Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's lab demonstrates password reset poisoning: the POST /forgot-password request accepts an arbitrary Host header, so the reset email sent to a user contains a link pointing at the attacker's domain. By setting the Host header to their exploit...
Password reset poisoning is a technique in which an attacker manipulates a vulnerable website into generating a password reset link that points to a domain the attacker controls, letting them steal the secret tokens needed to reset arbitrary users'...
PortSwigger's lab demonstrates web cache poisoning caused by discrepancies in how the cache and the back-end application handle ambiguous requests. The exercise requires adding a second Host header containing the exploit server's domain name in Burp...
PortSwigger's lab demonstrates routing-based SSRF caused by flawed parsing of a request's intended host, letting an attacker reach an insecure intranet admin panel at an internal IP in the 192.168.0.0/24 range. Solving it requires pointing an absolute URL...
PortSwigger's lab demonstrates routing-based SSRF through the Host header, where replacing the Host value with an address in the 192.168.0.0/24 range lets an attacker reach an insecure intranet admin panel on an internal IP. Solving it requires sending a...
PortSwigger Research published a lab demonstrating a routing-based SSRF flaw in which a front-end server validates the Host header on the first request of a connection but then assumes all later requests on that same connection share that validation. The...
PortSwigger's Web Security Academy lab demonstrates a host header authentication bypass in which an application decides a user's privilege level from the HTTP Host header. The solution changes the Host header to localhost on a GET /admin request, which...
GraphQL is an API query language that lets clients specify exactly what data they want in a response, avoiding the large response objects and multiple calls sometimes seen with REST APIs. All GraphQL operations use the same endpoint, generally sent as a...
PortSwigger's lab shows a GraphQL endpoint at POST /graphql/v1 that exposes a postPassword field on the BlogPost type when an introspection query is sent. By changing the id variable to 3 and adding postPassword to the query, the hidden blog post's secret...
A PortSwigger lab exercise shows how to find a hidden GraphQL endpoint by sending requests to common suffixes, where a GET to /api returned a "Query not present" error and a universal query confirmed the endpoint. The lab then bypasses introspection...
PortSwigger's lab shows a GraphQL user-management endpoint that accepts x-www-form-urlencoded requests, making it vulnerable to cross-site request forgery. The walkthrough converts an email-change mutation into a form-encoded POST, generates a CSRF proof...
PortSwigger's lab demonstrates that a GraphQL login API with a rate limiter returning errors for too many requests from one origin can still be brute-forced by sending multiple login mutations as aliases in a single request. The lab's goal is to sign in as...
PortSwigger's lab demonstrates an access control vulnerability in a GraphQL endpoint that powers user management, where an introspection query exposes the API's queries and a modified getUser query returns the administrator's credentials. The lab's...
Andres Rauschecker, a 26-year-old Munich-based pentester with a Master's in Cybersecurity, is profiled as a high flyer in PortSwigger's Web Security Academy Hall of Fame. He describes using Burp Suite Pro at work and for CTFs, working through Academy labs...
PortSwigger's Web Security Academy offers free learning materials, interactive labs, and guided learning paths that progress users from Apprentice to Expert level with a Hall of Fame ranking. The page also points to Burp Suite tutorial videos covering...
PortSwigger's lab presents an image upload function that validates files robustly, but moves each upload to an accessible folder before the virus check completes, so a malicious file can run in the window before removal. The lab asks the solver to upload a...
PortSwigger's lab presents an image upload function whose server is configured to block execution of user-supplied files, but the restriction can be bypassed through a secondary vulnerability. The walkthrough has the user upload a basic PHP web shell,...
PortSwigger's lab presents an image upload function that blacklists certain file extensions, and the defense can be bypassed with a classic obfuscation technique. The solution is to upload a basic PHP web shell, using a URL-encoded null byte followed by a...
PortSwigger's lab presents an image upload function that blacklists certain file extensions, but the blacklist can be bypassed because of a flaw in how it is configured. The exercise requires uploading a basic PHP web shell and a second file containing an...
This PortSwigger lab presents an image upload function that tries to block unexpected file types but relies on checking user-controllable input to do so. The task is to upload a basic PHP web shell and use it to exfiltrate the contents of...
PortSwigger's lab presents an image upload function that performs no validation on uploaded files before storing them on the server's filesystem. Solving it requires uploading a basic PHP web shell and using it to exfiltrate the contents of...
PortSwigger's lab presents an image upload function that verifies a file's contents are a genuine image but still allows server-side code to be uploaded and executed. The solution is a polyglot PHP/JPG file with the PHP payload placed in the image's...
PortSwigger's Web Security Academy lab describes a path traversal vulnerability in the display of product images, where the application transmits the full file path in a request parameter and validates only that the supplied path starts with the expected...
PortSwigger's Web Security Academy lab describes a path traversal vulnerability in a product image display feature, where the application validates that a supplied filename ends with the expected file extension. The solution modifies the filename parameter...
This PortSwigger Web Security Academy lab presents a product-image display with a path traversal vulnerability: the application blocks input containing traversal sequences, then URL-decodes the input before using it. The solution is to intercept a product...
This PortSwigger Web Security Academy lab presents a path traversal vulnerability in the display of product images, where the application strips path traversal sequences from the user-supplied filename before using it. The solution modifies the filename...
PortSwigger's Web Security Academy lab presents a product-image display that is vulnerable to path traversal: the application blocks traversal sequences but resolves the supplied filename against a default working directory. Supplying the absolute path...
Path traversal, also called directory traversal, lets an attacker read arbitrary files on the server running an application, and in some cases write to them to modify application data or behavior and take full control of the server. PortSwigger's example...
PortSwigger's lab presents a stored cross-site scripting vulnerability hidden in a non-standard data structure that is difficult to find manually, and instructs users to locate it with Burp Scanner's Scan selected insertion point feature. Burp Scanner...
PortSwigger's lab presents a server with a vulnerability that allows arbitrary file reads, and the task is to retrieve the contents of /etc/passwd within 10 minutes. Because of the tight time limit, the lab recommends using Burp Scanner on a specific...