Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's Web Security Academy lab uses a serialization-based session mechanism that is vulnerable to privilege escalation through a PHP serialized object stored in the session cookie. The cookie is URL and Base64-encoded, and its admin attribute holds...
This PortSwigger lab uses a serialization-based session mechanism that is vulnerable to authentication bypass, and solving it requires editing the serialized object in the session cookie to reach the administrator account and then deleting the user carlos....
This PortSwigger lab uses a serialization-based session mechanism in the Ruby on Rails framework, where documented exploits enable remote code execution via a gadget chain. The task is to find a documented exploit, adapt it into a malicious serialized...
PortSwigger's lab presents a PHP application with a serialization-based session mechanism that uses a signed cookie and a common PHP framework, with no source code access provided. The exercise is to identify the target framework, use the third-party...
This PortSwigger lab uses a serialization-based session mechanism and loads the Apache Commons Collections library, and it can be exploited without source code access using pre-built gadget chains. The task is to use a third-party tool such as ysoserial to...
This PortSwigger lab presents a PHP application that uses a serialization-based session mechanism, which can be exploited through insecure deserialization by deploying a custom gadget chain to achieve remote code execution. The chain works by passing a...
PortSwigger's Web Security Academy lab presents a Java deserialization exercise in which a serialization-based session mechanism can be exploited by constructing a suitable gadget chain to obtain the administrator's password. The lab directs users to gain...
This PortSwigger lab uses a serialization-based session mechanism that is vulnerable to arbitrary object injection. To solve it, participants must obtain source code access, craft a malicious serialized CustomTemplate object with the lock_file_path...
PortSwigger Research explains that insecure deserialization occurs when a website deserializes user-controllable data, letting an attacker manipulate serialized objects or substitute an object of an entirely different class, since any class available to...
PortSwigger's lab presents an email change function that is vulnerable to CSRF with no defenses in place. The task is to craft HTML that uses a CSRF attack to change the viewer's email address and upload it to the exploit server, with login credentials...
PortSwigger's lab presents an email-change function vulnerable to CSRF because token validation only runs when a token is present, so a request that omits the token passes. Solvers host an HTML page on the exploit server that changes the viewer's email...
PortSwigger's lab presents an email-change function that is vulnerable to CSRF because its defenses are applied only to certain request types. The lab asks the solver to host an HTML page on the exploit server that changes the viewer's email address, using...
This PortSwigger lab presents an email change function vulnerable to CSRF because its tokens are not fully integrated into the site's session handling system. The exercise asks the tester to host an HTML page on the exploit server that changes the viewer's...
PortSwigger's lab presents an email change function that uses CSRF tokens but does not tie them to the user's session, leaving it open to cross-site request forgery. The exercise asks the tester to host an HTML page on the exploit server that changes a...
PortSwigger's lab presents an email change function that is vulnerable to CSRF because it relies on the insecure "double submit" prevention technique, where the token is duplicated in a cookie. The exercise asks the tester to host an HTML page on the...
PortSwigger's research describes how CSRF token validation fails in practice: applications that validate tokens on POST but skip validation on GET, applications that skip validation when the token parameter is omitted entirely, and applications that accept...
PortSwigger's lab demonstrates a cross-site WebSocket hijacking attack in which the live chat feature's handshake request carries no unpredictable tokens, so a script can open a new chat connection and pull the full chat history. Because the site sets...
PortSwigger's lab demonstrates a CSRF attack that bypasses SameSite=Strict session cookies by abusing a client-side redirect: the comment confirmation page's JavaScript builds a redirect path from the postId query parameter, and a path traversal sequence...
PortSwigger's lab demonstrates a CSRF attack against an email-change function that lacks unpredictable tokens, where the site sets session cookies without explicit SameSite attributes so browsers apply the default Lax restriction. Because Lax still sends...
PortSwigger's research explains that SameSite is a browser mechanism limiting when cookies are sent on cross-site requests, and that since 2021 Chrome applies Lax restrictions by default when a site does not set its own level. It describes bypasses...
PortSwigger's lab demonstrates a CSRF flaw in an email change function that tries to block cross-domain requests but falls back to an insecure mode when the Referer header is absent. The exercise asks the tester to host an HTML page on the exploit server...
PortSwigger's lab presents an email-change function that is vulnerable to CSRF and tries to block cross-domain requests, but its detection mechanism can be bypassed. The bypass works by appending the lab instance's domain to the Referer header as a query...
PortSwigger Research describes how applications that rely on the HTTP Referer header for CSRF defense are often subject to bypasses, since the header is optional and browsers can withhold or modify it. The text details two bypass patterns: applications...
PortSwigger's Web Security Academy lab describes a stored cross-site scripting vulnerability in a blog's comment functionality, where the comment field stores input without encoding it into the HTML context. The solution is to submit...
PortSwigger's Web Security Academy lab describes a simple reflected cross-site scripting vulnerability in a site's search functionality, where input is reflected into an HTML context with nothing encoded. The stated solution is to paste...
PortSwigger's lab presents a stored XSS vulnerability in a blog comments function, where a simulated victim user views all comments after they are posted. The exercise requires injecting a payload that makes anyone viewing the comment send a POST request...
PortSwigger's lab presents a stored XSS vulnerability in a blog comments function, where the goal is to exploit it to steal a CSRF token and use that token to change the email address of anyone who views the comment. The provided payload makes any viewer...
PortSwigger's lab contains a stored XSS vulnerability in a blog comments function, where a simulated victim user views every comment after it is posted. The intended solution injects a payload that makes anyone viewing the comment send a POST request with...
This PortSwigger lab contains a DOM-based cross-site scripting vulnerability on its home page, where jQuery's $() selector function auto-scrolls to a post whose title is passed through the location.hash property. Solving the lab requires delivering an...
PortSwigger's Web Security Academy lab describes a DOM-based cross-site scripting vulnerability on a submit feedback page, where the jQuery $ selector function finds an anchor element and changes its href attribute using data from location.search. The...