Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger Research published a delimiter list for its Web Security Academy web cache deception labs, covering the printable ASCII characters from ! through ~ plus their percent-encoded equivalents such as %21, %2F, and %7E. The list sits alongside the...
PortSwigger's lab walks through a web cache deception attack in which adding an arbitrary path segment to /my-account still returns the account page, and appending a .js extension causes the cache to store the response, shown by X-Cache changing from miss...
PortSwigger's lab walks through a web cache deception attack in which the tester uses Burp Intruder to find that the origin server treats ';' and '?' as path delimiters, then appends ';abc.js' to /my-account so the cache stores the victim's account page...
PortSwigger's lab walks through exploiting a mismatch between origin server and cache path handling: the origin server treats '?' as its only path delimiter and decodes encoded dot-segments like /aaa/..%2fmy-account to reach /my-account, while the cache...
PortSwigger's lab walks through exploiting an exact-match cache rule: the origin server treats ';' and '?' as path delimiters, and the cache normalizes a path like /my-account;%2f%2e%2e%2frobots.txt to /robots.txt, so a request for that URL returns the...
PortSwigger's lab walks through exploiting web cache deception by finding which characters an origin server treats as path delimiters: Intruder testing showed that #, ?, %23, and %3f returned 200 responses containing the user's API key, while # was ruled...
Web cache deception is a vulnerability where an attacker tricks a web cache into storing sensitive, dynamic content by exploiting discrepancies between how the cache server and origin server handle requests. PortSwigger describes how an attacker persuades...
PortSwigger announced it will not produce a third edition of The Web Application Hacker's Handbook, the reference book it describes as the de facto standard for learning web security for over a decade. Instead, the company created the Web Security Academy,...
PortSwigger published a URL validation bypass cheat sheet containing payloads for evading URL validation, aimed at attacks including server-side request forgery, CORS misconfigurations, and open redirection. The page describes the wordlists as useful for...
PortSwigger's lab presents a stock check feature that fetches data from an internal system, and the task is to change the stock check URL to reach the admin interface at http://localhost/admin and delete the user carlos. The developer has deployed an...
PortSwigger's Web Security Academy lab presents a stock check feature that fetches data from an internal system, and the task is to change the stock check URL to reach the admin interface at http://localhost/admin and delete the user carlos. The lab states...
PortSwigger's lab presents a stock check feature that fetches data from an internal system, and the stock checker is restricted to only access the local application. To solve it, a tester must find an open redirect on the application, build a URL that...
PortSwigger's Web Security Academy lab presents a stock check feature that fetches data from an internal system, and the exercise is solved by changing the stockApi parameter to http://localhost/admin to reach the administration interface. The lab then has...
PortSwigger's Web Security Academy lab presents a stock check feature that fetches data from an internal system, and the exercise is to use it to scan the 192.168.0.X range on port 8080 for an admin interface. The solution intercepts the stockApi...
PortSwigger's lab asks the solver to exploit analytics software that fetches the URL in the Referer header, using it to perform a blind SSRF attack against an internal server in the 192.168.0.X range on port 8080. The blind attack uses a Shellshock payload...
PortSwigger's lab on blind SSRF with out-of-band detection uses a site whose analytics software fetches the URL in the Referer header when a product page loads. The exercise is to use that behavior to trigger an HTTP request to the public Burp Collaborator...
PortSwigger's lab presents a SQL injection vulnerability in a product category filter, where query results are returned in the application's response and can be exploited with a UNION attack to pull data from other tables. The database holds a separate...
This PortSwigger lab presents a SQL injection vulnerability in a product category filter, where query results are returned in the application's response, allowing a UNION attack to pull data from other tables. The database holds a separate users table with...
This PortSwigger lab presents a SQL injection vulnerability in a product category filter, where query results are returned in the application's response and can be exploited with a UNION attack to retrieve data from other tables. The lab requires...
PortSwigger's lab presents a SQL injection vulnerability in a product category filter, where query results are returned in the application's response and can be exploited with a UNION attack to retrieve data from other tables. The lab's first step is...
PortSwigger Research explains that when an application is vulnerable to SQL injection and query results appear in its responses, the UNION keyword lets an attacker append additional SELECT queries and pull data from other tables. The technique requires...
PortSwigger's lab presents a stock check feature that passes productId and storeId to the application in XML format, where the storeId is evaluated in a SQL query whose results return in the response. A web application firewall blocks obvious SQL injection...
PortSwigger's Web Security Academy lab describes a SQL injection vulnerability in a product category filter, where selecting a category runs a query of the form SELECT * FROM products WHERE category = 'Gifts' AND released = 1. The stated solution is to...
PortSwigger's Web Security Academy lab presents a SQL injection vulnerability in an application's login function, where the goal is to log in as the administrator user. The stated solution is to intercept and modify the login request with Burp Suite and...
PortSwigger's lab presents a SQL injection vulnerability in a product category filter that can be exploited with a UNION attack to retrieve results from an injected query. Because Oracle requires every SELECT to name a table, the lab notes that a UNION...
PortSwigger's lab presents a SQL injection vulnerability in a product category filter, which can be exploited with a UNION attack to return results from an injected query. Solving the lab requires determining the number of columns returned and which...
PortSwigger's lab presents a SQL injection vulnerability in a product category filter, where query results are returned in the application's response and a UNION attack can retrieve data from other tables. The lab requires determining the name and columns...
PortSwigger's lab contains a SQL injection vulnerability in the product category filter, and the query results are returned in the application's response, allowing a UNION attack to pull data from other tables. The database holds a table of usernames and...
PortSwigger's research note describes how attackers exploit SQL injection by first fingerprinting the database, using provider-specific version queries to identify the type and version, such as confirming Microsoft SQL Server from a UNION attack's output....
This PortSwigger lab presents a blind SQL injection in an application that runs a SQL query against the value of a tracking cookie, returning no query results and giving no different response for rows or errors. Because the query executes synchronously,...