Writeups of All Apprentice Labs in Portswigger — All Lab’s Solution| Karthikeyan Nagaraj

The Blog Contains a series of all writeups of Apprentice labs in Portswigger with an Explanation of Each Vulnerability. Labs are solved with and Without using Burpsuite | 2023

Serer Side Topics

1. SQL Injection

Understanding of SQL Injection and Types of SQL Injection

1.1 Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data — 1 | 2023

1.2 Lab: SQL injection vulnerability allowing login bypass — 2 | 2023

2. Authentication

Understanding How to Find and Exploit Authentication Vulnerabilities in Web Applications | 2023

2.1 Lab: Username enumeration via different responses — 3 | 2023

2.2 Lab: 2FA simple bypass using Burpsuite— 2023

2.3 Lab: Password reset broken logic using Burpsuite | 2023

3. Path Traversal

Basic Understanding of Directory Traversal | 2023

Directory Traversal in Web App Penetration Testing | 2023

3.1 Lab: File path traversal, simple case | 2023

4. Command Injection

Command Injection in Web App Penetration Testing: Exploring Vulnerabilities and Best Practices |…

OS Command Injection in Web App Penetration Testing | 2023

4.1 Lab: OS command injection, simple case | 2023

5. Business Logic Vulnerabilities

Business Logic Vulnerability in Web App Penetration Testing | 2023

Understanding and Exploiting Business Logic Vulnerability in Web App Penetration Testing | 2023

5.1 Lab: Excessive trust in client-side controls | 2023

5.2 Lab: High-level logic vulnerability | 2023

5.3 Lab: Inconsistent security controls | 2023

5.4 Lab: Flawed enforcement of business rules | 2023

6. Information Disclosure

Basics of Information Disclosure Vulnerability in Web App Penetration Testing | 2023

How to Find Information Disclosure Vulnerability in Web App Penetration Testing | 2023

How to Find Information Disclosure Vulnerability in Web App Penetration Testing | 2023

6.1 Lab: Information disclosure in error messages | 2023

6.2 Lab: Information disclosure on debug page | 2023

6.3 Lab: Source code disclosure via backup files | 2023

6.4 Lab: Authentication bypass via information disclosure | 2023

7. Access Control

Understanding Access Control Vulnerability in Web App Penetration Testing | 2023

7.1 Lab: Unprotected admin functionality | 2023

7.2 Lab: Unprotected admin functionality with unpredictable URL | 2023

7.3 Lab: User role controlled by request parameter | 2023

7.4 Lab: User role can be modified in user profile | 2023

8. File Upload Vulnerabilities

Understanding File Upload Vulnerabilities in Web App Penetration Testing

8.1 Lab: Remote code execution via web shell upload | 2023

8.2 Lab: Web shell upload via Content-Type restriction bypass | 2023

9. Race Conditions

Understanding Race Conditions Vulnerabilities in Web App Penetration Testing | 2023

Limit Overrun Race Conditions in Web App Penetration Testing | 2023

9.1 Lab: Limit overrun Race conditions | 2023

10. SSRF — Server-Side Request Forgery

Server-side request forgery (SSRF) in Web App Penetration Testing | 2023

Understanding Server-side Request Forgery (SSRF) in Web App Penetration Testing — 2

10.1 Lab: Basic SSRF against the local server | 2023

10.2 Lab: Basic SSRF against another back-end system | 2023

11. XXE Injection — XML External Entity Injection

XML External Entity (XXE) Injection in Web App Penetration Testing | 2023

11.1 Lab: Exploiting XXE using external entities to retrieve files | 2023

11.2 Lab: Exploiting XXE to perform SSRF attacks | 2023

12. NOSQL Injection

NoSQL in Web App Penetration Testing by Portswigger | 2023

12.1 Lab: Detecting NoSQL injection | 2023

12.2 Lab: Exploiting NoSQL operator injection to bypass authentication | 2023

Client-Side Topics

13. XSS — Cross Site Scripting

Cross-Site Scripting (XSS) in Web App Penetration Testing | 2023

XSS and its Types in Web App Penetration Testing | 2023

13.1 Lab: Reflected XSS into HTML context with nothing encoded | 2023

13.2 Lab: Stored XSS into HTML context with nothing encoded | 2023

13.3 Lab: DOM XSS in document.write sink using source location.search | 2023

13.4 Lab: DOM XSS in innerHTML sink using source location.search | 2023

13.5 Lab: DOM XSS in jQuery anchor href attribute sink using location.search source | 2023

13.6 Lab: DOM XSS in jQuery selector sink using a hashchange event | 2023

13.7 Lab: Reflected XSS into attribute with angle brackets HTML-encoded | 2023

13.8 Lab: Stored XSS into anchor href attribute with double quotes HTML-encoded | 2023

13.9 Lab: Reflected XSS into a JavaScript string with angle brackets HTML encoded | 2023

14. CSRF — Cross-Site Request Forgery

Cross-site request forgery (CSRF) in Web App Penetration Testing | 2023

14.1 Lab: CSRF vulnerability with no defenses | 2023

15. CORS — Cross-Origin Resource Sharing

Cross-origin resource sharing (CORS) in Web App Penetration Testing | 2023

15.1 Lab: CORS vulnerability with basic origin reflection | 2023

16. Clickjacking

Clickjacking in Web App Penetration Testing | 2023

What is Clickjacking and How to Find it in Web Application

16.1 Lab: Basic clickjacking with CSRF token protection | 2023

16.2 Lab: Clickjacking with form input data prefilled from a URL parameter | 2023

16.3 Lab: Clickjacking with a frame buster script | 2023

17. Websockets

Web Sockets in Web App Penetration Testing | 2023

17.1 Lab: Manipulating WebSocket messages to exploit vulnerabilities 2023

Advanced Topics

18. Insecure Deserialization

What is Insecure deserialization?

18.1 Lab: Modifying serialized objects | 2023

19. GrapQL Vulnerabilities

GraphQL API Vulnerabilities in Web App Penetration Testing | 2023

19.1 Lab: Accessing private GraphQL posts | 2023

20. HTTP Host Header Attacks

HTTP Host Header Attacks in Web App Penetration Testing | 2023

Host HTTP Header Attacks: Safeguarding Against Vulnerabilities | 2023

20.1 Lab: Basic password reset poisoning | 2023

20.2 Lab: Host header authentication bypass | 2023

21. OAuth Vulnerabilities

OAuth 2.0 Authentication Vulnerabilities in Web App Penetration Testing | 2023

21.1 Lab: Authentication bypass via OAuth implicit flow | 2023

22. JWT Attacks

JWT attack vulnerabilities in Web App Penetration Testing | 2023

22.1 Lab: JWT authentication bypass via unverified signature | 2023

22.2 Lab: JWT authentication bypass via flawed signature verification | 2023

23.1 Lab: CORS vulnerability with trusted null origin | 2023

23. CORS and Access Control

23.1 Lab: CORS vulnerability with trusted null origin | 2023

23.2 Lab: User ID controlled by request parameter | 2023

23.3 Lab: User ID controlled by request parameter, with unpredictable user IDs | 2023

If you would like to support me so that I can create more free content — https://www.buymeacoffee.com/cyberw1ng

Thank you for Reading!

Happy Hacking ~

Author: Karthikeyan Nagaraj ~ Cyberw1ng

Telegram Channel for Ethical Hacking Dumps — https://t.me/ethicalhackingessentials