HHareeshwar N K·Oct 30When the Database Talks Back: Blind SQLi Data Exfiltration Over DNSA PortSwigger Practitioner lab where a quoted string literal blocked my first payload, and rebuilding the concatenation at SQL level turned the admin password into a DNS label.6 min read·hareeshwarnk.hashnode.dev
DDavid Essien·Sep 19One Missing Parameter Cost Me Six Hours (PortSwigger Lab)A PortSwigger lab on multi-step process access control, where hours of guessing came down to one field missing from a single request.6 min read·david-essien.hashnode.dev12M
DDavid Essien·Sep 19What a Single File Name Taught Me About IDOR (PortSwigger Lab)A PortSwigger access control lab where a chat transcript downloaded as 2.txt, and that one detail was the whole vulnerability.4 min read·david-essien.hashnode.dev
PPriti Pawar·Aug 4PortSwigger: Broke 10 things this weekI'm a third-year B.Tech CSIT student, and this week I started working through PortSwigger's Web Security Academy to explore offensive security hands-on. I'm documenting each lab here — the vulnerabili23 min read·portswiggerlabs.hashnode.dev
SSreerag Pramod·Jul 27Excessive Trust in Client-Side ControlsHow trusting client-sent price data instead of server-side validation let me buy a $1337 item for one cent, a business logic walkthrough.10 min read·sreeragpramod.hashnode.dev
AAbhinav·Jul 15LAB #04 Basic password reset poisoningUnderstanding and exploiting Host header injection in password reset functionality.2 min read·log.page0.dev
AAbhinav·Jul 14LAB#03 OAuth account hijacking via redirect_uriUnderstanding and exploiting an insecure redirect_uri validation in OAuth.2 min read·log.page0.dev
AAbhinav·Jul 8LAB #02 Forced OAuth profile linkingUnderstanding and exploiting an insecure OAuth account-linking implementation.3 min read·log.page0.dev1
VVimal Mudalagi·Jul 7Learning Web Security #1: Broken Access Control (OWASP Top 10 #1 - Beginner's Guide)Disclaimer: I'm currently learning web security through PortSwigger Web Security Academy. These are my beginner-friendly notes rewritten as a blog to help reinforce my understanding. If you're just st9 min read·vimalmudalagi.hashnode.dev
MMouhamed Ben Abdallah·May 12Unprotected Admin Functionalityvertical privilege escalation broken access control vulnerability robots.txt security misconfiguration admin panel exposed without authentication8 min read·erinmin-writeups.hashnode.dev
