Web Application Security Labs

This repository contains structured web application security assessments performed in deliberately vulnerable training environments.

The work started as practical notes from PortSwigger Web Security Academy labs. I rebuild those notes into focused reports that document the security question, testing approach, vulnerable behavior, evidence, impact, root cause, and remediation.

What this project covers

The current assessments focus on three areas:

• OAuth and authorization-flow security
• HTTP Host header trust and password-reset poisoning
• File-upload validation and server-side execution

The completed lab work includes:

• Authorization-code leakage through insufficient redirect_uri validation
• Basic password-reset poisoning through attacker-controlled host information
• Password-reset poisoning through X-Forwarded-Host
• Password-reset poisoning through dangling markup
• File-upload blacklist bypass through an uploaded Apache .htaccess file

Repository structure

00 — Scope and methodology

Testing scope, evidence handling, methodology, and limitations

01 — OAuth security

OAuth security overview

• Authorization code leakage through insufficient redirect URI validation

02 — HTTP Host header security

Host header trust and attack surface

• Testing methodology for Host header vulnerabilities
• Password reset poisoning overview
• Basic Host header poisoning
• Poisoning through X-Forwarded-Host
• Poisoning through dangling markup

03 — File upload security

File upload attack surface

• Extension blacklist bypass through Apache .htaccess

04 — Cross-cutting lessons

Security lessons that appear across the different vulnerability classes

Tools and techniques

The assessments primarily used:

• Burp Suite Proxy
• Burp Suite Repeater
• Browser-based workflow analysis
• HTTP request and response inspection
• Parameter and header manipulation
• Controlled attacker infrastructure provided by the training environment

Scope and ethics

All testing documented here was performed against deliberately vulnerable training environments intended for security education.

The techniques are documented for professional development, defensive understanding, and authorised security testing. They must not be used against systems without explicit permission.

See DISCLAIMER.md for the complete usage statement.

Attribution

The current lab scenarios were provided by PortSwigger Web Security Academy. The reports in this repository are my own rewritten notes, analysis, HTTP examples, and security conclusions.

See THIRD_PARTY_NOTICES.md for additional attribution.