Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's guidance describes using Burp Scanner alongside manual testing: right-clicking a request and selecting Do active scan audits only that request with the default configuration, and highlighting an insertion point and selecting Scan selected...
PortSwigger Research describes how attackers evade input filters by exploiting mismatches between the decoding a WAF or filter performs and the decoding the back-end server or browser later applies, using URL, HTML, XML, Unicode, hex, and octal encodings....
PortSwigger's Burp AT can now be used alongside Web Security Academy labs, with a /academy-lab-mentor skill that asks questions and offers small clues rather than the answer, drawing on the user's Proxy traffic and shared requests and responses. The...
PortSwigger's Web Security Academy guidance states that each lab demonstrates just one variation of a vulnerability, and that copying lab solutions onto real sites will only get testers so far because live targets have often already been audited and...
PortSwigger describes DOM-based WebSocket-URL poisoning, which occurs when a script uses controllable data as the target URL of a WebSocket connection, letting an attacker construct a URL that makes another user's browser open a WebSocket connection to a...
PortSwigger Research describes web message manipulation vulnerabilities, which arise when a script sends attacker-controllable data as a web message to another document in the browser. An attacker can construct a page that, when visited by a user, causes...
This PortSwigger lab contains a DOM-based open-redirection vulnerability in the url parameter of a blog post page's "Back to Blog" link, which lets an attacker change where that link sends the user. Solving the lab requires constructing a URL with the lab...
DOM-based open-redirection vulnerabilities arise when a script writes attacker-controllable data into a sink that can trigger cross-domain navigation, such as unsafe handling of the location.hash property. An attacker can construct a URL that redirects...
PortSwigger describes DOM-based local file-path manipulation as a vulnerability that arises when a script passes attacker-controllable data to a file-handling API as the filename parameter. An attacker may construct a URL that, when visited by another...
DOM-based link-manipulation vulnerabilities arise when a script writes attacker-controllable data to a navigation target within the current page, such as a clickable link or a form's submission URL. An attacker can construct a URL that, when visited by...
DOM-based JavaScript-injection vulnerabilities arise when a script executes attacker-controllable data as JavaScript, letting an attacker construct a URL that runs arbitrary JavaScript in a victim's browser session if that user visits it. PortSwigger says...
PortSwigger Research describes DOM-based HTML5-storage manipulation, where a script stores attacker-controllable data in the browser's localStorage or sessionStorage, letting an attacker build a URL that makes another user's browser store that data. The...
DOM-data manipulation vulnerabilities arise when a script writes attacker-controllable data to a DOM field used in the visible UI or client-side logic, letting an attacker build a URL that modifies the appearance or behavior of the client-side UI for...
PortSwigger's lab demonstrates a DOM-clobbering flaw in a blog comment feature that permits "safe" HTML: two anchor tags sharing an ID form a DOM collection, and the name attribute on the second anchor clobbers the avatar property with its href value. The...
PortSwigger's lab uses the HTMLJanitor library, which filters HTML attributes through its attributes property, but that property can itself be clobbered so its length becomes undefined, letting an attacker inject arbitrary attributes into a form element....
DOM clobbering is a technique where injecting HTML into a page manipulates the DOM and changes how JavaScript behaves, and it is most useful when XSS is not possible but you control HTML where id or name attributes pass the filter. The most common form...
PortSwigger Research describes DOM-based document-domain manipulation, which occurs when a script uses attacker-controllable data to set the document.domain property, letting an attacker construct a URL that causes a response page to set an arbitrary...
PortSwigger describes DOM-based denial-of-service vulnerabilities as arising when a script passes attacker-controllable data in an unsafe way to a problematic platform API, such as one whose invocation can make the user's computer consume excessive CPU or...
This PortSwigger lab demonstrates DOM-based client-side cookie manipulation, in which an iframe loads a product page URL with a JavaScript payload appended so the browser saves that malicious URL as the lastViewedProduct cookie. An onload handler then...
PortSwigger describes DOM-based cookie manipulation as a vulnerability that arises when a script writes attacker-controllable data into a cookie's value, letting an attacker construct a URL that sets an arbitrary value in another user's cookie when...
This PortSwigger lab demonstrates DOM XSS through web messaging: a postMessage() call sends a message with type load-channel to the home page, whose event listener parses it with JSON.parse() and passes it to a switch. The load-channel case assigns the...
PortSwigger's lab demonstrates a DOM-based redirection vulnerability triggered by web messaging, where a page's event listener checks for the string "http:" and then passes the message payload to the location.href sink. The exploit page adds an iframe that...
This PortSwigger lab demonstrates a DOM cross-site scripting flaw in which a home page's event listener, intended to serve ads, takes the content of a web message and inserts it into the div with the ID ads. The exploit uses an iframe whose postMessage()...
PortSwigger Research describes how web messages become a source for DOM-based vulnerabilities when a page's event listener fails to verify the origin of incoming messages, letting an attacker host a malicious iframe and use postMessage() to pass a payload...
DOM-based XPath injection occurs when a script incorporates attacker-controllable data into an XPath query, letting an attacker construct a URL that triggers an arbitrary XPath query when another user visits it. The retrieved data may differ from what the...
PortSwigger describes DOM-based client-side SQL injection, where a script places attacker-controllable data into a client-side SQL query unsafely, letting an attacker build a URL that runs an arbitrary SQL query in the visitor's local browser database. The...
PortSwigger describes DOM-based JSON injection as occurring when a script places attacker-controllable data into a string that is then parsed as JSON and processed by the application. An attacker can build a URL that, when another user visits it, causes...
PortSwigger describes DOM-based Ajax request-header manipulation as a vulnerability that arises when a script writes attacker-controllable data into the request header of an Ajax request issued through an XmlHttpRequest object. An attacker can construct a...
A PortSwigger Web Security Academy lab demonstrates achieving remote code execution without explicit deserialization by combining PHAR deserialization with a custom gadget chain. The lab's website uses the Twig template engine, and the technique passes a...
This PortSwigger lab presents a web application that uses a serialization-based session mechanism, where a certain feature invokes a dangerous method on data supplied in a serialized object. The exercise asks the solver to edit the serialized object in the...