mirror of https://github.com/aliasrobotics/cai.git
remove readme on utils folder
This commit is contained in:
cris
parent
e139441d77
commit
5a32b8d0e6
|
|
@ -1,274 +0,0 @@
|
|||
# PortSwigger Labs
|
||||
|
||||
| Section | Lab Title | URL |
|
||||
|---------|-----------|-----|
|
||||
| sql-injection | SQL injection vulnerability in WHERE clause allowing retrieval of hidden data] | [Link](https://portswigger.net/web-security/sql-injection/lab-retrieve-hidden-data) |
|
||||
| sql-injection | SQL injection vulnerability allowing login bypass] | [Link](https://portswigger.net/web-security/sql-injection/lab-login-bypass) |
|
||||
| sql-injection | SQL injection attack, querying the database type and version on Oracle] | [Link](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-oracle) |
|
||||
| sql-injection | SQL injection attack, querying the database type and version on MySQL and Microsoft] | [Link](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-mysql-microsoft) |
|
||||
| sql-injection | SQL injection attack, listing the database contents on non-Oracle databases] | [Link](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-non-oracle) |
|
||||
| sql-injection | SQL injection attack, listing the database contents on Oracle] | [Link](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-oracle) |
|
||||
| sql-injection | SQL injection UNION attack, determining the number of columns returned by the query] | [Link](https://portswigger.net/web-security/sql-injection/union-attacks/lab-determine-number-of-columns) |
|
||||
| sql-injection | SQL injection UNION attack, finding a column containing text] | [Link](https://portswigger.net/web-security/sql-injection/union-attacks/lab-find-column-containing-text) |
|
||||
| sql-injection | SQL injection UNION attack, retrieving data from other tables] | [Link](https://portswigger.net/web-security/sql-injection/union-attacks/lab-retrieve-data-from-other-tables) |
|
||||
| sql-injection | SQL injection UNION attack, retrieving multiple values in a single column] | [Link](https://portswigger.net/web-security/sql-injection/union-attacks/lab-retrieve-multiple-values-in-single-column) |
|
||||
| sql-injection | Blind SQL injection with conditional responses] | [Link](https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses) |
|
||||
| sql-injection | Blind SQL injection with conditional errors] | [Link](https://portswigger.net/web-security/sql-injection/blind/lab-conditional-errors) |
|
||||
| sql-injection | Visible error-based SQL injection] | [Link](https://portswigger.net/web-security/sql-injection/blind/lab-sql-injection-visible-error-based) |
|
||||
| sql-injection | Blind SQL injection with time delays] | [Link](https://portswigger.net/web-security/sql-injection/blind/lab-time-delays) |
|
||||
| sql-injection | Blind SQL injection with time delays and information retrieval] | [Link](https://portswigger.net/web-security/sql-injection/blind/lab-time-delays-info-retrieval) |
|
||||
| sql-injection | Blind SQL injection with out-of-band interaction] | [Link](https://portswigger.net/web-security/sql-injection/blind/lab-out-of-band) |
|
||||
| sql-injection | Blind SQL injection with out-of-band data exfiltration] | [Link](https://portswigger.net/web-security/sql-injection/blind/lab-out-of-band-data-exfiltration) |
|
||||
| sql-injection | SQL injection with filter bypass via XML encoding] | [Link](https://portswigger.net/web-security/sql-injection/lab-sql-injection-with-filter-bypass-via-xml-encoding) |
|
||||
| cross-site-scripting | Reflected XSS into HTML context with nothing encoded] | [Link](https://portswigger.net/web-security/cross-site-scripting/reflected/lab-html-context-nothing-encoded) |
|
||||
| cross-site-scripting | Stored XSS into HTML context with nothing encoded] | [Link](https://portswigger.net/web-security/cross-site-scripting/stored/lab-html-context-nothing-encoded) |
|
||||
| cross-site-scripting | DOM XSS in document.write sink using source location.search] | [Link](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink) |
|
||||
| cross-site-scripting | DOM XSS in innerHTML sink using source location.search] | [Link](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-innerhtml-sink) |
|
||||
| cross-site-scripting | DOM XSS in jQuery anchor href attribute sink using location.search source] | [Link](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-jquery-href-attribute-sink) |
|
||||
| cross-site-scripting | DOM XSS in jQuery selector sink using a hashchange event] | [Link](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-jquery-selector-hash-change-event) |
|
||||
| cross-site-scripting | Reflected XSS into attribute with angle brackets HTML-encoded] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-attribute-angle-brackets-html-encoded) |
|
||||
| cross-site-scripting | Stored XSS into anchor href attribute with double quotes HTML-encoded] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-href-attribute-double-quotes-html-encoded) |
|
||||
| cross-site-scripting | Reflected XSS into a JavaScript string with angle brackets HTML encoded] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-string-angle-brackets-html-encoded) |
|
||||
| cross-site-scripting | DOM XSS in document.write sink using source location.search inside a select element] | [Link](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink-inside-select-element) |
|
||||
| cross-site-scripting | DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded] | [Link](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-angularjs-expression) |
|
||||
| cross-site-scripting | Reflected DOM XSS] | [Link](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-dom-xss-reflected) |
|
||||
| cross-site-scripting | Stored DOM XSS] | [Link](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-dom-xss-stored) |
|
||||
| cross-site-scripting | Reflected XSS into HTML context with most tags and attributes blocked] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-html-context-with-most-tags-and-attributes-blocked) |
|
||||
| cross-site-scripting | Reflected XSS into HTML context with all tags blocked except custom ones] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-html-context-with-all-standard-tags-blocked) |
