https://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/1.+Reflected+XSS+into+HTML+context+with+nothing+encodedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/6.+DOM+XSS+in+jQuery+selector+sink+using+a+hashchange+eventhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/5.+DOM+XSS+in+jQuery+anchor+href+attribute+sink+using+location.search+sourcehttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/4.+DOM+XSS+in+innerHTML+sink+using+source+location.searchhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/3.+DOM+XSS+in+document.write+sink+using+source+location.searchhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/2.+Stored+XSS+into+HTML+context+with+nothing+encodedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/15.+Reflected+XSS+into+HTML+context+with+all+tags+blocked+except+custom+oneshttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/8.+Stored+XSS+into+anchor+href+attribute+with+double+quotes+HTML-encodedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/7.+Reflected+XSS+into+attribute+with+angle+brackets+HTML-encodedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/%F0%9F%91%BE+XSS+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/%F0%9F%9B%A1%EF%B8%8F+XSS+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/14.+Reflected+XSS+into+HTML+context+with+most+tags+and+attributes+blockedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/13.+Stored+DOM+XSShttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/11.+DOM+XSS+in+AngularJS+expression+with+angle+brackets+and+double+quotes+HTML-encodedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/10.+DOM+XSS+in+document.write+sink+using+source+location.search+inside+a+select+elementhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/9.+Reflected+XSS+into+a+JavaScript+string+with+angle+brackets+HTML+encodedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/12.+Reflected+DOM+XSShttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/20.+Stored+XSS+into+onclick+event+with+angle+brackets+and+double+quotes+HTML-encoded+and+single+quotes+and+backslash+escapedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/19.+Reflected+XSS+into+a+JavaScript+string+with+angle+brackets+and+double+quotes+HTML-encoded+and+single+quotes+escapedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/18.+Reflected+XSS+into+a+JavaScript+string+with+single+quote+and+backslash+escapedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/17.+Reflected+XSS+in+canonical+link+taghttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/16.+Reflected+XSS+with+some+SVG+markup+allowedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/24.+Exploiting+XSS+to+bypass+CSRF+defenseshttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/23.+Exploiting+cross-site+scripting+to+capture+passwordshttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/22.+Exploiting+cross-site+scripting+to+steal+cookieshttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/21.+Reflected+XSS+into+a+template+literal+with+angle+brackets%2C+single%2C+double+quotes%2C+backslash+and+backticks+Unicode-escapedhttps://notes.bersec.me/Web+Application+Attacks/DOM-based+vulnerabilities/Portswigger/5.+DOM-based+cookie+manipulationhttps://notes.bersec.me/Web+Application+Attacks/DOM-based+vulnerabilities/Portswigger/%F0%9F%9B%A1%EF%B8%8F+XSS+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/DOM-based+vulnerabilities/Portswigger/4.+DOM-based+open+redirectionhttps://notes.bersec.me/Web+Application+Attacks/DOM-based+vulnerabilities/Portswigger/3.+DOM+XSS+using+web+messages+and+JSON.parsehttps://notes.bersec.me/Web+Application+Attacks/DOM-based+vulnerabilities/Portswigger/2.+DOM+XSS+using+web+messages+and+a+JavaScript+URLhttps://notes.bersec.me/Web+Application+Attacks/DOM-based+vulnerabilities/Portswigger/1.++DOM+XSS+using+web+messageshttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/4.+Exploiting+insecure+output+handling+in+LLMshttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/3.+Indirect+prompt+injectionhttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/2.+Exploiting+vulnerabilities+in+LLM+APIshttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/1.+Exploiting+LLM+APIs+with+excessive+agencyhttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/%F0%9F%9B%A1%EF%B8%8F+LLM+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Web+Cache+Deception/Portswigger/%F0%9F%9B%A1%EF%B8%8F+WCD+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Web+Cache+Deception/Portswigger/%F0%9F%91%BE+WCD+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/Web+Cache+Deception/Portswigger/4.