Web Security Academy

@WebSecAcademy

Free web security training from @PortSwigger

portswigger.net/web-security

Joined April 2018

Web Security Academy
@WebSecAcademy
10h
Imagine you have a secure facility with a boom gate. - An authorized person can scan their card to open the boom gate. - The authorized person drives their car through the boom gate. - The boom gate closes. What happens if a second car tailgates quickly behind the first one?
Web Security Academy
@WebSecAcademy
Aug 13
Here's a quick SSTI demo 👇 The lab runs ERB. We can check the SSTI existence with this payload: <%= 7*7 %> That input evaluates to 49, which means the template engine runs our input as code. From there, we ran a system command. Sorry Carlos! Want to practice this technique?
00:00
Web Security Academy
@WebSecAcademy
Aug 13
SQL injection! 💉 After finding the number of columns using the NULL trick, you can take it a step further and identify which column takes which data type. Swap 'abc' into one position at a time. The one that comes back without an error is your string column, and that's where
00:00
Web Security Academy
@WebSecAcademy
Aug 13
’ ORDER BY 3-- causes an error. So we know the query selects 2 columns... Now what? 🤓 Here’s the process (PostgreSQL/Oracle syntax and on MySQL you’d reach for CONCAT/GROUP_CONCAT instead): 🟧 Inject ' UNION SELECT NULL,NULL-- to confirm both columns. 🟧 Swap a NULL for a
Web Security Academy
@WebSecAcademy
Aug 13
One problem with most hacker training platforms is that they tell you the answer. It sharpens your knowledge, but not your ability to discover an *unknown* vulnerability in the wild. That's why we introduced ✨MYSTERY LABS✨. It picks a random lab with the title and