Welcome to my PortSwigger Web Security Academy solutions repository. This project contains solutions to various labs provided by the academy, categorized by topics. As I progress through each topic, I will update this repository with detailed steps and solutions for each lab.
Below is a list of server-side topics. Click on each topic to view the labs. Solutions to the labs can be found by navigating to the respective folder in this repository.
Server-side topics
- SQL Injection
- Authentication (Coming soon)
- Path Traversal (Coming soon)
- Command Injection (Coming soon)
- Business Logic Vulnerabilities (Coming soon)
- Information Disclosure (Coming soon)
- Access Control (Coming soon)
- File Upload Vulnerabilities (Coming soon)
- Race Conditions (Coming soon)
- Server-Side Request Forgery (SSRF) (Coming soon)
- XXE Injection (Coming soon)
- NoSQL Injection (Coming soon)
- API Testing (Coming soon)
- Web Cache Deception (Coming soon)
SQL Injection is a powerful vulnerability that can allow attackers to manipulate a database, bypass authentication, and even gain full control over the application. Below are the SQL injection labs, and you can click on each lab to go to its solution folder.
Click to expand SQL Injection Labs
- Lab 1: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data - Solved
- Lab 2: SQL injection vulnerability allowing login bypass - Solved
- Lab 3: SQL injection attack, querying the database type and version on Oracle - Solved
- Lab 4: SQL injection attack, querying the database type and version on MySQL and Microsoft - Solved
- Lab 5: SQL injection attack, listing the database contents on non-Oracle databases - Solved
- Lab 6: SQL injection attack, listing the database contents on Oracle - Solved
- Lab 7: SQL injection UNION attack, determining the number of columns returned by the query - Solved
- Lab 8: SQL injection UNION attack, finding a column containing text - Solved
- Lab 9: SQL injection UNION attack, retrieving data from other tables - Solved
- Lab 10: SQL injection UNION attack, retrieving multiple values in a single column - Solved
- Lab 11: Blind SQL injection with conditional responses - Solved
- Lab 12: Blind SQL injection with conditional errors - Solved
- Lab 13: Visible error-based SQL injection - Solved
- Lab 14: Blind SQL injection with time delays - Solved
- Lab 15: Blind SQL injection with time delays and information retrieval - Solved
- Lab 16: Blind SQL injection with out-of-band interaction - Not Solved
- Lab 17: Blind SQL injection with out-of-band data exfiltration - Not Solved
- Lab 18: SQL injection with filter bypass via XML encoding - Not Solved
- Clone the repository to your local machine:
git clone https://github.com/at0m-b0mb/Portswigger-Web-Security-Academy.git
For more information about all the labs, visit the PortSwigger Labs.