+Exploiting+cache+server+normalization+for+web+cache+deceptionhttps://notes.bersec.me/Web+Application+Attacks/Web+Cache+Deception/Portswigger/3.+Exploiting+origin+server+normalization+for+web+cache+deceptionhttps://notes.bersec.me/Web+Application+Attacks/Web+Cache+Deception/Portswigger/2.+Exploiting+path+delimiters+for+web+cache+deceptionhttps://notes.bersec.me/Web+Application+Attacks/Web+Cache+Deception/Portswigger/1.+Exploiting+path+mapping+for+web+cache+deceptionhttps://notes.bersec.me/Web+Application+Attacks/API+testing/Portswigger/4.+Exploiting+a+mass+assignment+vulnerabilityhttps://notes.bersec.me/Web+Application+Attacks/API+testing/Portswigger/3.+Finding+and+exploiting+an+unused+API+endpointhttps://notes.bersec.me/Web+Application+Attacks/API+testing/Portswigger/2.+Exploiting+server-side+parameter+pollution+in+a+query+stringhttps://notes.bersec.me/Web+Application+Attacks/API+testing/Portswigger/1.+Exploiting+an+API+endpoint+using+documentationhttps://notes.bersec.me/Web+Application+Attacks/API+testing/Portswigger/%F0%9F%9B%A1%EF%B8%8F+API+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/NoSQL+Injection/Portswigger/3.+Exploiting+NoSQL+injection+to+extract+datahttps://notes.bersec.me/Web+Application+Attacks/NoSQL+Injection/Portswigger/2.+Exploiting+NoSQL+operator+injection+to+bypass+authenticationhttps://notes.bersec.me/Web+Application+Attacks/NoSQL+Injection/Portswigger/%F0%9F%91%BE+XSS+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/NoSQL+Injection/Portswigger/%F0%9F%9B%A1%EF%B8%8F+XSS+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/NoSQL+Injection/Portswigger/1.+Detecting+NoSQL+injectionhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/18.+SQL+injection+with+filter+bypass+via+XML+encodinghttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/17.+Blind+SQL+injection+with+out-of-band+data+exfiltrationhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/16.+Blind+SQL+injection+with+out-of-band+interactionhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/15.+Blind+SQL+injection+with+time+delays+and+information+retrievalhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/11.+Blind+SQL+injection+with+conditional+responseshttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/14.+Blind+SQL+injection+with+time+delayshttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/%F0%9F%9B%A1%EF%B8%8F+SQLi+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/13.+Visible+error-based+SQL+injectionhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/12.+Blind+SQL+injection+with+conditional+errorshttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/10.+SQL+injection+UNION+attack%2C+retrieving+multiple+values+in+a+single+columnhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/9.+SQL+injection+UNION+attack%2C+retrieving+data+from+other+tableshttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/8.+SQL+injection+UNION+attack%2C+finding+a+column+containing+texthttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/7.+SQL+injection+UNION+attack%2C+determining+the+number+of+columns+returned+by+the+queryhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/6.+SQL+injection+attack%2C+listing+the+database+contents+on+Oraclehttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/5.+SQL+injection+attack%2C+listing+the+database+contents+on+non-Oracle+databaseshttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/4.+SQL+injection+attack%2C+querying+the+database+type+and+version+on+MySQL+and+Microsofthttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/3.+SQL+injection+attack%2C+querying+the+database+type+and+version+on+Oraclehttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/%F0%9F%91%BE+SQLi+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/2.+SQL+injection+vulnerability+allowing+login+bypasshttps://notes.bersec.me/Web+Application+Attacks/SQL+Injection/Portswigger/1.+SQL+injection+vulnerability+in+WHERE+clause+allowing+retrieval+of+hidden+datahttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/5.+CSRF+where+token+is+tied+to+non-session+cookiehttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/4.+CSRF+where+token+is+not+tied+to+user+sessionhttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/3.+CSRF+where+token+validation+depends+on+token+being+presenthttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/2.+CSRF+where+token+validation+depends+on+request+methodhttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/1.