|
||||
| cross-site-scripting | Reflected XSS with some SVG markup allowed] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-some-svg-markup-allowed) |
|
||||
| cross-site-scripting | Reflected XSS in canonical link tag] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-canonical-link-tag) |
|
||||
| cross-site-scripting | Reflected XSS into a JavaScript string with single quote and backslash escaped] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-string-single-quote-backslash-escaped) |
|
||||
| cross-site-scripting | Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-string-angle-brackets-double-quotes-encoded-single-quotes-escaped) |
|
||||
| cross-site-scripting | Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-onclick-event-angle-brackets-double-quotes-html-encoded-single-quotes-backslash-escaped) |
|
||||
| cross-site-scripting | Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-template-literal-angle-brackets-single-double-quotes-backslash-backticks-escaped) |
|
||||
| cross-site-scripting | Exploiting cross-site scripting to steal cookies] | [Link](https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-stealing-cookies) |
|
||||
| cross-site-scripting | Exploiting cross-site scripting to capture passwords] | [Link](https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-capturing-passwords) |
|
||||
| cross-site-scripting | Exploiting XSS to bypass CSRF defenses] | [Link](https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-perform-csrf) |
|
||||
| cross-site-scripting | Reflected XSS with AngularJS sandbox escape without strings] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/client-side-template-injection/lab-angular-sandbox-escape-without-strings) |
|
||||
| cross-site-scripting | Reflected XSS with AngularJS sandbox escape and CSP] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/client-side-template-injection/lab-angular-sandbox-escape-and-csp) |
|
||||
| cross-site-scripting | Reflected XSS with event handlers and href attributes blocked] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-event-handlers-and-href-attributes-blocked) |
|
||||
| cross-site-scripting | Reflected XSS in a JavaScript URL with some characters blocked] | [Link](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-url-some-characters-blocked) |
|
||||
| cross-site-scripting | Reflected XSS protected by very strict CSP, with dangling markup attack] | [Link](https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-very-strict-csp-with-dangling-markup-attack) |
|
||||
| cross-site-scripting | Reflected XSS protected by CSP, with CSP bypass] | [Link](https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-csp-bypass) |
|
||||
| cross-site-request-forgery-csrf | CSRF vulnerability with no defenses] | [Link](https://portswigger.net/web-security/csrf/lab-no-defenses) |
|
||||
| cross-site-request-forgery-csrf | CSRF where token validation depends on request method] | [Link](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-validation-depends-on-request-method) |
|
||||
| cross-site-request-forgery-csrf | CSRF where token validation depends on token being present] | [Link](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-validation-depends-on-token-being-present) |
|
||||
| cross-site-request-forgery-csrf | CSRF where token is not tied to user session] | [Link](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-not-tied-to-user-session) |
|
||||
| cross-site-request-forgery-csrf | CSRF where token is tied to non-session cookie] | [Link](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-tied-to-non-session-cookie) |
|
||||
| cross-site-request-forgery-csrf | CSRF where token is duplicated in cookie] | [Link](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-duplicated-in-cookie) |
|
||||
| cross-site-request-forgery-csrf | SameSite Lax bypass via method override] | [Link](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-lax-bypass-via-method-override) |
|
||||
| cross-site-request-forgery-csrf | SameSite Strict bypass via client-side redirect] | [Link](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-client-side-redirect) |
|
||||
| cross-site-request-forgery-csrf | SameSite Strict bypass via sibling domain] | [Link](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-sibling-domain) |
|
||||
| cross-site-request-forgery-csrf | SameSite Lax bypass via cookie refresh] | [Link](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-cookie-refresh) |
|
||||
| cross-site-request-forgery-csrf | CSRF where Referer validation depends on header being present] | [Link](https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses/lab-referer-validation-depends-on-header-being-present) |
|
||||
| cross-site-request-forgery-csrf | CSRF with broken Referer validation] | [Link](https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses/lab-referer-validation-broken) |
|
||||
| clickjacking | Basic clickjacking with CSRF token protection] | [Link](https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected) |
|
||||
| clickjacking | Clickjacking with form input data prefilled from a URL parameter] | [Link](https://portswigger.net/web-security/clickjacking/lab-prefilled-form-input) |
|
||||
| clickjacking | Clickjacking with a frame buster script] | [Link](https://portswigger.net/web-security/clickjacking/lab-frame-buster-script) |
|
||||
| clickjacking | Exploiting clickjacking vulnerability to trigger DOM-based XSS] | [Link](https://portswigger.net/web-security/clickjacking/lab-exploiting-to-trigger-dom-based-xss) |
|
||||
| clickjacking | Multistep clickjacking] | [Link](https://portswigger.net/web-security/clickjacking/lab-multistep) |
|
||||
| dom-based-vulnerabilities | DOM XSS using web messages] | [Link](https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages) |
|
||||
| dom-based-vulnerabilities | DOM XSS using web messages and a JavaScript URL] | [Link](https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages-and-a-javascript-url) |
|
||||
| dom-based-vulnerabilities | DOM XSS using web messages and JSON.parse] | [Link](https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages-and-json-parse) |
|
||||
