Chetan Patil·1d agoReflected XSS into HTML Context with All Tags Blocked Except Custom Ones (PortSwigger Lab)Practitioner-level lab from the PortSwigger Web Security Academy — solved by smuggling a script through a filter that blocks every “real”…
Muhammad Raza·1d agoPortSwigger Lab: Blind SQL Injection with Time DelaysDifficulty: Practitioner Target: PortSwigger Web Security Academy
Chetan Patil·3d agoReflected XSS into HTML Context with Most Tags and Attributes Blocked -Brute-Forcing a WAF with…Practitioner-level lab from the PortSwigger Web Security Academy — solved by using Burp Intruder to brute-force a WAF’s tag and…
Kaustubh Asthana·3d agoWeb Shell Upload via Race ConditionNot fooling the filter at all, but catching the server in the half-second gap between accepting a file and deleting it
Martinschibueze·4d ago“Web cache deception, explained: how a URL extension confuses the cache into storing your private…Web cache deception (WCD) is when an attacker tricks the cache into storing a private, dynamic response by taking advantage of the…
Pranjali Mandavi·4d agoOne Lab, Three Ways: Solving PortSwigger’s SQL Injection “Hidden Data” Lab with the Browser, Burp…Subtitle: Same payload, three delivery methods, and what each one teaches you about how web requests really work.
Chetan Patil·4d agoStored DOM XSS -Beating a Single-Shot .replace()Sanitizer (PortSwigger Lab)Practitioner-level lab from the PortSwigger Web Security Academy -solved by abusing a classic JavaScript gotcha: String.replace() without…
Kaustubh Asthana·4d agoRemote Code Execution via Polyglot Web Shell UploadNot disguising a PHP file as an image, but building a file that is honestly both at once
