Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's lab demonstrates DOM XSS via client-side prototype pollution caused by a gadget in a third-party library, which the lab notes is easy to miss because the source code is minified. Using DOM Invader, the walkthrough identifies two prototype...
PortSwigger Research published a lab demonstrating DOM XSS via client-side prototype pollution, in which developers noticed a potential gadget and patched it by using Object.defineProperty() to make the transport_url property unwritable and unconfigurable,...
PortSwigger research describes widespread prototype pollution gadgets in common browser JavaScript APIs, including the Fetch API, where polluting Object.prototype with a headers property can be inherited by the options object passed to fetch() and used to...
Prototype pollution is a JavaScript vulnerability that lets an attacker add arbitrary properties to global object prototypes, which are then inherited by user-defined objects. It typically arises when a function recursively merges an object containing...
PortSwigger's lab presents a blind OS command injection vulnerability in an application's feedback function, where the application executes a shell command containing user-supplied details but does not return the command's output in the response. The...
This PortSwigger lab presents a blind OS command injection vulnerability in an application's feedback function, where the application executes a shell command containing user-supplied details but does not return the command output in the response. The lab...
PortSwigger's lab presents a blind OS command injection flaw in an application's feedback function, where user-supplied details are passed into a shell command that runs asynchronously and leaves no trace in the application's response. Because output...
PortSwigger's lab presents a blind OS command injection flaw in an application's feedback function, where user-supplied details are passed into a shell command that runs asynchronously and does not affect the application's response. Because output cannot...
OS command injection, also called shell injection, lets an attacker execute operating system commands on the server running an application, typically fully compromising the application and its data and often allowing a pivot to other systems through trust...
PortSwigger's lab demonstrates SSRF through an OAuth service's dynamic client registration endpoint, where client-supplied data such as the logo_uri property is used unsafely by the provider. The exercise requires crafting a POST /reg request with a...
PortSwigger's lab demonstrates an OAuth flaw in which the service's validation of the redirect_uri parameter is weak enough to allow directory traversal, letting an attacker point the redirect at an open redirect on the blog website. By chaining the two,...
PortSwigger's lab demonstrates an OAuth service whose flawed validation lets an attacker leak access tokens to arbitrary pages on the client application. The exercise requires finding a secondary vulnerability in the client application, using it as a proxy...
PortSwigger's lab demonstrates a forced OAuth profile linking flaw, where insecure implementation of the OAuth flow by the client application lets an attacker manipulate the social-media linking feature to reach other users' accounts. The exercise asks the...
This PortSwigger lab demonstrates an OAuth login flow in which flawed validation by the client application lets an attacker log in to other users' accounts without knowing their passwords. The exercise asks the participant to log in to the account of a...
A PortSwigger Web Security Academy lab demonstrates OAuth account hijacking through a redirect_uri misconfiguration in the OAuth provider, letting an attacker steal authorization codes tied to other users' accounts. The exercise requires stealing the admin...
NoSQL databases store and retrieve data in formats other than traditional SQL relational tables, and are built to handle large volumes of unstructured or semi-structured data with fewer relational constraints and consistency checks than SQL. Unlike SQL,...
PortSwigger's lab targets a MongoDB-backed user lookup vulnerable to NoSQL injection, where changing the login password parameter to {"$ne":"invalid"} returns an "Account locked" error instead of "Invalid username or password," confirming the operator was...
PortSwigger's lab presents a user lookup function backed by a MongoDB NoSQL database that is vulnerable to NoSQL injection, and the goal is to extract the administrator password and log in as that user. The walkthrough shows that a single quote in the user...
PortSwigger's lab presents a product category filter backed by a MongoDB NoSQL database that is vulnerable to NoSQL injection. Submitting a single quote in the category parameter triggers a JavaScript syntax error, and a boolean condition that always...
PortSwigger's lab demonstrates a login backed by a MongoDB NoSQL database that accepts MongoDB operators in its username and password parameters, allowing authentication to be bypassed. Setting the password parameter to {"$ne":""} and the username...
PortSwigger Research describes NoSQL injection as a vulnerability where an attacker interferes with the queries an application sends to a NoSQL database, with two types covered and MongoDB, the most popular NoSQL database, used as the exploitation focus....
PortSwigger Research describes a mystery lab challenge in which the title and description of a random lab are hidden, so the solver must work out the vulnerability type through recon and analysis alone. Some labs provide an account with the credentials...
PortSwigger's lab presents a web application that assumes a user's privilege level based on their input, letting an attacker exploit the logic of its account management features to reach arbitrary users' accounts. The stated goal is to access the...
PortSwigger's lab presents a purchasing workflow that does not adequately validate user input, allowing a logic flaw to be exploited so items can be bought at an unintended price. Solving it requires buying a "Lightweight l33t leather jacket" while logged...
PortSwigger's Web Security Academy lab describes a shopping workflow that assumes events happen in order: after checkout, the POST /cart/checkout request redirects to an order confirmation page. By sending GET...
PortSwigger's lab presents a purchasing workflow with a logic flaw that lets a user buy a "Lightweight l33t leather jacket" by exploiting the checkout process. The provided solution automates buying and redeeming gift cards using Burp Intruder, with Turbo...
PortSwigger's lab describes a web application whose flawed logic lets arbitrary users reach administrative functionality intended only for company employees. The lab instructs users to register with an arbitrary email address in a specified format, then...
PortSwigger's lab presents a web application that does not adequately validate user input, and a logic flaw in its account registration process can be exploited to reach administrative functionality. The lab directs the tester to register with an email...
PortSwigger's Web Security Academy lab describes a purchasing workflow that fails to validate user input: the quantity in a POST /cart request can be set to an arbitrary integer, and a negative quantity larger than the cart's contents forces the cart to...
PortSwigger's Web Security Academy lab describes a purchasing workflow with a logic flaw: a logged-in user with credentials wiener:peter can obtain two coupon codes, NEWCUST5 and SIGNUP30, and apply both at checkout. Entering the same code twice in a row...