| dom-based-vulnerabilities | DOM-based open redirection] | [Link](https://portswigger.net/web-security/dom-based/open-redirection/lab-dom-open-redirection) |
|
||||
| dom-based-vulnerabilities | DOM-based cookie manipulation] | [Link](https://portswigger.net/web-security/dom-based/cookie-manipulation/lab-dom-cookie-manipulation) |
|
||||
| dom-based-vulnerabilities | Exploiting DOM clobbering to enable XSS] | [Link](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-xss-exploiting-dom-clobbering) |
|
||||
| dom-based-vulnerabilities | Clobbering DOM attributes to bypass HTML filters] | [Link](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-clobbering-attributes-to-bypass-html-filters) |
|
||||
| cross-origin-resource-sharing-cors | CORS vulnerability with basic origin reflection] | [Link](https://portswigger.net/web-security/cors/lab-basic-origin-reflection-attack) |
|
||||
| cross-origin-resource-sharing-cors | CORS vulnerability with trusted null origin] | [Link](https://portswigger.net/web-security/cors/lab-null-origin-whitelisted-attack) |
|
||||
| cross-origin-resource-sharing-cors | CORS vulnerability with trusted insecure protocols] | [Link](https://portswigger.net/web-security/cors/lab-breaking-https-attack) |
|
||||
| xml-external-entity-xxe-injection | Exploiting XXE using external entities to retrieve files] | [Link](https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-retrieve-files) |
|
||||
| xml-external-entity-xxe-injection | Exploiting XXE to perform SSRF attacks] | [Link](https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-perform-ssrf) |
|
||||
| xml-external-entity-xxe-injection | Blind XXE with out-of-band interaction] | [Link](https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-interaction) |
|
||||
| xml-external-entity-xxe-injection | Blind XXE with out-of-band interaction via XML parameter entities] | [Link](https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-interaction-using-parameter-entities) |
|
||||
| xml-external-entity-xxe-injection | Exploiting blind XXE to exfiltrate data using a malicious external DTD] | [Link](https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-exfiltration) |
|
||||
| xml-external-entity-xxe-injection | Exploiting blind XXE to retrieve data via error messages] | [Link](https://portswigger.net/web-security/xxe/blind/lab-xxe-with-data-retrieval-via-error-messages) |
|
||||
| xml-external-entity-xxe-injection | Exploiting XInclude to retrieve files] | [Link](https://portswigger.net/web-security/xxe/lab-xinclude-attack) |
|
||||
| xml-external-entity-xxe-injection | Exploiting XXE via image file upload] | [Link](https://portswigger.net/web-security/xxe/lab-xxe-via-file-upload) |
|
||||
| xml-external-entity-xxe-injection | Exploiting XXE to retrieve data by repurposing a local DTD] | [Link](https://portswigger.net/web-security/xxe/blind/lab-xxe-trigger-error-message-by-repurposing-local-dtd) |
|
||||
| server-side-request-forgery-ssrf | Basic SSRF against the local server] | [Link](https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-localhost) |
|
||||
| server-side-request-forgery-ssrf | Basic SSRF against another back-end system] | [Link](https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-backend-system) |
|
||||
| server-side-request-forgery-ssrf | Blind SSRF with out-of-band detection] | [Link](https://portswigger.net/web-security/ssrf/blind/lab-out-of-band-detection) |
|
||||
| server-side-request-forgery-ssrf | SSRF with blacklist-based input filter] | [Link](https://portswigger.net/web-security/ssrf/lab-ssrf-with-blacklist-filter) |
|
||||
| server-side-request-forgery-ssrf | SSRF with filter bypass via open redirection vulnerability] | [Link](https://portswigger.net/web-security/ssrf/lab-ssrf-filter-bypass-via-open-redirection) |
|
||||
| server-side-request-forgery-ssrf | Blind SSRF with Shellshock exploitation] | [Link](https://portswigger.net/web-security/ssrf/blind/lab-shellshock-exploitation) |
|
||||
| server-side-request-forgery-ssrf | SSRF with whitelist-based input filter] | [Link](https://portswigger.net/web-security/ssrf/lab-ssrf-with-whitelist-filter) |
|
||||
| http-request-smuggling | HTTP request smuggling, confirming a CL.TE vulnerability via differential responses] | [Link](https://portswigger.net/web-security/request-smuggling/finding/lab-confirming-cl-te-via-differential-responses) |
|
||||
| http-request-smuggling | HTTP request smuggling, confirming a TE.CL vulnerability via differential responses] | [Link](https://portswigger.net/web-security/request-smuggling/finding/lab-confirming-te-cl-via-differential-responses) |
|
||||
| http-request-smuggling | Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability] | [Link](https://portswigger.net/web-security/request-smuggling/exploiting/lab-bypass-front-end-controls-cl-te) |
|
||||
| http-request-smuggling | Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability] | [Link](https://portswigger.net/web-security/request-smuggling/exploiting/lab-bypass-front-end-controls-te-cl) |
|
||||
| http-request-smuggling | Exploiting HTTP request smuggling to reveal front-end request rewriting] | [Link](https://portswigger.net/web-security/request-smuggling/exploiting/lab-reveal-front-end-request-rewriting) |
|
||||
| http-request-smuggling | Exploiting HTTP request smuggling to capture other users' requests] | [Link](https://portswigger.net/web-security/request-smuggling/exploiting/lab-capture-other-users-requests) |
|
||||
| http-request-smuggling | Exploiting HTTP request smuggling to deliver reflected XSS] | [Link](https://portswigger.net/web-security/request-smuggling/exploiting/lab-deliver-reflected-xss) |
|
||||
| http-request-smuggling | Response queue poisoning via H2.TE request smuggling] | [Link](https://portswigger.net/web-security/request-smuggling/advanced/response-queue-poisoning/lab-request-smuggling-h2-response-queue-poisoning-via-te-request-smuggling) |
|
||||
| http-request-smuggling | H2.CL request smuggling] | [Link](https://portswigger.net/web-security/request-smuggling/advanced/lab-request-smuggling-h2-cl-request-smuggling) |
|
||||
| http-request-smuggling | HTTP/2 request smuggling via CRLF injection] | [Link](https://portswigger.net/web-security/request-smuggling/advanced/lab-request-smuggling-h2-request-smuggling-via-crlf-injection) |
