Cybersecurity Walkthroughs

Exploiting Inconsistent Security Controls - PortSwigger Lab Walkthrough

Apr 21, 20252 min read

Information Disclosure in Error Messages - PortSwigger Lab Walkthrough

Apr 19, 20252 min read

Exploiting Business Logic Flaws: Lightweight I33t Jacket for Free

Introduction Business logic vulnerabilities arise when an application fails to enforce rules properly. In this lab from PortSwigger, we explore how logic flaws in coupon validation can be abused to bypass payment rules and get a Lightweight I33t leat...

Apr 23, 20252 min read

Exploiting WebSocket Vulnerabilities to Trigger alert() - PortSwigger Lab Walkthrough

Apr 18, 20252 min read

How I Exploited Username Enumeration via Different Responses (PortSwigger Lab)

Apr 17, 20252 min read

Exploiting Role -Based Access Control Misconfiguration -PortSwigger Lab Walkthrough

Introduction In this lab, we exploit a flawed access control mechanism where user roles are controlled through a client-side modifiable field. Our goal is to an admin and accessing a restricted /admin page to delete the user carlos. Understanding the...

Apr 14, 20252 min read

Exploiting Server-Side Parameter Pollution in a Query String - PortSwigger Lab Walkthrough

Introduction In this post, I’ll walk through the PortSwigger lab on exploiting Server-Side Parameter Pollution (SSPP) in a query string to escalate privileges and reset the admin password. This lab is a great way to understand how duplicate parameter...

Apr 11, 20252 min read

Path Traversal Exploit: Bypassing Filters Using Superfluous URL- Decoding

Introduction Path traversal is a vulnerability that allows attackers to access files outside the intended directory by manipulating file paths. Developers often try to prevent it by filtering path traversal sequences (e.g., ../). However, some applic...

Mar 28, 20252 min read

Exploiting Server-Side Template Injection (SSTI) to Extract Sensitive Information - PortSwigger Lab Walkthrough

Introduction Server-Side Template Injection (SSTI) is a vulnerability that occurs when user input is directly passed into a template engine without proper sanitization. This can lead to information disclosure, code execution, and even full system com...

Mar 24, 20252 min read

Exploiting Blind OS Command Injection with Out-of-Band Interaction (PortSwigger Lab Walkthrough)

Introduction OS Command Injection is a critical vulnerability that allows an attacker to execute arbitrary system commands on a server. Blind OS command injection is a special case where the attack is successful, but no direct output is returned to t...

Mar 23, 20252 min read

Blind SSRF with Shellshock Exploitation - PortSwigger Lab Walkthrough

Introduction Server-Side Request Forgery (SSRF) is an attack where an attacker tricks a vulnerable server into making unintended requests to internal or external systems. In this blog, we will explore how to exploit a Blind Server-Side Request Forger...

Mar 22, 20252 min read

Command Palette

Latest articles