Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
This PortSwigger lab presents a blind SQL injection vulnerability in an application that stores a tracking cookie value and runs it in a synchronous SQL query. Because the application returns no query results and responds identically whether the query...
This PortSwigger lab presents a SQL injection vulnerability in an analytics tracking cookie whose value is placed into a SQL query, with the query results not returned to the user. The lab requires leaking the administrator password from a users table with...
PortSwigger's lab presents a blind SQL injection in an application that runs a SQL query against the value of a tracking cookie, executed asynchronously with no effect on the application's response. The database holds a separate users table with username...
This PortSwigger lab contains a blind SQL injection vulnerability in the TrackingId cookie, which the application passes into a SQL query that runs asynchronously and has no effect on the response. To solve it, participants modify the cookie with a payload...
PortSwigger's lab presents a blind SQL injection in an application that runs a SQL query on the value of a tracking cookie for analytics, returning no query results and no error messages. The only signal is a 'Welcome back' message that appears when the...
PortSwigger's lab presents a blind SQL injection in a tracking cookie that the application feeds into a SQL query, where query results are not returned and responses differ only when the query causes an error, which returns a custom error message. The lab...
SQL injection is a web security vulnerability that lets an attacker interfere with the queries an application makes to its database, allowing them to view, modify, or delete data they should not access, and in some cases compromise the underlying server or...
This PortSwigger lab is vulnerable to server-side template injection because an object is passed into the template, and the flaw can be exploited to access sensitive data. The goal is to steal and submit the framework's secret key, using provided account...
PortSwigger's lab demonstrates server-side template injection through the blog-post-author-display parameter in a POST request for changing a preferred name, where an arbitrary file can be set as the avatar and rendered by viewing a test comment. The lab...
PortSwigger published a lab in which the target application is vulnerable to server-side template injection, and solving it requires identifying the template engine and using its documentation to work out how to execute arbitrary code. The goal is to...
PortSwigger's lab presents a target vulnerable to server-side template injection, and solving it requires identifying the template engine and finding a documented exploit online to execute arbitrary code. The final step modifies that exploit to call...
This PortSwigger lab uses the Freemarker template engine, which is vulnerable to server-side template injection because of its poorly implemented sandbox. Solving the lab requires breaking out of the sandbox to read the file my_password.txt from Carlos's...
PortSwigger's lab demonstrates server-side template injection in a Tornado template, where the "preferred name" feature lets a user escape the {{someExpression}} syntax and inject arbitrary template code. The exercise requires using Tornado's syntax for...
PortSwigger's lab demonstrates server-side template injection caused by the unsafe construction of an ERB template. Solving it requires using ERB template syntax to run arbitrary code and delete the morale.txt file from Carlos's home directory. What's...
PortSwigger Research first documented server-side template injection in a 2015 paper and conference presentation, describing it as an attacker using native template syntax to inject a malicious payload into a template that is then executed server-side. The...
This PortSwigger lab presents a front-end and back-end server that handle duplicate HTTP request headers differently, with the front-end rejecting any method other than GET or POST. The goal is to smuggle a request so the back-end processes the next...
PortSwigger's lab sets up a front-end and back-end server where the back-end does not support chunked encoding and the front-end rejects any request not using GET or POST. The goal is to smuggle a request so the back-end processes the next request as...
This PortSwigger lab sets up a front-end and back-end server pair where the front end does not support chunked encoding and rejects any request that is not GET or POST. The goal is to smuggle a request to the back end so that its next processed request...
This PortSwigger lab sets up a front-end and back-end server where the back-end does not support chunked encoding, and the task is to smuggle a request so that a later request for the web root returns a 404 Not Found. The lab supports HTTP/2, but the...
This PortSwigger lab sets up a front-end and back-end server pair where the front-end does not support chunked encoding, and asks the solver to smuggle a request to the back-end so that a later request for the web root returns a 404. The lab supports...
This PortSwigger lab sets up a front-end and back-end server where the front-end does not support chunked encoding, and an admin panel at /admin is reachable only from IP address 127.0.0.1. The front-end adds an HTTP header carrying the client's IP...
This PortSwigger lab sets up a front-end and back-end server pair where the front-end does not support chunked encoding and is configured to cache certain responses. The goal is a request smuggling attack that poisons the cache so a later request for a...
This PortSwigger lab sets up a front-end and back-end server pair where the front-end does not support chunked encoding and caches static resources. The goal is to perform a request smuggling attack so the next user's request causes their API key to be...
This PortSwigger lab sets up a front-end and back-end server pair where the front-end does not support chunked encoding, and the application reflects input from the User-Agent header, making it vulnerable to reflected XSS. The exercise is to smuggle a...
This PortSwigger lab sets up a front-end and back-end server where the front-end does not support chunked encoding, and asks the solver to smuggle a request to the back-end that stores the next user's request in the application. The solver then retrieves...
PortSwigger's lab sets up a front-end and back-end server where the back-end does not support chunked encoding, and an admin panel at /admin is blocked by the front-end. The intended solution requires HTTP/1-only techniques to smuggle a request past the...
This PortSwigger lab presents a front-end and back-end server setup where the front-end does not support chunked encoding, and an admin panel at /admin is blocked from the front end. The intended solution is a CL.TE request smuggling attack that smuggles a...
PortSwigger published a lab demonstrating pause-based server-side request smuggling against Apache 2.4.52, where the front-end streams requests to the back-end and the back-end does not close the connection after a timeout on some endpoints. The technique...
PortSwigger Research describes pause-based desync attacks, in which a server's read timeout causes it to treat a partial request as complete while leaving the connection open for reuse, enabling CL.0-style request smuggling. The team found this behavior in...
PortSwigger Research published a lab showing client-side desync attacks, where a server ignores the Content-Length header on requests to some endpoints, letting an attacker induce a victim's browser to disclose its session cookie. The lab walks through...