|
||||
| http-request-smuggling | HTTP/2 request splitting via CRLF injection] | [Link](https://portswigger.net/web-security/request-smuggling/advanced/lab-request-smuggling-h2-request-splitting-via-crlf-injection) |
|
||||
| http-request-smuggling | 0.CL request smuggling] | [Link](https://portswigger.net/web-security/request-smuggling/advanced/lab-request-smuggling-0cl-request-smuggling) |
|
||||
| http-request-smuggling | CL.0 request smuggling] | [Link](https://portswigger.net/web-security/request-smuggling/browser/cl-0/lab-cl-0-request-smuggling) |
|
||||
| http-request-smuggling | HTTP request smuggling, basic CL.TE vulnerability] | [Link](https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te) |
|
||||
| http-request-smuggling | HTTP request smuggling, basic TE.CL vulnerability] | [Link](https://portswigger.net/web-security/request-smuggling/lab-basic-te-cl) |
|
||||
| http-request-smuggling | HTTP request smuggling, obfuscating the TE header] | [Link](https://portswigger.net/web-security/request-smuggling/lab-obfuscating-te-header) |
|
||||
| http-request-smuggling | Exploiting HTTP request smuggling to perform web cache poisoning] | [Link](https://portswigger.net/web-security/request-smuggling/exploiting/lab-perform-web-cache-poisoning) |
|
||||
| http-request-smuggling | Exploiting HTTP request smuggling to perform web cache deception] | [Link](https://portswigger.net/web-security/request-smuggling/exploiting/lab-perform-web-cache-deception) |
|
||||
| http-request-smuggling | Bypassing access controls via HTTP/2 request tunnelling] | [Link](https://portswigger.net/web-security/request-smuggling/advanced/request-tunnelling/lab-request-smuggling-h2-bypass-access-controls-via-request-tunnelling) |
|
||||
| http-request-smuggling | Web cache poisoning via HTTP/2 request tunnelling] | [Link](https://portswigger.net/web-security/request-smuggling/advanced/request-tunnelling/lab-request-smuggling-h2-web-cache-poisoning-via-request-tunnelling) |
|
||||
| http-request-smuggling | Client-side desync] | [Link](https://portswigger.net/web-security/request-smuggling/browser/client-side-desync/lab-client-side-desync) |
|
||||
| http-request-smuggling | Server-side pause-based request smuggling] | [Link](https://portswigger.net/web-security/request-smuggling/browser/pause-based-desync/lab-server-side-pause-based-request-smuggling) |
|
||||
| os-command-injection | OS command injection, simple case] | [Link](https://portswigger.net/web-security/os-command-injection/lab-simple) |
|
||||
| os-command-injection | Blind OS command injection with time delays] | [Link](https://portswigger.net/web-security/os-command-injection/lab-blind-time-delays) |
|
||||
| os-command-injection | Blind OS command injection with output redirection] | [Link](https://portswigger.net/web-security/os-command-injection/lab-blind-output-redirection) |
|
||||
| os-command-injection | Blind OS command injection with out-of-band interaction] | [Link](https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band) |
|
||||
| os-command-injection | Blind OS command injection with out-of-band data exfiltration] | [Link](https://portswigger.net/web-security/os-command-injection/lab-blind-out-of-band-data-exfiltration) |
|
||||
| server-side-template-injection | Basic server-side template injection] | [Link](https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-basic) |
|
||||
| server-side-template-injection | Basic server-side template injection (code context)] | [Link](https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-basic-code-context) |
|
||||
| server-side-template-injection | Server-side template injection using documentation] | [Link](https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-using-documentation) |
|
||||
| server-side-template-injection | Server-side template injection in an unknown language with a documented exploit] | [Link](https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-in-an-unknown-language-with-a-documented-exploit) |
|
||||
| server-side-template-injection | Server-side template injection with information disclosure via user-supplied objects] | [Link](https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-with-information-disclosure-via-user-supplied-objects) |
|
||||
| server-side-template-injection | Server-side template injection in a sandboxed environment] | [Link](https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-in-a-sandboxed-environment) |
|
||||
| server-side-template-injection | Server-side template injection with a custom exploit] | [Link](https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-with-a-custom-exploit) |
|
||||
| path-traversal | File path traversal, simple case] | [Link](https://portswigger.net/web-security/file-path-traversal/lab-simple) |
|
||||
| path-traversal | File path traversal, traversal sequences blocked with absolute path bypass] | [Link](https://portswigger.net/web-security/file-path-traversal/lab-absolute-path-bypass) |
|
||||
| path-traversal | File path traversal, traversal sequences stripped non-recursively] | [Link](https://portswigger.net/web-security/file-path-traversal/lab-sequences-stripped-non-recursively) |
|
||||
| path-traversal | File path traversal, traversal sequences stripped with superfluous URL-decode] | [Link](https://portswigger.net/web-security/file-path-traversal/lab-superfluous-url-decode) |
|
||||
| path-traversal | File path traversal, validation of start of path] | [Link](https://portswigger.net/web-security/file-path-traversal/lab-validate-start-of-path) |
|
||||
| path-traversal | File path traversal, validation of file extension with null byte bypass] | [Link](https://portswigger.net/web-security/file-path-traversal/lab-validate-file-extension-null-byte-bypass) |
|
||||
| access-control-vulnerabilities | Unprotected admin functionality] | [Link](https://portswigger.net/web-security/access-control/lab-unprotected-admin-functionality) |
|
||||
| access-control-vulnerabilities | Unprotected admin functionality with unpredictable URL] | [Link](https://portswigger.net/web-security/access-control/lab-unprotected-admin-functionality-with-unpredictable-url) |
|
||||
