Dashboard Hunt Learn Certs Journal Flashcards

Search

Press ESC to close
Notifications

No new notifications

Settings

Study Preferences

Daily Study Goal Hours per day
Flashcard Session Size Cards per session

Notifications

Study Reminders Daily reminder to study
Flashcard Due Alerts When cards are due for review

Display

Theme Color scheme
← Back to Certifications
PortSwigger

Web Security Academy Labs

0/219
Labs Completed
0
Apprentice
0
Practitioner
0
Expert
Clear
Exploiting an API endpoint using documentation
API Testing · apprentice
Exploiting a mass assignment vulnerability
API Testing · practitioner
Exploiting server-side parameter pollution in a REST URL
API Testing · practitioner
Exploiting server-side parameter pollution in a query string
API Testing · practitioner
Finding and exploiting an unused API endpoint
API Testing · practitioner
Insecure direct object references
Access Control · apprentice
Unprotected admin functionality
Access Control · apprentice
Unprotected admin functionality with unpredictable URL
Access Control · apprentice
User ID controlled by request parameter
Access Control · apprentice
User ID controlled by request parameter with data leak
Access Control · apprentice
User ID controlled by request parameter with password disclosure
Access Control · apprentice
User role can be modified in user profile
Access Control · apprentice
User role controlled by request parameter
Access Control · apprentice
DOM-based open redirection
Access Control · practitioner
Method-based access control can be circumvented
Access Control · practitioner
Multi-step process with no access control on one step
Access Control · practitioner
Referer-based access control
Access Control · practitioner
URL-based access control can be circumvented
Access Control · practitioner
2FA simple bypass
Authentication · apprentice
Password reset broken logic
Authentication · apprentice
Username enumeration via different responses
Authentication · apprentice
2FA bypass using a brute-force attack
Authentication · expert
Broken brute-force protection, multiple credentials
Authentication · expert
Password reset poisoning via dangling markup
Authentication · expert
2FA broken logic
Authentication · practitioner
Broken brute-force protection, IP block
Authentication · practitioner
Brute-forcing a stay-logged-in cookie
Authentication · practitioner
Offline password cracking
Authentication · practitioner
Password brute-force via password change
Authentication · practitioner
Password reset poisoning via middleware
Authentication · practitioner
Username enumeration via account lock
Authentication · practitioner
Username enumeration via subtly different responses
Authentication · practitioner
Excessive trust in client-side controls
Business Logic · apprentice
Flawed enforcement of business rules
Business Logic · apprentice
High-level logic vulnerability
Business Logic · apprentice
Inconsistent security controls
Business Logic · apprentice
Authentication bypass via encryption oracle
Business Logic · practitioner
Authentication bypass via flawed state machine
Business Logic · practitioner
Inconsistent handling of exceptional input
Business Logic · practitioner
Infinite money logic flaw
Business Logic · practitioner
Insufficient workflow validation
Business Logic · practitioner
Low-level logic flaw
Business Logic · practitioner
Weak isolation on dual-use endpoint
Business Logic · practitioner
CORS vulnerability with basic origin reflection
CORS · apprentice
CORS vulnerability with internal network pivot attack
CORS · expert
CORS vulnerability with trusted insecure protocols
CORS · practitioner
CORS vulnerability with trusted null origin
CORS · practitioner
CSRF vulnerability with no defenses
CSRF · apprentice
CSRF where Referer validation depends on header being present
CSRF · practitioner
CSRF where token is duplicated in cookie
CSRF · practitioner
CSRF where token is not tied to user session
CSRF · practitioner
CSRF where token is tied to a non-session cookie
CSRF · practitioner
CSRF where token validation depends on request method
CSRF · practitioner
