Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's Web Security Academy lab demonstrates a purchasing workflow that fails to validate user input, letting a logged-in user buy a "Lightweight l33t leather jacket" for an unintended price. The POST /cart request carries a price parameter, and...
PortSwigger's lab demonstrates an email address parsing discrepancy in which a registration form enforces a ginandjuice.shop domain check, but encoded-word formats slip past it: UTF-8 and ISO-8859-1 encoded addresses were blocked with 'Registration blocked...
PortSwigger's Web Security Academy lab describes a login flow that assumes users complete each step in order: after the POST /login request, the next request is GET /role-selector, where the user picks a role before reaching the home page. Dropping that...
This PortSwigger lab contains a logic flaw that exposes an encryption oracle to users, and solving it requires exploiting that flaw to reach the admin panel and delete the user carlos. The lab shows that an error message reflects the email parameter in...
PortSwigger's Web LLM attacks lab demonstrates indirect prompt injection against a live chat LLM that has access to APIs for deleting accounts and editing associated email addresses. The lab walks through confirming the APIs, testing that the Edit Email...
PortSwigger's Web LLM attacks lab presents a live LLM whose accessible APIs include a Newsletter Subscription function, and asking it to call that API with the argument $(whoami)@... caused the resulting email to be sent to carlos@..., indicating the...
PortSwigger's Web LLM attacks lab demonstrates an LLM-backed live chat whose Debug SQL API accepts a string containing an entire SQL statement, letting the model execute raw SQL on the database. By asking the LLM which APIs it can access and what arguments...
A PortSwigger Web Security Academy lab demonstrates that an LLM chat feature which renders its output without encoding is vulnerable to XSS, since submitting the string <img src=1 onerror=alert(1)> to the live chat triggers an alert dialog. The lab shows...
PortSwigger Research published a lab in which an AI-powered site scanner holds sensitive user data, including API keys, and has been given the login credentials for the user carlos so it can explore authenticated areas of the site. The lab is vulnerable to...
PortSwigger Research published a lab in which an AI-powered scanner, given login credentials for the user carlos, investigates user-generated content on a site. The lab's goal is to delete carlos by using indirect prompt injection to manipulate the LLM's...
PortSwigger published a lab in which an application's AI-powered scanner is vulnerable to indirect prompt injection and can be manipulated into exploiting a routing-based SSRF vulnerability on the internal network. The lab uses a live LLM, which...
PortSwigger Research published a lab featuring an AI-powered scanner that holds sensitive user data, including API keys, and has been given the login credentials for the user carlos so it can explore authenticated areas of the site. The scanner has...
PortSwigger Research describes how AI-powered scanners that use LLMs to interpret web content can be manipulated through indirect prompt injection, where malicious instructions embedded in stored content are treated as part of the scanner's action plan....
PortSwigger states that it collects telemetry data only in specific Burp Suite Academy labs, which are always clearly and visibly marked before a user enters them. In those marked labs it collects technical and interaction data such as activity events,...
PortSwigger's lab demonstrates a JWT authentication bypass in which the application signs and verifies session tokens with an extremely weak secret key that can be brute-forced from a wordlist of common secrets. Following the walkthrough, hashcat reveals...
A PortSwigger Web Security Academy lab demonstrates a JWT authentication bypass in which the server does not verify the signature on any JWT it receives. By changing the sub claim in the token payload from wiener to administrator, a logged-in user reaches...
This PortSwigger lab demonstrates a JWT authentication bypass in which the server uses the kid header parameter to fetch a signing key from its filesystem. By pointing kid at /dev/null via a path traversal sequence and signing the token with an empty...
This PortSwigger lab presents a JWT authentication bypass in which the server accepts the jwk parameter in the JWT header, letting a token embed its own verification key, but fails to check whether that key came from a trusted source. The exercise has the...
PortSwigger's lab demonstrates a JWT authentication bypass in which the server accepts a jku header parameter but does not verify that the supplied URL belongs to a trusted domain before fetching the key. The exercise walks through hosting a JWK Set on an...
PortSwigger's lab demonstrates a JWT authentication bypass in which the server is insecurely configured to accept unsigned tokens. By changing the sub claim to administrator, setting the alg parameter to none, and removing the signature while leaving the...
This PortSwigger lab presents a JWT session mechanism that uses an RSA key pair to sign and verify tokens but is vulnerable to algorithm confusion attacks due to implementation flaws. The exercise has the user derive the server's public key from two valid...
This PortSwigger lab presents a JWT session mechanism that signs and verifies tokens with an RSA key pair but is vulnerable to algorithm confusion attacks because of implementation flaws. The server exposes its public key as a JWK Set at /jwks.json, and...
Algorithm confusion attacks, also called key confusion attacks, occur when an attacker forces a server to verify a JWT signature using a different algorithm than the developers intended, potentially letting them forge valid tokens with arbitrary values...
PortSwigger's Web Security Academy lab demonstrates source code disclosure through backup files: the site's /robots.txt reveals a /backup directory containing ProductTemplate.java.bak, and the leaked source code holds a hard-coded Postgres database...
PortSwigger's Web Security Academy lab presents an application with a debug page that discloses sensitive information, including the SECRET_KEY environment variable. The solution path runs from an HTML comment on the home page linking to...
This PortSwigger lab presents a web application that discloses sensitive information through its version control history. Solving it requires obtaining the administrator password from that history, logging in, and deleting the user carlos. What's...
PortSwigger's Web Security Academy lab shows that sending a non-integer value such as a string in the productId parameter of a GET /product request causes an exception, and the response returns a full stack trace. That stack trace reveals the application...
This PortSwigger lab presents an administration interface with an authentication bypass vulnerability that cannot practically be exploited without knowing a custom HTTP header used by the front-end. Solving it requires obtaining that header name, using it...
PortSwigger's research explains that information disclosure, also called information leakage, occurs when a website unintentionally reveals sensitive information to its users, and that attackers often have to elicit the leak by interacting with the site in...
This PortSwigger lab demonstrates password reset poisoning via dangling markup, in which tampering with the domain name in the Host header causes a server error, but adding an arbitrary non-numeric port to the Host header still reaches the site normally...