+CSRF+vulnerability+with+no+defenseshttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/%F0%9F%9B%A1%EF%B8%8F+CSRF+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/%F0%9F%91%BE+CSRF+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/Path+Traversal/Portswigger/6.+File+path+traversal%2C+validation+of+file+extension+with+null+byte+bypasshttps://notes.bersec.me/Web+Application+Attacks/Path+Traversal/Portswigger/4.+File+path+traversal%2C+traversal+sequences+stripped+with+superfluous+URL-decodehttps://notes.bersec.me/Web+Application+Attacks/Path+Traversal/Portswigger/3.+File+path+traversal%2C+traversal+sequences+stripped+non-recursivelyhttps://notes.bersec.me/Web+Application+Attacks/Path+Traversal/Portswigger/2.+File+path+traversal%2C+traversal+sequences+blocked+with+absolute+path+bypasshttps://notes.bersec.me/Web+Application+Attacks/Path+Traversal/Portswigger/%F0%9F%9B%A1%EF%B8%8F+Path+Traversal+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Path+Traversal/Portswigger/%F0%9F%91%BE+Path+Traversal+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/Path+Traversal/Portswigger/1.+File+path+traversal%2C+simple+casehttps://notes.bersec.me/Web+Application+Attacks/Path+Traversal/Portswigger/5.+File+path+traversal%2C+validation+of+start+of+pathhttps://notes.bersec.me/Web+Application+Attacks/Cross-origin+resource+sharing+(CORS)/Portswigger/%F0%9F%9B%A1%EF%B8%8F+CORS+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Cross-origin+resource+sharing+(CORS)/Portswigger/3.+CORS+vulnerability+with+trusted+insecure+protocolshttps://notes.bersec.me/Web+Application+Attacks/Cross-origin+resource+sharing+(CORS)/Portswigger/2.+CORS+vulnerability+with+trusted+null+originhttps://notes.bersec.me/Web+Application+Attacks/Cross-origin+resource+sharing+(CORS)/Portswigger/1.+CORS+vulnerability+with+basic+origin+reflectionhttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/12.+CSRF+with+broken+Referer+validationhttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/11.+CSRF+where+Referer+validation+depends+on+header+being+presenthttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/10.+SameSite+Lax+bypass+via+cookie+refreshhttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/9.+SameSite+Strict+bypass+via+sibling+domainhttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/8.+SameSite+Strict+bypass+via+client-side+redirecthttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/7.+SameSite+Lax+bypass+via+method+overridehttps://notes.bersec.me/Web+Application+Attacks/CSRF/Portswigger/6.+CSRF+where+token+is+duplicated+in+cookiehttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/9.+Exploiting+XXE+to+retrieve+data+by+repurposing+a+local+DTDhttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/8.+Exploiting+XXE+via+image+file+uploadhttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/7.+Exploiting+XInclude+to+retrieve+fileshttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/6.+Exploiting+blind+XXE+to+retrieve+data+via+error+messageshttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/5.+Exploiting+blind+XXE+to+exfiltrate+data+using+a+malicious+external+DTDhttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/4.+Blind+XXE+with+out-of-band+interaction+via+XML+parameter+entitieshttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/%F0%9F%9B%A1%EF%B8%8F+XML+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/%F0%9F%91%BE+XML+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/1.+Exploiting+XXE+using+external+entities+to+retrieve+fileshttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/2.+Exploiting+XXE+to+perform+SSRF+attackshttps://notes.bersec.me/Web+Application+Attacks/XML+external+entity+(XXE)+injection/PortSwigger/3.+Blind+XXE+with+out-of-band+interactionhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/7.+SSRF+with+whitelist-based+input+filterhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/6.+Blind+SSRF+with+Shellshock+exploitationhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/5.+SSRF+with+filter+bypass+via+open+redirection+vulnerabilityhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/4.+SSRF+with+blacklist-based+input+filterhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/3.+Blind+SSRF+with+out-of-band+detectionhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/%F0%9F%9B%A1%EF%B8%8F+SSRF+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/%F0%9F%91%BE+SSRF+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/2.+Basic+SSRF+against+another+back-end+systemhttps://notes.bersec.me/Web+Application+Attacks/SSRF/Portswigger/1.