CSRF where token validation depends on token being present
CSRF · practitioner
CSRF with broken Referer validation
CSRF · practitioner
SameSite Lax bypass via cookie refresh
CSRF · practitioner
SameSite Lax bypass via method override
CSRF · practitioner
SameSite Strict bypass via client-side redirect
CSRF · practitioner
SameSite Strict bypass via sibling domain
CSRF · practitioner
Basic clickjacking with CSRF token protection
Clickjacking · apprentice
Clickjacking with form input data prefilled from URL parameter
Clickjacking · apprentice
Clickjacking with a frame buster script
Clickjacking · practitioner
Exploiting clickjacking vulnerability to trigger DOM-based XSS
Clickjacking · practitioner
Multistep clickjacking
Clickjacking · practitioner
OS command injection, simple case
Command Injection · apprentice
Blind OS command injection with out-of-band data exfiltration
Command Injection · practitioner
Blind OS command injection with out-of-band interaction
Command Injection · practitioner
Blind OS command injection with output redirection
Command Injection · practitioner
Blind OS command injection with time delays
Command Injection · practitioner
Modifying serialized objects
Deserialization · apprentice
Developing a custom gadget chain for Java deserialization
Deserialization · expert
Developing a custom gadget chain for PHP deserialization
Deserialization · expert
Using PHAR deserialization to deploy a custom gadget chain
Deserialization · expert
Arbitrary object injection in PHP
Deserialization · practitioner
Exploiting Java deserialization with Apache Commons
Deserialization · practitioner
Exploiting PHP deserialization with pre-built gadget chain
Deserialization · practitioner
Exploiting Ruby deserialization using a documented gadget
Deserialization · practitioner
Modifying serialized data types
Deserialization · practitioner
Using application functionality to exploit deserialization
Deserialization · practitioner
Discovering vulnerabilities quickly with targeted scanning
Essential Skills · apprentice
Scanning non-standard data structures
Essential Skills · practitioner
Using Burp Scanner during manual testing
Essential Skills · practitioner
Web security testing with Burp Scanner
Essential Skills · practitioner
Remote code execution via web shell upload
File Upload · apprentice
Web shell upload via Content-Type restriction bypass
File Upload · apprentice
Web shell upload via race condition
File Upload · expert
Remote code execution via polyglot web shell upload
File Upload · practitioner
Web shell upload via extension blacklist bypass
File Upload · practitioner
Web shell upload via obfuscated file extension
File Upload · practitioner
Web shell upload via path traversal
File Upload · practitioner
Accessing private GraphQL posts
GraphQL · apprentice
Accidental exposure of private GraphQL fields
GraphQL · practitioner
Bypassing GraphQL brute force protections
GraphQL · practitioner
Finding a hidden GraphQL endpoint
GraphQL · practitioner
Performing CSRF exploits over GraphQL
GraphQL · practitioner
Browser cache poisoning via client-side desync
HTTP Request Smuggling · expert
Bypassing access controls via HTTP/2 smuggling
HTTP Request Smuggling · expert
CL.0 request smuggling via browser
HTTP Request Smuggling · expert
Client-side desync (web timing)
HTTP Request Smuggling · expert
Exploiting HTTP request smuggling to perform cache deception
HTTP Request Smuggling · expert
HTTP request smuggling via client-side desync
HTTP Request Smuggling · expert
HTTP request smuggling, basic TE.TE
HTTP Request Smuggling · expert
Server-side pause-based request smuggling
HTTP Request Smuggling · expert
CL.0 request smuggling
HTTP Request Smuggling · practitioner
Exploiting HTTP request smuggling to bypass access
HTTP Request Smuggling · practitioner
Exploiting HTTP request smuggling to capture request
HTTP Request Smuggling · practitioner
Exploiting HTTP request smuggling to deliver XSS
HTTP Request Smuggling · practitioner
Exploiting HTTP request smuggling to reveal headers
HTTP Request Smuggling · practitioner
H2.CL request smuggling
HTTP Request Smuggling · practitioner