| access-control-vulnerabilities | User role controlled by request parameter] | [Link](https://portswigger.net/web-security/access-control/lab-user-role-controlled-by-request-parameter) |
|
||||
| access-control-vulnerabilities | User role can be modified in user profile] | [Link](https://portswigger.net/web-security/access-control/lab-user-role-can-be-modified-in-user-profile) |
|
||||
| access-control-vulnerabilities | User ID controlled by request parameter] | [Link](https://portswigger.net/web-security/access-control/lab-user-id-controlled-by-request-parameter) |
|
||||
| access-control-vulnerabilities | User ID controlled by request parameter, with unpredictable user IDs] | [Link](https://portswigger.net/web-security/access-control/lab-user-id-controlled-by-request-parameter-with-unpredictable-user-ids) |
|
||||
| access-control-vulnerabilities | User ID controlled by request parameter with data leakage in redirect] | [Link](https://portswigger.net/web-security/access-control/lab-user-id-controlled-by-request-parameter-with-data-leakage-in-redirect) |
|
||||
| access-control-vulnerabilities | User ID controlled by request parameter with password disclosure] | [Link](https://portswigger.net/web-security/access-control/lab-user-id-controlled-by-request-parameter-with-password-disclosure) |
|
||||
| access-control-vulnerabilities | Insecure direct object references] | [Link](https://portswigger.net/web-security/access-control/lab-insecure-direct-object-references) |
|
||||
| access-control-vulnerabilities | URL-based access control can be circumvented] | [Link](https://portswigger.net/web-security/access-control/lab-url-based-access-control-can-be-circumvented) |
|
||||
| access-control-vulnerabilities | Method-based access control can be circumvented] | [Link](https://portswigger.net/web-security/access-control/lab-method-based-access-control-can-be-circumvented) |
|
||||
| access-control-vulnerabilities | Multi-step process with no access control on one step] | [Link](https://portswigger.net/web-security/access-control/lab-multi-step-process-with-no-access-control-on-one-step) |
|
||||
| access-control-vulnerabilities | Referer-based access control] | [Link](https://portswigger.net/web-security/access-control/lab-referer-based-access-control) |
|
||||
| authentication | Username enumeration via different responses] | [Link](https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-different-responses) |
|
||||
| authentication | 2FA simple bypass] | [Link](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-simple-bypass) |
|
||||
| authentication | Password reset broken logic] | [Link](https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-broken-logic) |
|
||||
| authentication | Username enumeration via subtly different responses] | [Link](https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-subtly-different-responses) |
|
||||
| authentication | Username enumeration via response timing] | [Link](https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-response-timing) |
|
||||
| authentication | Broken brute-force protection, IP block] | [Link](https://portswigger.net/web-security/authentication/password-based/lab-broken-bruteforce-protection-ip-block) |
|
||||
| authentication | Username enumeration via account lock] | [Link](https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-account-lock) |
|
||||
| authentication | 2FA broken logic] | [Link](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-broken-logic) |
|
||||
| authentication | Brute-forcing a stay-logged-in cookie] | [Link](https://portswigger.net/web-security/authentication/other-mechanisms/lab-brute-forcing-a-stay-logged-in-cookie) |
|
||||
| authentication | Offline password cracking] | [Link](https://portswigger.net/web-security/authentication/other-mechanisms/lab-offline-password-cracking) |
|
||||
| authentication | Password reset poisoning via middleware] | [Link](https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-poisoning-via-middleware) |
|
||||
| authentication | Password brute-force via password change] | [Link](https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-brute-force-via-password-change) |
|
||||
| authentication | Broken brute-force protection, multiple credentials per request] | [Link](https://portswigger.net/web-security/authentication/password-based/lab-broken-brute-force-protection-multiple-credentials-per-request) |
|
||||
| authentication | 2FA bypass using a brute-force attack] | [Link](https://portswigger.net/web-security/authentication/multi-factor/lab-2fa-bypass-using-a-brute-force-attack) |
|
||||
| websockets | Manipulating WebSocket messages to exploit vulnerabilities] | [Link](https://portswigger.net/web-security/websockets/lab-manipulating-messages-to-exploit-vulnerabilities) |
|
||||
| websockets | Cross-site WebSocket hijacking] | [Link](https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking/lab) |
|
||||
| websockets | Manipulating the WebSocket handshake to exploit vulnerabilities] | [Link](https://portswigger.net/web-security/websockets/lab-manipulating-handshake-to-exploit-vulnerabilities) |
|
||||
| web-cache-poisoning | Web cache poisoning with an unkeyed header] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-with-an-unkeyed-header) |
|
||||
| web-cache-poisoning | Web cache poisoning with an unkeyed cookie] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-with-an-unkeyed-cookie) |
|
||||
| web-cache-poisoning | Web cache poisoning with multiple headers] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-with-multiple-headers) |
|
||||
| web-cache-poisoning | Targeted web cache poisoning using an unknown header] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-targeted-using-an-unknown-header) |
|
||||
| web-cache-poisoning | Web cache poisoning via an unkeyed query string] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-unkeyed-query) |
|
||||
| web-cache-poisoning | Web cache poisoning via an unkeyed query parameter] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-unkeyed-param) |
|
||||
| web-cache-poisoning | Parameter cloaking] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-param-cloaking) |
|
||||
| web-cache-poisoning | Web cache poisoning via a fat GET request] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-fat-get) |
