Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's research notes that account-management features beyond the login page - "remember me" cookies, password reset, and password change - often carry the same vulnerabilities sites guard against at login. It describes predictable cookie...
PortSwigger's Web Security Academy lab shows a two-factor authentication bypass in which a user who has a valid username and password but not the victim's verification code can log in as the victim by manually changing the URL to /my-account when prompted...
PortSwigger's lab demonstrates that a two-factor authentication implementation can be defeated by brute-forcing the 2FA verification code, using credentials for the victim account carlos:montoya. Because the verification code resets during the attack, the...
PortSwigger's Web Security Academy lab describes a two-factor authentication flaw in which the POST /login2 request uses a verify parameter to determine which user's account is being accessed. The solution changes verify to carlos to generate a temporary...
PortSwigger Research outlines how poorly implemented two-factor authentication can be beaten or bypassed entirely, including cases where a site puts the user in a logged-in state after the password step before the verification code is entered. It also...
PortSwigger Research published a list of usernames for use in Burp Intruder to help solve its Web Security Academy authentication labs. The list begins with common account names such as carlos, root, admin, test, guest, info, adm, mysql, user,...
PortSwigger Research publishes a copy-and-paste password list for use in Burp Intruder to solve its Web Security Academy authentication labs. The list runs from common strings such as 123456, password and qwerty through names and keyboard patterns...
PortSwigger Research's overview of authentication vulnerabilities states that they are conceptually easy to understand but usually critical, because authentication is the process of verifying a user's identity and its flaws can let attackers reach...
PortSwigger published a mapping table aligning its Web Security Academy topics with the OWASP Top 10 API vulnerabilities, noting that while some API risks carry different names, many match existing Academy material. The table pairs each risk with relevant...
PortSwigger's lab walks through exploiting server-side parameter pollution in a REST URL: a password reset request places the username value into the path of a server-side API call without escaping, which the tester confirms by submitting URL-encoded...
PortSwigger's lab walks through exploiting server-side parameter pollution in a password reset query string: sending username=administrator%26x=y returns a "Parameter is not supported" error, showing the internal API treats the injected &x=y as a separate...
Server-side parameter pollution occurs when a website embeds user input in a server-side request to an internal API without adequate encoding, letting an attacker manipulate or inject parameters. PortSwigger describes testing this by placing URL-encoded...
PortSwigger's lab walks through finding an unused API endpoint by sending an OPTIONS request to /api/products/3/price, which reveals that GET and PATCH are allowed. After logging in as wiener:peter, the tester sends a PATCH to /api/products/1/price with...
PortSwigger's lab walks through exploiting a mass assignment vulnerability in an e-commerce checkout API, where the GET response for /api/checkout exposes a chosen_discount parameter absent from the POST request. Adding chosen_discount to the POST body is...
PortSwigger's lab walks through finding exposed API documentation by trimming a PATCH /api/user/wiener request down to /api, which returns interactive docs. From those docs, the DELETE row is used with the identifier carlos to delete that user and solve...
PortSwigger Research outlines four access control security models: programmatic access control, which stores a matrix of user privileges in a database and applies controls with reference to it; discretionary access control, where resource owners assign or...
PortSwigger's Web Security Academy lab presents an admin panel at /admin that identifies administrators using a forgeable cookie rather than a server-side check. After logging in as wiener:peter, the response sets Admin=false, and changing it to Admin=true...
PortSwigger's Web Security Academy lab presents an admin panel at /admin that is restricted to logged-in users with a roleid of 2. The solution shows that after logging in as wiener:peter and updating the account email, the response returns the user's role...
PortSwigger's Web Security Academy lab presents a horizontal privilege escalation flaw on a user account page where users are identified by GUIDs rather than sequential IDs. The walkthrough has the tester find a blog post by carlos, note the GUID in his...
PortSwigger's Web Security Academy lab presents a user account page that displays the current user's existing password prefilled in a masked input, and the exercise is solved by changing the "id" parameter in the URL to administrator to retrieve the...
PortSwigger's Web Security Academy lab demonstrates an access control flaw in which changing the "id" request parameter to carlos returns a redirect to the home page whose body still contains carlos's API key. The lab is solved by logging in as...
PortSwigger's Web Security Academy lab presents a user account page whose URL carries the username in an "id" parameter, creating a horizontal privilege escalation vulnerability. The solution is to log in as wiener, send the request to Burp Repeater,...
PortSwigger's lab describes a site with an unauthenticated admin panel at /admin that a front-end system blocks from external access, while the back-end framework supports the X-Original-URL header. Sending a request to / with X-Original-URL: /invalid...
This PortSwigger Web Security Academy lab presents an application with an unprotected admin panel placed at an unpredictable location, but with that location disclosed somewhere in the application. The solution is to review the lab home page's source with...
PortSwigger's Web Security Academy lab presents an admin panel left unprotected, and the solution is to append /robots.txt to the lab URL, where the Disallow line discloses the path to the admin panel. Replacing /robots.txt with /administrator-panel in the...
PortSwigger's Web Security Academy lab shows an application that gates admin functionality on the Referer header alone. A non-admin session request to /admin-roles?username=carlos&action=upgrade is rejected when the Referer header is absent, but replaying...
PortSwigger's Web Security Academy lab presents an admin panel whose multi-step user-role change process leaves one step without access control. The solution logs in as administrator:admin, promotes carlos, sends the confirmation request to Burp Repeater,...
PortSwigger's Web Security Academy lab shows an application that enforces access control partly on the HTTP method of a request, letting a non-admin user reach admin functionality by changing the request method. In the walkthrough, a request to promote...
PortSwigger's Web Security Academy lab stores user chat logs as text files on the server's file system, retrieved through static URLs with filenames containing an incrementing number. The lab is solved by changing the transcript filename to 1.txt, reading...
PortSwigger's research describes broken access control as a common and often critical web vulnerability, splitting it into vertical controls (restricting sensitive functions to specific user types), horizontal controls (restricting resources to specific...