weXe1 / PortSwigger-Academy-Solutions

Scripts to help with solving labs on PortSwigger Web Security Academy

PortSwigger Web Security Academy Solutions

Scripts and exploits to help solve lab assignments at PortSwigger Web Security Academy

Server-side topics

SQLi

UNION based

• Finding amount of columns in table

Blind

• Lab: Blind SQL injection with conditional responses
• Lab: Blind SQL injection with conditional errors
• Lab: Blind SQL injection with time delays and information retrieval

Authentication

• Lab: Broken brute-force protection, IP block
• Lab: Username enumeration via account lock
• Lab: 2FA broken logic
• Lab: Brute-forcing a stay-logged-in cookie

Business logic vulnerabilities

• Lab: Infinite money logic flaw

File upload vulnerabilities

• Lab: Remote code execution via web shell upload
• Lab: Web shell upload via extension blacklist bypass
• Lab: Remote code execution via polyglot web shell upload

Client-side topics

CSRF

• Lab: CSRF where token validation depends on token being present
• Lab: CSRF where token is not tied to user session
• Lab: CSRF where token is tied to non-session cookie
• Lab: CSRF where token is duplicated in cookie
• Lab: SameSite Lax bypass via method override
• Lab: SameSite Strict bypass via client-side redirect
• Lab: SameSite Lax bypass via cookie refresh
• Lab: CSRF where Referer validation depends on header being present
• Lab: CSRF with broken Referer validation

WebSockets

• Lab: Cross-site WebSocket hijacking