|
||||
| web-cache-poisoning | URL normalization] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-normalization) |
|
||||
| web-cache-poisoning | Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-to-exploit-a-dom-vulnerability-via-a-cache-with-strict-cacheability-criteria) |
|
||||
| web-cache-poisoning | Combining web cache poisoning vulnerabilities] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-combining-vulnerabilities) |
|
||||
| web-cache-poisoning | Cache key injection] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-cache-key-injection) |
|
||||
| web-cache-poisoning | Internal cache poisoning] | [Link](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-internal) |
|
||||
| insecure-deserialization | Modifying serialized objects] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-modifying-serialized-objects) |
|
||||
| insecure-deserialization | Modifying serialized data types] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-modifying-serialized-data-types) |
|
||||
| insecure-deserialization | Using application functionality to exploit insecure deserialization] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-using-application-functionality-to-exploit-insecure-deserialization) |
|
||||
| insecure-deserialization | Arbitrary object injection in PHP] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-arbitrary-object-injection-in-php) |
|
||||
| insecure-deserialization | Exploiting Java deserialization with Apache Commons] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-java-deserialization-with-apache-commons) |
|
||||
| insecure-deserialization | Exploiting PHP deserialization with a pre-built gadget chain] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-php-deserialization-with-a-pre-built-gadget-chain) |
|
||||
| insecure-deserialization | Exploiting Ruby deserialization using a documented gadget chain] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-ruby-deserialization-using-a-documented-gadget-chain) |
|
||||
| insecure-deserialization | Developing a custom gadget chain for Java deserialization] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-developing-a-custom-gadget-chain-for-java-deserialization) |
|
||||
| insecure-deserialization | Developing a custom gadget chain for PHP deserialization] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-developing-a-custom-gadget-chain-for-php-deserialization) |
|
||||
| insecure-deserialization | Using PHAR deserialization to deploy a custom gadget chain] | [Link](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-using-phar-deserialization-to-deploy-a-custom-gadget-chain) |
|
||||
| information-disclosure | Information disclosure in error messages] | [Link](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-in-error-messages) |
|
||||
| information-disclosure | Information disclosure on debug page] | [Link](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-on-debug-page) |
|
||||
| information-disclosure | Source code disclosure via backup files] | [Link](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-via-backup-files) |
|
||||
| information-disclosure | Authentication bypass via information disclosure] | [Link](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-authentication-bypass) |
|
||||
| information-disclosure | Information disclosure in version control history] | [Link](https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-in-version-control-history) |
|
||||
| business-logic-vulnerabilities | Excessive trust in client-side controls] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-excessive-trust-in-client-side-controls) |
|
||||
| business-logic-vulnerabilities | High-level logic vulnerability] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-high-level) |
|
||||
| business-logic-vulnerabilities | Inconsistent security controls] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-inconsistent-security-controls) |
|
||||
| business-logic-vulnerabilities | Flawed enforcement of business rules] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-flawed-enforcement-of-business-rules) |
|
||||
| business-logic-vulnerabilities | Low-level logic flaw] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-low-level) |
|
||||
| business-logic-vulnerabilities | Inconsistent handling of exceptional input] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-inconsistent-handling-of-exceptional-input) |
|
||||
| business-logic-vulnerabilities | Weak isolation on dual-use endpoint] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-weak-isolation-on-dual-use-endpoint) |
|
||||
| business-logic-vulnerabilities | Insufficient workflow validation] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-insufficient-workflow-validation) |
|
||||
| business-logic-vulnerabilities | Authentication bypass via flawed state machine] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-authentication-bypass-via-flawed-state-machine) |
|
||||
| business-logic-vulnerabilities | Infinite money logic flaw] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-infinite-money) |
|
||||
| business-logic-vulnerabilities | Authentication bypass via encryption oracle] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-authentication-bypass-via-encryption-oracle) |
|
||||
| business-logic-vulnerabilities | Bypassing access controls using email address parsing discrepancies] | [Link](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-bypassing-access-controls-using-email-address-parsing-discrepancies) |
|
||||
| http-host-header-attacks | Basic password reset poisoning] | [Link](https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning/lab-host-header-basic-password-reset-poisoning) |
|
||||
| http-host-header-attacks | Host header authentication bypass] | [Link](https://portswigger.net/web-security/host-header/exploiting/lab-host-header-authentication-bypass) |
|
||||
| http-host-header-attacks | Web cache poisoning via ambiguous requests] | [Link](https://portswigger.net/web-security/host-header/exploiting/lab-host-header-web-cache-poisoning-via-ambiguous-requests) |
|
||||
