Tag

#portswigger

67 posts3 followers

Explore Hashnode

Alternatives

When the Database Talks Back: Blind SQLi Data Exfiltration Over DNS

TL;DR Target/Lab: PortSwigger Web Security Academy, Blind SQL injection with out-of-band data exfiltration — Practitioner, CWE-89, solved in an authorized lab instance. Vulnerability class: Blind SQL

hareeshwarnk.hashnode.dev

David EssienSep 19 · 6 min read

One Missing Parameter Cost Me Six Hours (PortSwigger Lab)

I spent six hours trying to upgrade a non-admin user to admin, convinced I was missing some clever bypass. The gap turned out to be one field in a request body I'd already looked at twice. This is a P

2 david-essien.hashnode.dev

David EssienSep 19 · 4 min read

What a Single File Name Taught Me About IDOR (PortSwigger Lab)

My transcript downloaded as 2.txt. That was the entire vulnerability, sitting right there in a file name, and it took less time to exploit than it did to notice. This is a PortSwigger Web Security Aca

david-essien.hashnode.dev

Priti PawarAug 4 · 23 min read

PortSwigger: Broke 10 things this week

I'm a third-year B.Tech CSIT student, and this week I started working through PortSwigger's Web Security Academy to explore offensive security hands-on. I'm documenting each lab here — the vulnerabili

portswiggerlabs.hashnode.dev

Sreerag PramodJul 27 · 10 min read

Excessive Trust in Client-Side Controls

A walkthrough of how trusting client-sent price data instead of validating it server-side let me buy a $1337 item for a single cent, and what it teaches about business logic security. Introduction A

sreeragpramod.hashnode.dev

AbhinavJul 15 · 2 min read

LAB #04 Basic password reset poisoning

Lab Overview This lab is vulnerable to password reset poisoning. The user carlos will carelessly click on any links in emails that he receives. To solve the lab, log in to Carlos's account. You can lo

log.page0.dev

AbhinavJul 14 · 2 min read

LAB#03 OAuth account hijacking via redirect_uri

Lab Overview This lab uses an OAuth service to allow users to log in with their social media account. A misconfiguration by the OAuth provider makes it possible for an attacker to steal authorization

log.page0.dev

AbhinavJul 8 · 3 min read

LAB #02 Forced OAuth profile linking

Lab Overview This lab gives you the option to attach a social media profile to your account so that you can log in via OAuth instead of using the normal username and password. Due to the insecure impl

log.page0.dev

Vimal MudalagiJul 7 · 9 min read

Learning Web Security #1: Broken Access Control (OWASP Top 10 #1 - Beginner's Guide)

Disclaimer: I'm currently learning web security through PortSwigger Web Security Academy. These are my beginner-friendly notes rewritten as a blog to help reinforce my understanding. If you're just st

vimalmudalagi.hashnode.dev

Mouhamed Ben AbdallahMay 12 · 8 min read

Unprotected Admin Functionality

Platform: PortSwigger Web Security Academy Category: Access Control / Vertical Privilege Escalation Difficulty: Apprentice Tool(s): Browser only Date: 12/05/2026 Overview This lab demonstrates a ver

erinmin-writeups.hashnode.dev

Search Hashnode

Explore Hashnode

Trending tags this week

When the Database Talks Back: Blind SQLi Data Exfiltration Over DNS

One Missing Parameter Cost Me Six Hours (PortSwigger Lab)

What a Single File Name Taught Me About IDOR (PortSwigger Lab)

PortSwigger: Broke 10 things this week

Excessive Trust in Client-Side Controls

LAB #04 Basic password reset poisoning

LAB#03 OAuth account hijacking via redirect_uri

LAB #02 Forced OAuth profile linking

Learning Web Security #1: Broken Access Control (OWASP Top 10 #1 - Beginner's Guide)

Unprotected Admin Functionality