulate an email-change form through a URL parameter, then frame the account page so a victim clicks a "Click me" decoy that lands on the "Update email" button. The lab is...
PortSwigger's lab presents account functionality protected by both a CSRF token and a confirmation dialog intended to block clickjacking. The exercise asks the solver to build an attack that makes the victim click the delete account button and the...
PortSwigger's lab presents a website protected by a frame buster script that prevents the page from being framed, and asks the solver to get around it and conduct a clickjacking attack that changes a user's email address. The task is to craft HTML that...
PortSwigger's Web Security Academy lab describes an XSS vulnerability triggered by a click, in which an attacker builds a clickjacking page that overlays a transparent iframe of the target's "Submit feedback" page under a decoy "Click me" button. The...
PortSwigger's lab presents a web application with login functionality and a delete account button protected by a CSRF token, where a victim on Chrome will click elements displaying the word "click" on a decoy website. The exercise asks the tester to craft...
Clickjacking is an interface-based attack in which a user is tricked into clicking actionable content on a hidden website by clicking on decoy content, typically an invisible iframe overlaid on a decoy page using CSS position and z-index values with...
This is PortSwigger's Website Terms of Use, a legal agreement governing access to portswigger.net and its associated tools and products, requiring users to accept the terms to use the site. The document sets out user obligations including confidentiality...
PortSwigger's certification terms state that exams are proctored by an Automated Proctor that authenticates a candidate's identity via a real-time webcam feed and reports any behavior that could constitute cheating or dishonesty. PortSwigger reserves the...
PortSwigger Research describes its Burp Suite Certified Practitioner exam as a practical test in which candidates must find and exploit vulnerabilities across several web applications, with stages requiring real exploitation rather than simple detection -...
PortSwigger's first preparation step for the Burp Suite Certified Practitioner exam is to work through a listed set of labs in order, completing each one in turn. There is no set time frame, but candidates must be able to finish each lab without access to...
PortSwigger's guide to preparing for the Burp Suite Certified Practitioner exam recommends working through a set list of Web Security Academy labs without using the provided solutions, then using a mystery lab challenge that spins up five randomized...
PortSwigger's Burp Suite Certified Practitioner exam is a four-hour practical test in which candidates must compromise two deliberately vulnerable applications, each in three stages: access any user account, use it to reach the admin interface, then read...
PortSwigger's Burp Suite Certified Practitioner exam requires a valid, active Burp Suite Professional license at the time of the exam and cannot be completed with Burp Suite Community Edition or any other testing toolkit. Candidates must use a project file...
PortSwigger published guidance for candidates retaking the Burp Suite Certified Practitioner exam, advising them to review their previous project file for missed clues, work through the suggested preparation steps, and complete additional Web Security...
PortSwigger's guidance for the Burp Suite Certified Practitioner exam states candidates get four hours to work through two applications, each with deliberate vulnerabilities, in three ordered stages: access any user account, reach the /admin interface,...
PortSwigger offers the Burp Suite Certified Practitioner (BSCP) certification, an exam for web security professionals that it says demonstrates deep knowledge of web vulnerabilities, the mindset to exploit them, and the Burp Suite skills to carry that out....
PortSwigger's lab demonstrates a login form that is subtly vulnerable to username enumeration and password brute-force attacks, using an account with a predictable username and password drawn from provided wordlists. The intended path is to enumerate a...
PortSwigger's lab is vulnerable to username enumeration through response timing, and solving it requires enumerating a valid username, brute-forcing that user's password, and accessing their account page. The lab also implements IP-based brute-force...
PortSwigger's lab is deliberately vulnerable to username enumeration and password brute-force attacks, and contains an account with a predictable username and password drawn from supplied wordlists. Solving it requires enumerating a valid username,...
PortSwigger's lab demonstrates username enumeration against a login that uses account locking, where the locking logic contains a flaw. The exercise has the tester enumerate a valid username, brute-force that user's password, and reach the account page,...
PortSwigger's lab describes a login page that temporarily blocks an IP after 3 incorrect logins in a row, but resets that failed-attempt counter when the attacker logs in to their own account before the limit is reached. The solution sends a pitchfork...
PortSwigger's Web Security Academy lab describes a login endpoint that accepts credentials in JSON and whose brute-force protection has a logic flaw: submitting the password field as an array of candidate strings in a single POST /login request returns a...
PortSwigger's research explains that password-based login treats knowledge of a secret password as sufficient proof of identity, so the site is compromised if an attacker can obtain or guess another user's credentials. It details how automated brute-force...
PortSwigger's lab demonstrates password reset poisoning, a vulnerability in which the application trusts a manipulated host header when generating reset links. The lab instructs the tester to add an X-Forwarded-Host header pointing at the exploit server in...
PortSwigger's Web Security Academy lab shows a password reset flow where the reset token is passed as a URL query parameter and included in the POST /forgot-password request, but the server never checks it when the new password is submitted. Deleting the...
PortSwigger's lab demonstrates that a password change function can be vulnerable to brute-force attacks, and the exercise asks the user to brute-force Carlos's account using a list of candidate passwords to reach his "My account" page. The walkthrough...
This PortSwigger lab stores a user's password hash in a stay-logged-in cookie and includes a stored XSS vulnerability in the comment functionality. The exercise is to use the XSS to obtain Carlos's cookie, decode it in Burp Decoder, crack the password...
A PortSwigger lab demonstrates that a stay-logged-in cookie is Base64-encoded and decodes to a username plus a 32-character string that the lab identifies as an MD5 hash of the user's password. The exercise has the user confirm the MD5 construction, then...