+Basic+SSRF+against+the+local+serverhttps://notes.bersec.me/Web+Application+Attacks/Command+Injection/PortSwigger/5.+Blind+OS+command+injection+with+out-of-band+data+exfiltrationhttps://notes.bersec.me/Web+Application+Attacks/Command+Injection/PortSwigger/4.+Blind+OS+command+injection+with+out-of-band+interactionhttps://notes.bersec.me/Web+Application+Attacks/Command+Injection/PortSwigger/3.+Blind+OS+command+injection+with+output+redirectionhttps://notes.bersec.me/Web+Application+Attacks/Command+Injection/PortSwigger/2.+Blind+OS+command+injection+with+time+delayshttps://notes.bersec.me/Web+Application+Attacks/Command+Injection/PortSwigger/1.+OS+command+injection%2C+simple+casehttps://notes.bersec.me/Web+Application+Attacks/Command+Injection/PortSwigger/%F0%9F%9B%A1%EF%B8%8F+Command+Injection+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Command+Injection/PortSwigger/%F0%9F%91%BE+Command+Injection+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/SSTI/PortSwigger/6.+Server-side+template+injection+in+a+sandboxed+environmenthttps://notes.bersec.me/Web+Application+Attacks/SSTI/PortSwigger/5.+Server-side+template+injection+with+information+disclosure+via+user-supplied+objectshttps://notes.bersec.me/Web+Application+Attacks/SSTI/PortSwigger/4.+Server-side+template+injection+in+an+unknown+language+with+a+documented+exploithttps://notes.bersec.me/Web+Application+Attacks/SSTI/PortSwigger/3.+Server-side+template+injection+using+documentationhttps://notes.bersec.me/Web+Application+Attacks/SSTI/PortSwigger/2.+Basic+server-side+template+injection+(code+context)https://notes.bersec.me/Web+Application+Attacks/SSTI/PortSwigger/1.+Basic+server-side+template+injectionhttps://notes.bersec.me/Web+Application+Attacks/SSTI/PortSwigger/%F0%9F%9B%A1%EF%B8%8F+SSTI+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/SSTI/PortSwigger/%F0%9F%91%BE+SSTI+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/13.+Referer-based+access+controlhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/12.+Multi-step+process+with+no+access+control+on+one+stephttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/11.+Method-based+access+control+can+be+circumventedhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/10.+URL-based+access+control+can+be+circumventedhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/9.+Insecure+direct+object+referenceshttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/8.+User+ID+controlled+by+request+parameter+with+password+disclosurehttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/7.+User+ID+controlled+by+request+parameter+with+data+leakage+in+redirecthttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/5.+User+ID+controlled+by+request+parameterhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/6.+User+ID+controlled+by+request+parameter%2C+with+unpredictable+user+IDshttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/4.+User+role+can+be+modified+in+user+profilehttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/3.+User+role+controlled+by+request+parameterhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/2.+Unprotected+admin+functionality+with+unpredictable+URLhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/1.+Unprotected+admin+functionalityhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/%F0%9F%9B%A1%EF%B8%8F+Access+Control+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Access+control+vulnerabilities/PortSwigger/%F0%9F%91%BE+Access+Control+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/12.+Password+brute-force+via+password+changehttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/11.+Password+reset+poisoning+via+middlewarehttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/9.+Brute-forcing+a+stay-logged-in+cookiehttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/8.+2FA+broken+logichttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/7.+Username+enumeration+via+account+lockhttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/%F0%9F%9B%A1%EF%B8%8F+Auth+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/6.+Broken+brute-force+protection%2C+IP+blockhttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/5.+Username+enumeration+via+response+timinghttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/10.+Offline+Password+Crackinghttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/4.+Username+enumeration+via+subtly+different+responseshttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/2.