| http-host-header-attacks | Routing-based SSRF] | [Link](https://portswigger.net/web-security/host-header/exploiting/lab-host-header-routing-based-ssrf) |
|
||||
| http-host-header-attacks | SSRF via flawed request parsing] | [Link](https://portswigger.net/web-security/host-header/exploiting/lab-host-header-ssrf-via-flawed-request-parsing) |
|
||||
| http-host-header-attacks | Host validation bypass via connection state attack] | [Link](https://portswigger.net/web-security/host-header/exploiting/lab-host-header-host-validation-bypass-via-connection-state-attack) |
|
||||
| http-host-header-attacks | Password reset poisoning via dangling markup] | [Link](https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning/lab-host-header-password-reset-poisoning-via-dangling-markup) |
|
||||
| oauth-authentication | Authentication bypass via OAuth implicit flow] | [Link](https://portswigger.net/web-security/oauth/lab-oauth-authentication-bypass-via-oauth-implicit-flow) |
|
||||
| oauth-authentication | SSRF via OpenID dynamic client registration] | [Link](https://portswigger.net/web-security/oauth/openid/lab-oauth-ssrf-via-openid-dynamic-client-registration) |
|
||||
| oauth-authentication | Forced OAuth profile linking] | [Link](https://portswigger.net/web-security/oauth/lab-oauth-forced-oauth-profile-linking) |
|
||||
| oauth-authentication | OAuth account hijacking via redirect_uri] | [Link](https://portswigger.net/web-security/oauth/lab-oauth-account-hijacking-via-redirect-uri) |
|
||||
| oauth-authentication | Stealing OAuth access tokens via an open redirect] | [Link](https://portswigger.net/web-security/oauth/lab-oauth-stealing-oauth-access-tokens-via-an-open-redirect) |
|
||||
| oauth-authentication | Stealing OAuth access tokens via a proxy page] | [Link](https://portswigger.net/web-security/oauth/lab-oauth-stealing-oauth-access-tokens-via-a-proxy-page) |
|
||||
| file-upload-vulnerabilities | Remote code execution via web shell upload] | [Link](https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload) |
|
||||
| file-upload-vulnerabilities | Web shell upload via Content-Type restriction bypass] | [Link](https://portswigger.net/web-security/file-upload/lab-file-upload-web-shell-upload-via-content-type-restriction-bypass) |
|
||||
| file-upload-vulnerabilities | Web shell upload via path traversal] | [Link](https://portswigger.net/web-security/file-upload/lab-file-upload-web-shell-upload-via-path-traversal) |
|
||||
| file-upload-vulnerabilities | Web shell upload via extension blacklist bypass] | [Link](https://portswigger.net/web-security/file-upload/lab-file-upload-web-shell-upload-via-extension-blacklist-bypass) |
|
||||
| file-upload-vulnerabilities | Web shell upload via obfuscated file extension] | [Link](https://portswigger.net/web-security/file-upload/lab-file-upload-web-shell-upload-via-obfuscated-file-extension) |
|
||||
| file-upload-vulnerabilities | Remote code execution via polyglot web shell upload] | [Link](https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-polyglot-web-shell-upload) |
|
||||
| file-upload-vulnerabilities | Web shell upload via race condition] | [Link](https://portswigger.net/web-security/file-upload/lab-file-upload-web-shell-upload-via-race-condition) |
|
||||
| jwt | JWT authentication bypass via unverified signature] | [Link](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-unverified-signature) |
|
||||
| jwt | JWT authentication bypass via flawed signature verification] | [Link](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-flawed-signature-verification) |
|
||||
| jwt | JWT authentication bypass via weak signing key] | [Link](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-weak-signing-key) |
|
||||
| jwt | JWT authentication bypass via jwk header injection] | [Link](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jwk-header-injection) |
|
||||
| jwt | JWT authentication bypass via jku header injection] | [Link](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jku-header-injection) |
|
||||
| jwt | JWT authentication bypass via kid header path traversal] | [Link](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-kid-header-path-traversal) |
|
||||
| jwt | JWT authentication bypass via algorithm confusion] | [Link](https://portswigger.net/web-security/jwt/algorithm-confusion/lab-jwt-authentication-bypass-via-algorithm-confusion) |
|
||||
| jwt | JWT authentication bypass via algorithm confusion with no exposed key] | [Link](https://portswigger.net/web-security/jwt/algorithm-confusion/lab-jwt-authentication-bypass-via-algorithm-confusion-with-no-exposed-key) |
|
||||
| essential-skills | Discovering vulnerabilities quickly with targeted scanning] | [Link](https://portswigger.net/web-security/essential-skills/using-burp-scanner-during-manual-testing/lab-discovering-vulnerabilities-quickly-with-targeted-scanning) |
|
||||
| essential-skills | Scanning non-standard data structures] | [Link](https://portswigger.net/web-security/essential-skills/using-burp-scanner-during-manual-testing/lab-scanning-non-standard-data-structures) |
|
||||
| prototype-pollution | Client-side prototype pollution via browser APIs] | [Link](https://portswigger.net/web-security/prototype-pollution/client-side/browser-apis/lab-prototype-pollution-client-side-prototype-pollution-via-browser-apis) |
|
||||
| prototype-pollution | DOM XSS via client-side prototype pollution] | [Link](https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-dom-xss-via-client-side-prototype-pollution) |
|
||||
| prototype-pollution | DOM XSS via an alternative prototype pollution vector] | [Link](https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-dom-xss-via-an-alternative-prototype-pollution-vector) |
|
||||
| prototype-pollution | Client-side prototype pollution via flawed sanitization] | [Link](https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-client-side-prototype-pollution-via-flawed-sanitization) |
|
||||
| prototype-pollution | Client-side prototype pollution in third-party libraries] | [Link](https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-client-side-prototype-pollution-in-third-party-libraries) |
|
||||
| prototype-pollution | Privilege escalation via server-side prototype pollution] | [Link](https://portswigger.net/web-security/prototype-pollution/server-side/lab-privilege-escalation-via-server-side-prototype-pollution) |
