--- title: "#portswigger articles | Hashnode" description: "Explore 67 articles tagged #portswigger on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/portswigger" --- Tag # #portswigger 67 posts · 3 followers [Hareeshwar N K](https://hashnode.com/@H4x0rGh0st) · [Oct 30](https://hashnode.com/posts/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns/6ae41ee471b5a8dbb4e7f2f0) ### [When the Database Talks Back: Blind SQLi Data Exfiltration Over DNS](https://hareeshwarnk.hashnode.dev/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns?utm_source=hashnode&utm_medium=feed) A PortSwigger Practitioner lab where a quoted string literal blocked my first payload, and rebuilding the concatenation at SQL level turned the admin password into a DNS label. 6 min read · [hareeshwarnk.hashnode.dev](https://hareeshwarnk.hashnode.dev/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns?utm_source=hashnode&utm_medium=feed) [David Essien](https://hashnode.com/@davidessien) · [Sep 19](https://hashnode.com/posts/one-missing-parameter-cost-me-six-hours-portswigger-lab/6aae394cf99fc5bd87e38e24) ### [One Missing Parameter Cost Me Six Hours (PortSwigger Lab)](https://david-essien.hashnode.dev/one-missing-parameter-cost-me-six-hours-portswigger-lab?utm_source=hashnode&utm_medium=feed) A PortSwigger lab on multi-step process access control, where hours of guessing came down to one field missing from a single request. 6 min read · [david-essien.hashnode.dev](https://david-essien.hashnode.dev/one-missing-parameter-cost-me-six-hours-portswigger-lab?utm_source=hashnode&utm_medium=feed) [2](https://hashnode.com/posts/one-missing-parameter-cost-me-six-hours-portswigger-lab/6aae394cf99fc5bd87e38e24) [David Essien](https://hashnode.com/@davidessien) · [Sep 19](https://hashnode.com/posts/what-a-single-file-name-taught-me-about-idor-portswigger-lab/6aae3716aba8a64317cad7e8) ### [What a Single File Name Taught Me About IDOR (PortSwigger Lab)](https://david-essien.hashnode.dev/what-a-single-file-name-taught-me-about-idor-portswigger-lab?utm_source=hashnode&utm_medium=feed) A PortSwigger access control lab where a chat transcript downloaded as 2.txt, and that one detail was the whole vulnerability. 4 min read · [david-essien.hashnode.dev](https://david-essien.hashnode.dev/what-a-single-file-name-taught-me-about-idor-portswigger-lab?utm_source=hashnode&utm_medium=feed) [Priti Pawar](https://hashnode.com/@pritip) · [Aug 4](https://hashnode.com/posts/portswigger-broke-10-things-this-week/6a713de36ae30d873c542885) ### [PortSwigger: Broke 10 things this week](https://portswiggerlabs.hashnode.dev/portswigger-broke-10-things-this-week?utm_source=hashnode&utm_medium=feed) I'm a third-year B.Tech CSIT student, and this week I started working through PortSwigger's Web Security Academy to explore offensive security hands-on. I'm documenting each lab here — the vulnerabili 23 min read · [portswiggerlabs.hashnode.dev](https://portswiggerlabs.hashnode.dev/portswigger-broke-10-things-this-week?utm_source=hashnode&utm_medium=feed) [Sreerag Pramod](https://hashnode.com/@sreeragpramod) · [Jul 27](https://hashnode.com/posts/excessive-trust-in-client-side-controls/6a67761e875c0e45003d11d1) ### [Excessive Trust in Client-Side Controls](https://sreeragpramod.hashnode.dev/excessive-trust-in-client-side-controls?utm_source=hashnode&utm_medium=feed) How trusting client-sent price data instead of server-side validation let me buy a $1337 item for one cent, a business logic walkthrough. 10 min read · [sreeragpramod.hashnode.dev](https://sreeragpramod.hashnode.dev/excessive-trust-in-client-side-controls?utm_source=hashnode&utm_medium=feed) [Abhinav](https://hashnode.com/@abiinv) · [Jul 15](https://hashnode.com/posts/lab-04-basic-password-reset-poisoning/6a575da4b36d3effd223b56e) ### [LAB #04 Basic password reset poisoning](https://log.page0.dev/lab-04-basic-password-reset-poisoning?utm_source=hashnode&utm_medium=feed) Understanding and exploiting Host header injection in password reset functionality. 2 min read · [log.page0.dev](https://log.page0.dev/lab-04-basic-password-reset-poisoning?utm_source=hashnode&utm_medium=feed) [Abhinav](https://hashnode.com/@abiinv) · [Jul 14](https://hashnode.com/posts/lab-03-oauth-account-hijacking-via-redirect-uri/6a560f642690a47284dff046) ### [LAB#03 OAuth account hijacking via redirect\_uri](https://log.page0.dev/lab-03-oauth-account-hijacking-via-redirect-uri?utm_source=hashnode&utm_medium=feed) Understanding and exploiting an insecure redirect\_uri validation in OAuth. 2 min read · [log.page0.dev](https://log.page0.dev/lab-03-oauth-account-hijacking-via-redirect-uri?utm_source=hashnode&utm_medium=feed) [Abhinav](https://hashnode.com/@abiinv) · [Jul 8](https://hashnode.com/posts/lab-02-forced-oauth-profile-linking/6a4e3b447d82fee7b21d8de9) ### [LAB #02 Forced OAuth profile linking](https://log.page0.dev/lab-02-forced-oauth-profile-linking?utm_source=hashnode&utm_medium=feed) Understanding and exploiting an insecure OAuth account-linking implementation. 3 min read · [log.page0.dev](https://log.page0.dev/lab-02-forced-oauth-profile-linking?utm_source=hashnode&utm_medium=feed) [Vimal Mudalagi](https://hashnode.com/@vimalmudalagi) · [Jul 7](https://hashnode.com/posts/learning-web-security-1-broken-access-control-owasp-top-10-1-beginner-s-guide/6a4d0305ab2992a7aae06ac4) ### [Learning Web Security #1: Broken Access Control (OWASP Top 10 #1 - Beginner's Guide)](https://vimalmudalagi.hashnode.dev/learning-web-security-1-broken-access-control-owasp-top-10-1-beginner-s-guide?utm_source=hashnode&utm_medium=feed) Disclaimer: I'm currently learning web security through PortSwigger Web Security Academy. These are my beginner-friendly notes rewritten as a blog to help reinforce my understanding. If you're just st 9 min read · [vimalmudalagi.hashnode.dev](https://vimalmudalagi.hashnode.dev/learning-web-security-1-broken-access-control-owasp-top-10-1-beginner-s-guide?utm_source=hashnode&utm_medium=feed) [Mouhamed Ben Abdallah](https://hashnode.com/@erinmin) · [May 12](https://hashnode.com/posts/unprotected-admin-functionality/6a02f950937b84f77957c444) ### [Unprotected Admin Functionality](https://erinmin-writeups.hashnode.dev/unprotected-admin-functionality?utm_source=hashnode&utm_medium=feed) vertical privilege escalation broken access control vulnerability robots.txt security misconfiguration admin panel exposed without authentication 8 min read · [erinmin-writeups.hashnode.dev](https://erinmin-writeups.hashnode.dev/unprotected-admin-functionality?utm_source=hashnode&utm_medium=feed)