+2FA+simple+bypasshttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/3.+Password+reset+broken+logichttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/1.+Username+enumeration+via+different+responseshttps://notes.bersec.me/Web+Application+Attacks/JWT+Attacks/PortSwigger/%F0%9F%9B%A1%EF%B8%8F+JWT+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/JWT+Attacks/PortSwigger/4.JWT+authentication+bypass+via+jwk+header+injectionhttps://notes.bersec.me/Web+Application+Attacks/JWT+Attacks/PortSwigger/3.+JWT+authentication+bypass+via+weak+signing+keyhttps://notes.bersec.me/Web+Application+Attacks/JWT+Attacks/PortSwigger/2.+JWT+authentication+bypass+via+flawed+signature+verificationhttps://notes.bersec.me/Web+Application+Attacks/JWT+Attacks/PortSwigger/1.+JWT+authentication+bypass+via+unverified+signaturehttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/%F0%9F%91%BE+File+Upload+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/7.+Web+shell+upload+via+race+conditionhttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/6.+Remote+code+execution+via+polyglot+web+shell+uploadhttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/5.+Web+shell+upload+via+obfuscated+file+extensionhttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/4.+Web+shell+upload+via+extension+blacklist+bypasshttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/3.+Web+shell+upload+via+path+traversalhttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/2.+Web+shell+upload+via+Content-Type+restriction+bypasshttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/%F0%9F%9B%A1%EF%B8%8F+File+Upload+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/FIle+Upload+Vulnerabilities/Portswigger/1.+Remote+code+execution+via+web+shell+uploadhttps://notes.bersec.me/Web+Application+Attacks/HTTP+Host+Header+Attacks/Portswigger/7.+Password+reset+poisoning+via+dangling+markuphttps://notes.bersec.me/Web+Application+Attacks/HTTP+Host+Header+Attacks/Portswigger/6.+Host+validation+bypass+via+connection+state+attackhttps://notes.bersec.me/Web+Application+Attacks/HTTP+Host+Header+Attacks/Portswigger/5.+SSRF+via+flawed+request+parsinghttps://notes.bersec.me/Web+Application+Attacks/HTTP+Host+Header+Attacks/Portswigger/4.+Routing-based+SSRFhttps://notes.bersec.me/Web+Application+Attacks/HTTP+Host+Header+Attacks/Portswigger/3.+Web+cache+poisoning+via+ambiguous+requestshttps://notes.bersec.me/Web+Application+Attacks/HTTP+Host+Header+Attacks/Portswigger/2.+Host+header+authentication+bypasshttps://notes.bersec.me/Web+Application+Attacks/HTTP+Host+Header+Attacks/Portswigger/1.+Basic+password+reset+poisoninghttps://notes.bersec.me/Web+Application+Attacks/HTTP+Host+Header+Attacks/Portswigger/%F0%9F%91%BE+Host+Header+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/WebSockets/Portswigger/3.+Manipulating+the+WebSocket+handshake+to+exploit+vulnerabilitieshttps://notes.bersec.me/Web+Application+Attacks/WebSockets/Portswigger/%F0%9F%9B%A1%EF%B8%8F+WebSocket+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/WebSockets/Portswigger/2.+Cross-site+WebSocket+hijackinghttps://notes.bersec.me/Web+Application+Attacks/WebSockets/Portswigger/1.+Manipulating+WebSocket+messages+to+exploit+vulnerabilitieshttps://notes.bersec.me/Web+Application+Attacks/Information+Disclosure/Portswigger/5.+Information+disclosure+in+version+control+historyhttps://notes.bersec.me/Web+Application+Attacks/Information+Disclosure/Portswigger/4.+Authentication+bypass+via+information+disclosurehttps://notes.bersec.me/Web+Application+Attacks/Information+Disclosure/Portswigger/3.+Source+code+disclosure+via+backup+fileshttps://notes.bersec.me/Web+Application+Attacks/Information+Disclosure/Portswigger/%F0%9F%9B%A1%EF%B8%8F+Information+Disclosure+Lab+Index+1https://notes.bersec.me/Web+Application+Attacks/Information+Disclosure/Portswigger/2.+Information+disclosure+on+debug+pagehttps://notes.bersec.me/Web+Application+Attacks/Information+Disclosure/Portswigger/1.+Information+disclosure+in+error+messageshttps://notes.bersec.me/Web+Application+Attacks/OAuth/Portswigger/6.+Stealing+OAuth+access+tokens+via+a+proxy+pagehttps://notes.bersec.me/Web+Application+Attacks/OAuth/Portswigger/5.+Stealing+OAuth+access+tokens+via+an+open+redirecthttps://notes.bersec.me/Web+Application+Attacks/OAuth/Portswigger/4.+OAuth+account+hijacking+via+redirect_urihttps://notes.bersec.me/Web+Application+Attacks/OAuth/Portswigger/%F0%9F%9B%A1%EF%B8%8F+OAuth+Traversal+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/OAuth/Portswigger/3.