|
||||
| prototype-pollution | Detecting server-side prototype pollution without polluted property reflection] | [Link](https://portswigger.net/web-security/prototype-pollution/server-side/lab-detecting-server-side-prototype-pollution-without-polluted-property-reflection) |
|
||||
| prototype-pollution | Bypassing flawed input filters for server-side prototype pollution] | [Link](https://portswigger.net/web-security/prototype-pollution/server-side/lab-bypassing-flawed-input-filters-for-server-side-prototype-pollution) |
|
||||
| prototype-pollution | Remote code execution via server-side prototype pollution] | [Link](https://portswigger.net/web-security/prototype-pollution/server-side/lab-remote-code-execution-via-server-side-prototype-pollution) |
|
||||
| prototype-pollution | Exfiltrating sensitive data via server-side prototype pollution] | [Link](https://portswigger.net/web-security/prototype-pollution/server-side/lab-exfiltrating-sensitive-data-via-server-side-prototype-pollution) |
|
||||
| graphql-api-vulnerabilities | Accessing private GraphQL posts] | [Link](https://portswigger.net/web-security/graphql/lab-graphql-reading-private-posts) |
|
||||
| graphql-api-vulnerabilities | Accidental exposure of private GraphQL fields] | [Link](https://portswigger.net/web-security/graphql/lab-graphql-accidental-field-exposure) |
|
||||
| graphql-api-vulnerabilities | Finding a hidden GraphQL endpoint] | [Link](https://portswigger.net/web-security/graphql/lab-graphql-find-the-endpoint) |
|
||||
| graphql-api-vulnerabilities | Bypassing GraphQL brute force protections] | [Link](https://portswigger.net/web-security/graphql/lab-graphql-brute-force-protection-bypass) |
|
||||
| graphql-api-vulnerabilities | Performing CSRF exploits over GraphQL] | [Link](https://portswigger.net/web-security/graphql/lab-graphql-csrf-via-graphql-api) |
|
||||
| race-conditions | Limit overrun race conditions] | [Link](https://portswigger.net/web-security/race-conditions/lab-race-conditions-limit-overrun) |
|
||||
| race-conditions | Bypassing rate limits via race conditions] | [Link](https://portswigger.net/web-security/race-conditions/lab-race-conditions-bypassing-rate-limits) |
|
||||
| race-conditions | Multi-endpoint race conditions] | [Link](https://portswigger.net/web-security/race-conditions/lab-race-conditions-multi-endpoint) |
|
||||
| race-conditions | Single-endpoint race conditions] | [Link](https://portswigger.net/web-security/race-conditions/lab-race-conditions-single-endpoint) |
|
||||
| race-conditions | Exploiting time-sensitive vulnerabilities] | [Link](https://portswigger.net/web-security/race-conditions/lab-race-conditions-exploiting-time-sensitive-vulnerabilities) |
|
||||
| race-conditions | Partial construction race conditions] | [Link](https://portswigger.net/web-security/race-conditions/lab-race-conditions-partial-construction) |
|
||||
| nosql-injection | Detecting NoSQL injection] | [Link](https://portswigger.net/web-security/nosql-injection/lab-nosql-injection-detection) |
|
||||
| nosql-injection | Exploiting NoSQL operator injection to bypass authentication] | [Link](https://portswigger.net/web-security/nosql-injection/lab-nosql-injection-bypass-authentication) |
|
||||
| nosql-injection | Exploiting NoSQL injection to extract data] | [Link](https://portswigger.net/web-security/nosql-injection/lab-nosql-injection-extract-data) |
|
||||
| nosql-injection | Exploiting NoSQL operator injection to extract unknown fields] | [Link](https://portswigger.net/web-security/nosql-injection/lab-nosql-injection-extract-unknown-fields) |
|
||||
| api-testing | Exploiting an API endpoint using documentation] | [Link](https://portswigger.net/web-security/api-testing/lab-exploiting-api-endpoint-using-documentation) |
|
||||
| api-testing | Exploiting server-side parameter pollution in a query string] | [Link](https://portswigger.net/web-security/api-testing/server-side-parameter-pollution/lab-exploiting-server-side-parameter-pollution-in-query-string) |
|
||||
| api-testing | Finding and exploiting an unused API endpoint] | [Link](https://portswigger.net/web-security/api-testing/lab-exploiting-unused-api-endpoint) |
|
||||
| api-testing | Exploiting a mass assignment vulnerability] | [Link](https://portswigger.net/web-security/api-testing/lab-exploiting-mass-assignment-vulnerability) |
|
||||
| api-testing | Exploiting server-side parameter pollution in a REST URL] | [Link](https://portswigger.net/web-security/api-testing/server-side-parameter-pollution/lab-exploiting-server-side-parameter-pollution-in-rest-url) |
|
||||
| web-llm-attacks | Exploiting LLM APIs with excessive agency] | [Link](https://portswigger.net/web-security/llm-attacks/lab-exploiting-llm-apis-with-excessive-agency) |
|
||||
| web-llm-attacks | Exploiting vulnerabilities in LLM APIs] | [Link](https://portswigger.net/web-security/llm-attacks/lab-exploiting-vulnerabilities-in-llm-apis) |
|
||||
| web-llm-attacks | Indirect prompt injection] | [Link](https://portswigger.net/web-security/llm-attacks/lab-indirect-prompt-injection) |
|
||||
| web-llm-attacks | Exploiting insecure output handling in LLMs] | [Link](https://portswigger.net/web-security/llm-attacks/lab-exploiting-insecure-output-handling-in-llms) |
|
||||
| web-cache-deception | Exploiting path mapping for web cache deception] | [Link](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-path-mapping) |
|
||||
| web-cache-deception | Exploiting path delimiters for web cache deception] | [Link](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-path-delimiters) |
|
||||
| web-cache-deception | Exploiting origin server normalization for web cache deception] | [Link](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-origin-server-normalization) |
|
||||
| web-cache-deception | Exploiting cache server normalization for web cache deception] | [Link](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-cache-server-normalization) |
|
||||
| web-cache-deception | Exploiting exact-match cache rules for web cache deception] | [Link](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-exact-match-cache-rules) |
|
||||
Loading…
Reference in New Issue