A structured, in-depth collection of hands-on writeups covering the PortSwigger Web Security Academy labs.
Each topic dives deep into the vulnerability concept, exploitation techniques, real-world implications, and defensive mitigations.
Built for aspiring penetration testers, bug bounty hunters, and security engineers who want to go beyond surface-level understanding.
This repository is a personal knowledge base and structured learning journal documenting my journey through the PortSwigger Web Security Academy — the most comprehensive and well-respected free platform for mastering web application security.
Unlike typical CTF writeups, these notes are designed to be reference material: thorough enough that you can revisit them months later and fully reconstruct your understanding of the vulnerability, the exploitation path, and the fix. Each topic is broken down into clearly structured sections that mirror how real-world penetration testers approach a vulnerability class.
Whether you are preparing for BSCP (Burp Suite Certified Practitioner), OSCP, eWPT, or simply leveling up your web security skills, this repo will serve as a reliable companion.
| # | Topic | Vulnerability Class | Difficulty |
|---|---|---|---|
| 01 | SQL Injection (SQLi) | Injection | 🟢 Beginner → 🔴 Advanced |
| 02 | Cross-Site Scripting (XSS) | Client-Side | 🟢 Beginner → 🔴 Advanced |
| 03 | CSRF / XSRF | Client-Side | 🟡 Intermediate |
| 04 | Clickjacking | Client-Side | 🟢 Beginner → 🟡 Intermediate |
| 05 | CORS | Access Control | 🟡 Intermediate |
| 06 | XXE Injection | Injection | 🟡 Intermediate → 🔴 Advanced |
| 07 | SSRF | Server-Side | 🟡 Intermediate → 🔴 Advanced |
| 08 | HTTP Request Smuggling | Protocol-Level | 🔴 Advanced |
| 09 | OS Command Injection | Injection | 🟡 Intermediate |
| 10 | SSTI | Injection / RCE | 🔴 Advanced |
| 11 | Path Traversal | File System | 🟢 Beginner → 🟡 Intermediate |
| 12 | Access Control Vulnerabilities | Authorization | 🟡 Intermediate → 🔴 Advanced |
SQL Injection remains one of the most critical and prevalent vulnerabilities in web applications. It occurs when user-supplied input is incorporated into SQL queries without proper sanitization, allowing attackers to manipulate the query logic. Exploitation can lead to unauthorized data extraction, authentication bypass, data manipulation, and in some cases, full operating system compromise via features like xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL).
Key subtypes covered: In-band (Union-based, Error-based), Blind (Boolean-based, Time-based), Out-of-band.
XSS enables attackers to inject malicious client-side scripts into pages viewed by other users. It is a gateway to session hijacking, credential theft, keylogging, defacement, and phishing. The three main variants — Reflected, Stored, and DOM-based — each require distinct detection and exploitation strategies, especially in modern applications with complex JavaScript frameworks.
Key subtypes covered: Reflected XSS, Stored XSS, DOM-based XSS, XSS via CSP bypass.
CSRF exploits the trust a web application places in an authenticated user's browser. By crafting malicious requests that the victim's browser automatically includes credentials for, attackers can perform actions on behalf of the victim — from changing email addresses and passwords to initiating financial transactions — all without the victim's knowledge.
Key subtypes covered: Token bypass techniques, SameSite cookie abuse, Referer-based defenses.
Clickjacking (UI Redressing) tricks users into interacting with a hidden or disguised interface element by overlaying a transparent <iframe> containing a legitimate page over a decoy UI. The victim believes they are clicking on something harmless, but are actually performing sensitive actions on the target site.
Key subtypes covered: Basic clickjacking, multistep attacks, drag-and-drop attacks, DOM-based clickjacking.
Misconfigured CORS policies can expose sensitive data to unauthorized origins. When servers blindly trust the Origin header or use wildcards alongside credentials, attackers can craft malicious pages that exfiltrate authenticated API responses from victim users. CORS misconfigurations are especially dangerous in single-page applications with JWT-based auth.
Key subtypes covered: Wildcard misuse, reflected origin vulnerabilities, null origin exploitation, internal network CORS attacks.
XXE vulnerabilities arise when XML parsers process external entity references in user-supplied XML data. Depending on the parser configuration, attackers can read arbitrary server-side files (like /etc/passwd), perform blind SSRF, exfiltrate data via out-of-band channels, or cause denial of service via the "Billion Laughs" attack.
Key subtypes covered: Classic XXE, blind XXE (OOB via DNS/HTTP), XXE via file upload, XXE in SOAP and SVG.
SSRF allows attackers to induce the server-side application to make HTTP requests to an arbitrary domain or internal IP. This can be used to scan internal networks, access cloud metadata endpoints (AWS/GCP/Azure), bypass IP-based access controls, and in advanced cases, achieve RCE by chaining SSRF with other vulnerabilities.
Key subtypes covered: Basic SSRF, blind SSRF, SSRF via redirect, filter bypass techniques (IP obfuscation, alternative schemes).
HTTP Request Smuggling exploits ambiguities in how front-end (reverse proxy/load balancer) and back-end servers interpret the boundaries of HTTP requests — specifically around Content-Length and Transfer-Encoding headers. This can allow attackers to poison the back-end TCP socket, bypass security controls, steal other users' requests, or achieve RCE indirectly.