+Forced+OAuth+profile+linkinghttps://notes.bersec.me/Web+Application+Attacks/OAuth/Portswigger/2.+SSRF+via+OpenID+dynamic+client+registrationhttps://notes.bersec.me/Web+Application+Attacks/OAuth/Portswigger/1.+Authentication+bypass+via+OAuth+implicit+flowhttps://notes.bersec.me/Web+Application+Attacks/Web+Cache+Deception/Portswigger/5.+Exploiting+exact-match+cache+rules+for+web+cache+deceptionhttps://notes.bersec.me/Web+Application+Attacks/API+testing/Portswigger/5.+Exploiting+server-side+parameter+pollution+in+a+REST+URLhttps://notes.bersec.me/Web+Application+Attacks/NoSQL+Injection/Portswigger/4.+Exploiting+NoSQL+operator+injection+to+extract+unknown+fieldshttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/%F0%9F%91%BE+Prototype+Pollution+Payload+Compendiumhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/%F0%9F%9B%A1%EF%B8%8F+Prototype+Pollution+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/10.+Exfiltrating+sensitive+data+via+server-side+prototype+pollutionhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/9.+Remote+code+execution+via+server-side+prototype+pollutionhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/8.+Bypassing+flawed+input+filters+for+server-side+prototype+pollutionhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/7.+Detecting+server-side+prototype+pollution+without+polluted+property+reflectionhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/6.+Privilege+escalation+via+server-side+prototype+pollutionhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/5.+Client-side+prototype+pollution+in+third-party+librarieshttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/4.+Client-side+prototype+pollution+via+flawed+sanitizationhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/3.+DOM+XSS+via+an+alternative+prototype+pollution+vectorhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/2.+DOM+XSS+via+client-side+prototype+pollutionhttps://notes.bersec.me/Web+Application+Attacks/Prototype+Pollution/Portswigger/1.++Client-side+prototype+pollution+via+browser+APIshttps://notes.bersec.me/Web+Application+Attacks/Race+Conditions/Portswigger/5.+Exploiting+time-sensitive+vulnerabilitieshttps://notes.bersec.me/Web+Application+Attacks/Race+Conditions/Portswigger/6.+Partial+construction+race+conditionshttps://notes.bersec.me/Web+Application+Attacks/Race+Conditions/Portswigger/%F0%9F%9B%A1%EF%B8%8F+Race+Conditions+Lab+Indexhttps://notes.bersec.me/Web+Application+Attacks/Race+Conditions/Portswigger/3.+Multi-endpoint+race+conditionshttps://notes.bersec.me/Web+Application+Attacks/Race+Conditions/Portswigger/4.+Single-endpoint+race+conditionshttps://notes.bersec.me/Web+Application+Attacks/Race+Conditions/Portswigger/2.+Bypassing+rate+limits+via+race+conditionshttps://notes.bersec.me/Web+Application+Attacks/Race+Conditions/Portswigger/1.+Limit+overrun+race+conditionshttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/14.+2FA+bypass+using+a+brute-force+attackhttps://notes.bersec.me/Web+Application+Attacks/Authentication/PortSwigger/13.+Broken+brute-force+protection%2C+multiple+credentials+per+requesthttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/28.+Reflected+XSS+in+a+JavaScript+URL+with+some+characters+blockedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/30.+Reflected+XSS+protected+by+CSP%2C+with+CSP+bypasshttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/29.+Reflected+XSS+protected+by+very+strict+CSP%2C+with+dangling+markup+attackhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/27.+Reflected+XSS+with+event+handlers+and+href+attributes+blockedhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/26.+Reflected+XSS+with+AngularJS+sandbox+escape+and+CSPhttps://notes.bersec.me/Web+Application+Attacks/XSS/PortSwigger/25.+Reflected+XSS+with+AngularJS+sandbox+escape+without+stringshttps://notes.bersec.me/Web+Application+Attacks/DOM-based+vulnerabilities/Portswigger/7.+Clobbering+DOM+attributes+to+bypass+HTML+filtershttps://notes.bersec.me/Web+Application+Attacks/DOM-based+vulnerabilities/Portswigger/6.+Exploiting+DOM+clobbering+to+enable+XSShttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/5.+Exploiting+AI+agents+to+perform+destructive+actionshttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/6.+Exploiting+AI+agents+to+exfiltrate+sensitive+informationhttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/8.+Bypassing+AI+scanner+defenses+to+exfiltrate+sensitive+informationhttps://notes.bersec.me/Web+Application+Attacks/WEB+LLM+Attacks/Portswigger/7.+Exploiting+AI+agents+to+trigger+secondary+vulnerabilities