Web Security Academy

You've heard of SQL injection, but have you heard of NoSQL injection? In this video, we perform a full account takeover using NoSQL injection. We use the NoSQL injection to find the admin username, and reset their password! Learn this in our FREE labs 👇 portswigger.net/web-security…

One method for discovering the correct amount of columns to SELECT in a SQL injection is to keep adding NULL until the error disappears. Check it out! 👇

If you're learning to hack, you need to be the guy in the bottom pane

How to Find Path Delimiter Issues with Burp Suite Intruder Sometimes web servers treat special characters (like ; or ?) differently in URLs. This can lead to security issues like web cache deception or access control problems. Here's how you can test for path delimiter discrepancies: 1️⃣ Capture the Request Find a request you want to test GET /my-account HTTP/2 2️⃣ Right click the request and "Send to Intruder". In Intruder, highlight add a new position after /my-account followed by abc. It should look like this: GET /my-account§§abc HTTP/2 Attack Type = Sniper (only changing one spot). Payload: Paste a list of special characters, like this: ! # $ % & ' ( ) * + , - . / : ; = ? @ [ \ ] _ ~ ... A full list of delimiters can be found here: portswigger.net/web-security… 3️⃣ Start the Attack Press Start Attack. Look at the Status, Length, and Response columns. Watch for differences (like bigger/smaller pages, changes to status code or different behavior) and if you notice something different then you've likely found a delimiter discrepancy! 🎉 Why is this important? When special characters confuse the server or cache, you might find: 🔸 Web cache deception: Caching personal pages by accident 🔸 Access bypass: Skipping security checks 🔸 Leaked info: Seeing data you shouldn't Try this lab for yourself and dive even deeper into how to exploit this when you find it: portswigger.net/web-security… #BugBounty #WebSecurity #BurpSuite #EthicalHacking #Cybersecurity

In Burp Repeater, try changing the file’s Content-Type to image/jpeg. If a previously blocked upload is now accepted, the server may be trusting the multipart header instead of checking the file itself. That header is supplied by the client. Validation also needs to consider the filename, extension, actual contents, storage location, and whether the server can execute the uploaded file. Try it in the file upload labs 👇 portswigger.net/web-security…

Your SSRF filter blocks 127.0.0.1 and localhost. That's okay! Try these: 2130706433 (decimal) 017700000001 (octal) 127.1 (shorthand) 127.0.0.0 (with subnet tricks) 0x7f000001 (hex) They all resolve to localhost. Many blocklists don't catch all of them. Try this technique, and plenty of other SSRF techniques, in our free SSRF labs! portswigger.net/web-security…

How to manually check for CL.TE Request Smuggling Vulnerabilities: 1️⃣ See if a GET request accepts POST 2️⃣ See if it accepts HTTP/1 3️⃣ Disable "Update Content-Length" 4️⃣ Send with CL & TE headers: POST / HTTP/1.1 Host: <HOST-URL> Content-Length: 6 Transfer-Encoding: chunked 0 G 5️⃣ Send request twice. If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability! Try this out for yourself in our CL.TE lab: portswigger.net/web-security…

SQL injection! 💉 After finding the number of columns using the NULL trick, you can take it a step further and identify which column takes which data type. Swap 'abc' into one position at a time. The one that comes back without an error is your string column, and that's where your data goes. Want to practice this technique? Hack our FREE labs! 👇 portswigger.net/web-security…

Hackers asked for a third edition of The Web Hacker’s Handbook. Rather than releasing another book which will quickly get out-dated, we created the Web Security Academy, a living, constantly updated learning hub with hands-on labs and video walk-throughs so you can learn by doing, not just reading. portswigger.net/web-security…

Sometimes I feel bad for Carlos.

👋 hello to our latest followers! @RuizMun_02 @_mohammadtahsin @JK_EternalWork @sayfeltief @danz_adz99 @FealsHunter @Prtmyo10 @henryramirezf @Ab0L3TA @Lyrica3soulfire @mm3445364414766 @shinobe179 @The_spcone @Cyph3r0ptik

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now: portswigger.net/web-security…

Pro tip for SSRF! Blocking 127.0.0.1 does not necessarily account for every representation a parser may resolve as loopback. Depending on the parser, that can include case variations of localhost or shorthand forms such as 127.1. Compare validation, normalization, DNS resolution, and the final request. Explore the Academy SSRF labs 👇 portswigger.net/web-security…

If you're manually exploiting a SQLi, one of the most important parts is figuring out how many columns you're dumping. There are many methods, but using ORDER BY is particularly efficient!

Everyone who wants to learn: 1️⃣ XSS ↪️ SSRF 🤔 OWASP 🪟 DOM XSS 🔐 Auth bypass 💉 SQL injection 📁 File upload vulns 📦 GraphQL Hacking 🧰 Burp Suite Mastery 🧠 Business Logic Flaws 💔 Broken Access Control 🏴‍☠️ Real Exploit Techniques 💥 Much, much, much, more I hope you found this account.