Key subtypes covered: CL.TE, TE.CL, TE.TE variants; client-side desync; response queue poisoning.
OS Command Injection occurs when an application passes unsafe user data to a system shell. Attackers can execute arbitrary operating system commands with the permissions of the web server, potentially gaining full control of the underlying host. Even blind variants, where there is no visible output, can be exploited through time delays or out-of-band DNS/HTTP callbacks.
Key subtypes covered: In-band injection, blind time-based, blind OOB (DNS exfiltration), filter bypass using shell metacharacters.
SSTI occurs when user input is embedded into template strings that are evaluated server-side. Depending on the template engine in use (Jinja2, Twig, Freemarker, etc.), attackers can escape the template context and execute arbitrary code on the server — making SSTI effectively a Remote Code Execution vulnerability in many cases.
Key subtypes covered: Detection methodology, engine fingerprinting, sandbox escape, RCE via Jinja2/Twig/FreeMarker/Tornado.
Path traversal vulnerabilities allow attackers to read files from the server's file system outside the intended web root by manipulating file path parameters with sequences like ../. Sensitive files such as configuration files, source code, credentials, and private keys can be exposed. Defenses like URL encoding and canonicalization must be properly implemented to prevent bypass.
Key subtypes covered: Simple traversal, encoded traversal (%2e%2e%2f), null byte bypass, superfluous path sequences.
Access control flaws (Broken Access Control) occur when an application does not properly enforce restrictions on what authenticated — or unauthenticated — users are allowed to do. This encompasses vertical privilege escalation (accessing admin functions), horizontal privilege escalation (accessing other users' data), and IDOR (Insecure Direct Object References). It is consistently ranked as one of the OWASP Top 10 most critical risks.
Key subtypes covered: Vertical privilege escalation, horizontal escalation, IDOR, unprotected admin functionality, parameter-based and referer-based access control.
| Tool | Purpose |
|---|---|
| Burp Suite Pro | Primary proxy — intercept, repeat, and fuzz HTTP requests |
| Burp Collaborator | Out-of-band interaction detection for blind vulnerabilities |
| SQLMap | Automated SQL injection detection and exploitation |
| ffuf / dirb | Directory and parameter fuzzing |
Python / requests |
Custom exploit scripting |
| Browser DevTools | DOM analysis, cookie inspection, CSP review |
| CyberChef | Encoding/decoding payloads |
| Interactsh | Self-hosted OOB interaction server (SSRF, XXE) |
If you are new to web security, follow the topics in numerical order — they are sequenced from foundational to complex. Here is a suggested progression:
SQLi → XSS → CSRF → Clickjacking → CORS → XXE → SSRF → OS Command Injection → Path Traversal → Access Control → SSTI → HTTP Request Smuggling
Each topic builds conceptual depth. Understanding injection fundamentals (SQLi, OS Command) makes SSTI much easier to grasp. Understanding how browsers handle origins (SOP) is essential for XSS, CSRF, and CORS.
Every writeup in this repository follows a consistent format designed for maximum clarity and reproducibility:
- 🎯 Vulnerability Overview — What the vulnerability is, why it exists, and where it appears in the OWASP Top 10 / CWE taxonomy
- 🔬 Lab Walkthrough — Step-by-step methodology with annotated screenshots and payload breakdowns
- 🧠 Conceptual Deep-Dive — The underlying mechanics that make the exploit work
- 🛠️ Tools & Payloads — All tools, scripts, and payload templates used
- ⚡ Tips & Tricks — Edge cases, filter bypass techniques, and advanced variations
- 🔒 Remediation — Developer-focused defensive guidance and secure coding patterns
| Category | Labs Documented |
|---|---|
| SQL Injection | ✅ Completed |
| XSS | ✅ Completed |
| CSRF | ✅ Completed |
| Clickjacking | ✅ Completed |
| CORS | ✅ Completed |
| XXE | ✅ Completed |
| SSRF | ✅ Completed |
| HTTP Request Smuggling | ✅ Completed |
| OS Command Injection | ✅ Completed |
| SSTI | ✅ Completed |
| Path Traversal | ✅ Completed |
| Access Control | ✅ Completed |
If you want to supplement these writeups, here are some highly recommended external resources:
- 🌐 PortSwigger Web Security Academy — The primary source material
- 📘 OWASP Top 10 — Industry-standard vulnerability classification
- 📗 HackTricks — Comprehensive offensive security reference
- 🎥 IppSec — Deep HackTheBox walkthroughs (great for technique transfer)
- 🧪 PentesterLab — Complementary hands-on web security labs
- 📜 PayloadsAllTheThings — Payload repository for all major vulnerability classes
All content in this repository is strictly for educational purposes.
These techniques should only be practiced in authorized environments such as PortSwigger Academy labs, HackTheBox, TryHackMe, or your own test infrastructure.
Never apply these techniques against systems you do not own or have explicit written permission to test.
Unauthorized testing is a criminal offense in most jurisdictions.
The author assumes no responsibility for any misuse of the information provided here.
Made with 🔐 by a security enthusiast | PortSwigger Web Security Academy
"The more you know about how systems break, the better you can build systems that don't."