SQL Injection Vulenerabilities
Video Walkthrough :
Writeups :
| Lab Name | Visit |
|---|---|
| SQL injection UNION attack, determining the number of columns returned by the query | View |
| SQL injection UNION attack, finding a column containing text | View |
| SQL injection attack, listing the database contents on Oracle | View |
| SQL injection attack, listing the database contents on non-Oracle databases | View |
| SQL injection attack, querying the database type and version on MySQL and Microsoft | View |
| SQL injection attack, querying the database type and version on Oracle | View |
| SQL injection vulnerability allowing login bypass | View |
| SQL injection vulnerability in WHERE clause allowing retrieval of hidden data | View |
| Blind SQL injection with conditional errors | View |
| Blind SQL injection with conditional responses | View |
| Blind SQL injection with time delays | View |
| SQL injection UNION attack, retrieving multiple values in a single column | View |
| SQL injection with filter bypass via XML encoding | View |
| Visible error-based SQL injection | View |
Authentication Vulnerabilities
Video Walkthrough :
Writeups :
| Lab Name | Visit |
|---|---|
| 2FA simple bypass | View |
| Password reset broken logic | View |
| Username enumeration via different responses | View |
| 2FA broken logic | View |
| Brute-forcing a stay-logged-in cookie | View |
| Offline password cracking | View |
| Password brute-force via password change | View |
| Password reset poisoning via middleware | View |
| Username enumeration via account lock | View |
| Username enumeration via response timing | View |
| Username enumeration via subtly different responses | View |
| Broken brute-force protection, IP block | View |
| Broken brute-force protection, multiple credentials per request | View |
Access Control Vulnerabilities
Video Walkthrough :
Writeups :
| Lab Name | Visit |
|---|---|
| Insecure direct object references | View |
| Method-based access control can be circumvented | View |
| Multi-step process with no access control on one step | View |
| Referer-based access control | View |
| URL-based access control can be circumvented | View |
| Unprotected admin functionality with unpredictable URL | View |
| Unprotected admin functionality | View |
| User ID controlled by request parameter with data leakage in redirect | View |
| User ID controlled by request parameter with password disclosure | View |
| User ID controlled by request parameter | View |
| User role can be modified in user profile | View |
| User role controlled by request parameter | View |
| User ID controlled by request parameter, with unpredictable user IDs | View |
Path Traversal
Video Walkthrough :
Writeups :
| Lab Name | Visit |
|---|---|
| File path traversal, simple case | View |
| File path traversal, traversal sequences blocked with absolute path bypass | View |
| File path traversal, traversal sequences stripped non-recursively | View |
| File path traversal, traversal sequences stripped with superfluous URL-decode | View |
| File path traversal, validation of file extension with null byte bypass | View |
| File path traversal, validation of start of path | View |
SSRF
Video Walkthrough :
Writeups :
| Lab Name | Visit |
|---|---|
| Basic SSRF against another back-end system | View |
| Basic SSRF against the local server | View |
| Lab - SSRF with blacklist-based input filter | View |
| Lab - SSRF with whitelist-based input filter | View |
| Lab - SSRF with filter bypass via open redirection vulnerability | View |
| Lab - Blind SSRF with out-of-band detection | View |
File Upload Vulnerabilities
Writeups :
| Lab Name | Visit |
|---|---|
| Remote code execution via polyglot web shell upload | View |
| Remote code execution via web shell upload | View |
| Web shell upload via Content-Type restriction bypass | View |
| Web shell upload via extension blacklist bypass | View |
| Web shell upload via obfuscated file extension | View |
| Web shell upload via path traversal | View |
CSRF
Writeups :
| Category | Lab Name | Visit |
|---|---|---|
| CSRF | CSRF vulnerability with no defenses | View |
| CSRF | CSRF where token validation depends on request method | View |
Command Injection
Writeups :
| Category | Lab Name | Visit |
|---|---|---|
| Command Injection | OS command injection, simple case | View |
Cross-Site Scripting (XSS)
Writeups :
| Category | Lab Name | Visit |
|---|---|---|
| Cross Site Scripting (XSS) | (No labs listed yet) | — |
Essential Skills
Writeups :
| Category | Lab Name | Visit |
|---|---|---|
| Essential Skills | Discovering vulnerabilities quickly with targeted scanning | View |
Host Header Attacks
Writeups :
| Category | Lab Name | Visit |
|---|---|---|
| Host Header Attacks | Host header authentication bypass | View |
| Host Header Attacks | Web cache poisoning via ambiguous requests | View |
JWT Vulnerabilities
Writeups :
| Category | Lab Name | Visit |
|---|---|---|
| JWT Vulnerabilities | JWT authentication bypass via unverified signature | View |
SSTI
Writeups :
| Category | Lab Name | Visit |
|---|---|---|
| SSTI | Basic server-side template injection (code context) | View |
| SSTI | Basic server-side template injection | View |
| SSTI | Server-side template injection in an unknown language with a documented exploit | View |
| SSTI | Server-side template injection using documentation | View |
| SSTI | Server-side template injection with information disclosure via user-supplied objects | View |
XXE
Writeups :
| Category | Lab Name | Visit |
|---|---|---|
| XXE | Blind XXE with out-of-band interaction via XML parameter entities | View |
| XXE | Blind XXE with out-of-band interaction | View |
| XXE | Exploiting XXE to perform SSRF attacks | View |
| XXE | Exploiting XXE using external entities to retrieve files | View |
| XXE | Exploiting blind XXE to exfiltrate data using a malicious external DTD | View |