Your password reset link: https://attacker[.]com/reset?token=0a1b2c... Why is the domain an attacker domain?! That can happen when an application uses the request’s Host header to build the reset URL. This was actually a vulnerability in older versions of WordPress! The email is genuine and the token is valid, but the domain is controlled by an attacker. If the victim opens the link, the token reaches the attacker’s server and can be used against the real reset endpoint. Try exploiting this vulnerability yourself in our labs 👇 portswigger.net/web-security…

In Burp Repeater, try changing the file’s Content-Type to image/jpeg. If a previously blocked upload is now accepted, the server may be trusting the multipart header instead of checking the file itself. That header is supplied by the client. Validation also needs to consider the filename, extension, actual contents, storage location, and whether the server can execute the uploaded file. Try it in the file upload labs 👇 portswigger.net/web-security…

Sometimes applications are vulnerable to CSRF even when they use CSRF tokens! This happens when the CSRF token isn't tied to the active session. If an application accepts any token from a global pool, an attacker can create one from their own account and craft a CSRF payload to force a victim to perform requests on their account, using the attacker's CSRF token. When testing for CSRF, you need to ask 2 questions: - Does the application use CSRF tokens? - Are the CSRF tokens tied to sessions? Try it out in the free labs 👇 portswigger.net/web-security…

You've found proto in input, here's what to do next 👇 To turn prototype pollution into impact, you need a source that adds a property, a gadget that inherits it, and a sink that uses it unsafely. That is why a polluted object is not automatically a reportable exploit. Use DOM Invader and the free labs to map the full chain 👇 portswigger.net/web-security…

Just like we have SQLi and blind SQLi, we also have XXE injection and blind XXE injection. Sometimes, you find a XXE injection that does not reflect the entity value in the response, but there are still ways to exfiltrate data. Learn here 👇 portswigger.net/web-security…

Sometimes, disabling the introspection is implemented as a regex against __schema keyword. A simple newline character can be enough to create a discrepancy between the filter and the parser. For GraphQL, whitespace is insignificant, but the regex will stop matching after that! Try it out in the lab 👇 portswigger.net/web-security…

When finding a GraphQL instance, make sure to check out the following paths 👇 /graphql /api /api/graphql /graphql/api /graphql/graphql Append /v1 if the first pass comes back empty. GraphQL services answer non-GraphQL requests with "Query not present" or similar. It means that we can start querying from there. Learn more here: portswigger.net/web-security…

In this lab walkthrough, we uploaded an SVG file with a nefarious XML payload inside to extract data. Follow along here 👇 portswigger.net/web-security…

We love a bit of competition here at the Web Security Academy, and that's why we have the Hall of Fame! We announce each of our labs on X, so don't miss out.

Absolutely incredible research by @garethheyes One email, two readers. :before and :after inject text into the page. An AI browser reading the message does not see that text. opacity:0.00000001 does the reverse. The victim cannot read the element, but the AI browser can. Read CSS:the bomb inside your inbox by Gareth to learn more 👇 portswigger.net/research/css…

Just because there's no XML in the body, doesn't mean it won't be parsed as XML! It's rare, but it happens. Learn more here 👇 portswigger.net/web-security…

Nothing makes us prouder than educating the world's next generation of hackers! Over the years we've: 👨‍💻 Released 247 free labs 👨‍💻 Served 90,000 up and coming hackers 👨‍💻 Ran an 18,000 strong Discord community 👨‍💻 Served hackers in 170 countries Hackers are more important than they've ever been. Keep at it 💪

In case you missed it, @albinowax did a talk at BlackHat titled "Can AI do novel security research? Meet the HTTP Terminator". Check out the writeup 👇 portswigger.net/research/can…

SQL injection is great, but what if you can't see the response? Enter Blind SQL Injection! In this walkthrough, we exfiltrate the administrator's password from the database from a blind SQLi using DNS 👀 Check it out, and follow along here (it's free) 👇 portswigger.net/web-security…

Hackers asked for a third edition of The Web Hacker’s Handbook. Rather than releasing another book which will quickly get out-dated, we created the Web Security Academy, a living, constantly updated learning hub with hands-on labs and video walk-throughs so you can learn by doing, not just reading. portswigger.net/web-security…

Getting a pingback on Burp Collaborator might just be the best feeling in the world.

Wheeeeeeee!

The thing about XSS, is that the correct payload varies wildly depending on exactly where the injection lands on the page. This video walks through one of our DOM XSS challenges, you can follow along in the free lab here 👇 portswigger.net/web-security…