PortSwigger Web Security Academy Solutions

Scripts and exploits to help solve lab assignments at PortSwigger Web Security Academy

Server-side topics

SQLi

UNION based

• Finding amount of columns in table

Blind

• Lab: Blind SQL injection with conditional responses
• Lab: Blind SQL injection with conditional errors
• Lab: Blind SQL injection with time delays and information retrieval

Authentication

• Lab: Broken brute-force protection, IP block
• Lab: Username enumeration via account lock
• Lab: 2FA broken logic
• Lab: Brute-forcing a stay-logged-in cookie

Business logic vulnerabilities

• Lab: Infinite money logic flaw

File upload vulnerabilities

• Lab: Remote code execution via web shell upload
• Lab: Web shell upload via extension blacklist bypass
• Lab: Remote code execution via polyglot web shell upload

SSRF

• Lab: Basic SSRF against another back-end system

Client-side topics

CSRF

• Lab: CSRF where token validation depends on token being present
• Lab: CSRF where token is not tied to user session
• Lab: CSRF where token is tied to non-session cookie
• Lab: CSRF where token is duplicated in cookie
• Lab: SameSite Lax bypass via method override
• Lab: SameSite Strict bypass via client-side redirect
• Lab: SameSite Lax bypass via cookie refresh
• Lab: CSRF where Referer validation depends on header being present
• Lab: CSRF with broken Referer validation

WebSockets

• Lab: Cross-site WebSocket hijacking