HTTP request smuggling, basic CL.TE
HTTP Request Smuggling · practitioner
HTTP request smuggling, basic TE.CL
HTTP Request Smuggling · practitioner
HTTP request smuggling, confirming CL.TE via response
HTTP Request Smuggling · practitioner
HTTP request smuggling, confirming TE.CL via response
HTTP Request Smuggling · practitioner
HTTP request smuggling, obfuscating TE header
HTTP Request Smuggling · practitioner
HTTP/2 request smuggling via CRLF injection
HTTP Request Smuggling · practitioner
HTTP/2 request splitting via CRLF injection
HTTP Request Smuggling · practitioner
Response queue poisoning via H2.TE request smuggling
HTTP Request Smuggling · practitioner
Authentication bypass via information disclosure
Information Disclosure · apprentice
Information disclosure in error messages
Information Disclosure · apprentice
Information disclosure on debug page
Information Disclosure · apprentice
Source code disclosure via backup files
Information Disclosure · apprentice
Information disclosure in version control history
Information Disclosure · practitioner
JWT authentication bypass via flawed signature verification
JWT · apprentice
JWT authentication bypass via unverified signature
JWT · apprentice
JWT authentication bypass via algorithm confusion
JWT · expert
JWT authentication bypass via algorithm confusion with no key
JWT · expert
JWT authentication bypass via jku header injection
JWT · practitioner
JWT authentication bypass via jwk header injection
JWT · practitioner
JWT authentication bypass via kid header path traversal
JWT · practitioner
JWT authentication bypass via weak signing key
JWT · practitioner
Authentication bypass via OAuth implicit flow
OAuth · apprentice
Stealing OAuth access tokens via a proxy page
OAuth · expert
Forced OAuth profile linking
OAuth · practitioner
OAuth account hijacking via redirect_uri
OAuth · practitioner
SSRF via OpenID dynamic client registration
OAuth · practitioner
Stealing OAuth access tokens via an open redirect
OAuth · practitioner
File path traversal, simple case
Path Traversal · apprentice
File path traversal, traversal sequences blocked with absolute path bypass
Path Traversal · practitioner
File path traversal, traversal sequences stripped non-recursively
Path Traversal · practitioner
File path traversal, traversal sequences stripped with superfluous URL-decode
Path Traversal · practitioner
File path traversal, validation of file extension with null byte bypass
Path Traversal · practitioner
File path traversal, validation of start of path
Path Traversal · practitioner
Exfiltrating sensitive data via server-side prototype pollution
Prototype Pollution · expert
Bypassing flawed input filters for server-side prototype pollution
Prototype Pollution · practitioner
Client-side prototype pollution in third-party libraries
Prototype Pollution · practitioner
Client-side prototype pollution via browser APIs
Prototype Pollution · practitioner
Client-side prototype pollution via flawed sanitization
Prototype Pollution · practitioner
DOM XSS via an alternative prototype pollution vector
Prototype Pollution · practitioner
DOM XSS via client-side prototype pollution
Prototype Pollution · practitioner
Detecting server-side prototype pollution without polluted property reflection
Prototype Pollution · practitioner
Privilege escalation via server-side prototype pollution
Prototype Pollution · practitioner
Remote code execution via server-side prototype pollution
Prototype Pollution · practitioner
SQL injection vulnerability allowing login bypass
SQL Injection · apprentice
SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
SQL Injection · apprentice
Blind SQL injection with conditional errors
SQL Injection · practitioner
Blind SQL injection with conditional responses
SQL Injection · practitioner
Blind SQL injection with out-of-band data exfiltration
SQL Injection · practitioner
Blind SQL injection with out-of-band interaction
SQL Injection · practitioner
Blind SQL injection with time delays
SQL Injection · practitioner
Blind SQL injection with time delays and information retrieval
SQL Injection · practitioner
SQL injection UNION attack, determining the number of columns
SQL Injection · practitioner
SQL injection UNION attack, finding a column containing text
SQL Injection · practitioner
SQL injection UNION attack, retrieving data from other tables
SQL Injection · practitioner
SQL injection UNION attack, retrieving multiple values
SQL Injection · practitioner
SQL injection attack, listing database contents on Oracle
SQL Injection · practitioner
SQL injection attack, listing database contents on non-Oracle
SQL Injection · practitioner
SQL injection attack, querying the database type and version on MySQL
SQL Injection · practitioner
SQL injection attack, querying the database type and version on Oracle
SQL Injection · practitioner
SQL injection with filter bypass via XML encoding
SQL Injection · practitioner
Visible error-based SQL injection
SQL Injection · practitioner
Basic SSRF against another back-end system
SSRF · apprentice
Basic SSRF against the local server
SSRF · apprentice
SSRF with Shellshock exploitation
SSRF · expert
SSRF with whitelist-based input filter
SSRF · expert
Blind SSRF with out-of-band detection
SSRF · practitioner
SSRF with blacklist-based input filter
SSRF · practitioner
SSRF with filter bypass via open redirection
SSRF · practitioner
Manipulating WebSocket messages to exploit vulnerabilities
WebSockets · apprentice
Cross-site WebSocket hijacking
WebSockets · practitioner
Manipulating the WebSocket handshake to exploit vulnerabilities
WebSockets · practitioner
DOM XSS in document.write sink using source location.search
XSS · apprentice
DOM XSS in innerHTML sink using source location.search
XSS · apprentice
DOM XSS in jQuery anchor href attribute sink
XSS · apprentice
DOM XSS in jQuery selector sink using hashchange event
XSS · apprentice
Reflected XSS into HTML context with nothing encoded
XSS · apprentice
Reflected XSS into JavaScript string with angle brackets
XSS · apprentice
Reflected XSS into attribute with angle brackets HTML-encoded
XSS · apprentice
Stored XSS into HTML context with nothing encoded
XSS · apprentice
Stored XSS into anchor href attribute with double quotes
XSS · apprentice
Exploiting cross-site scripting to capture passwords
XSS · expert
Reflected XSS in a JavaScript URL with some blocked
XSS · expert
Reflected XSS protected by CSP with nonce
XSS · expert
Reflected XSS protected by very strict CSP with dangling
XSS · expert
Reflected XSS with AngularJS sandbox escape and CSP
XSS · expert
Reflected XSS with AngularJS sandbox escape without strings
XSS · expert
Reflected XSS with event handlers and href blocked
XSS · expert
DOM XSS in AngularJS expression with angle brackets
XSS · practitioner
DOM XSS in document.write sink inside select element
XSS · practitioner
Exploiting XSS to perform CSRF
XSS · practitioner
Reflected DOM XSS
XSS · practitioner
Reflected XSS in canonical link tag
XSS · practitioner
Reflected XSS into HTML context with all tags blocked
XSS · practitioner
Reflected XSS into HTML context with most tags blocked
XSS · practitioner
Reflected XSS into JavaScript string with escape sequence
XSS · practitioner
Reflected XSS into JavaScript string with single quote
XSS · practitioner
Reflected XSS into JavaScript with angle brackets encoded
XSS · practitioner
Reflected XSS into template literal with angle brackets
XSS · practitioner
Reflected XSS with some SVG markup allowed
XSS · practitioner
Stored DOM XSS
XSS · practitioner
Stored XSS into onclick event with angle brackets encoded
XSS · practitioner
Exploiting XXE to perform SSRF attacks
XXE · apprentice
Exploiting XXE using external entities to retrieve files
XXE · apprentice
Exploiting XXE to retrieve data by repurposing a local DTD
XXE · expert
Blind XXE with out-of-band interaction
XXE · practitioner
Blind XXE with out-of-band interaction via XML parameter
XXE · practitioner
Exploiting XInclude to retrieve files
XXE · practitioner
Exploiting XXE via image file upload
XXE · practitioner
Exploiting blind XXE to exfiltrate data using malicious DTD
XXE · practitioner
Exploiting blind XXE to retrieve data via error messages
XXE · practitioner