> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web.md). # Web Security - PortSwigger PortSwigger Web Security Academy notes for Burp Suite labs, web application vulnerabilities, exploitation workflows, payload validation, and BSCP preparation. PortSwigger Web Security Academy notes for practical web application security testing, Burp Suite workflows, vulnerability exploitation, payload validation, and BSCP preparation. ## Testing Workflow 1. Map the feature, request, parameter, cookie, header, browser sink, or API endpoint involved in the lab. 2. Reproduce the vulnerability in Burp Suite with the smallest payload that proves control. 3. Escalate only when the behavior is confirmed, keeping payloads and lab credentials exact. 4. Capture the exploitation path with concise notes: trigger, impact, final proof, and remediation context. ## Vulnerability Categories

:database:

SQL Injection

SQL injection, UNION attacks, blind SQLi, error-based SQLi, time-based SQLi, OOB exfiltration, and DBMS enumeration.SQL Injection

:code:

XSS

Cross-site scripting, reflected XSS, stored XSS, DOM XSS, CSP bypass, AngularJS sandbox escape, cookie theft, and credential capture.Cross-Site Scripting (XSS)

:repeat:

CSRF

Cross-site request forgery, SameSite bypass, token validation flaws, Referer validation bypass, and exploit server payloads.Cross-Site Request Forgery (CSRF)

:arrow-pointer:

Clickjacking

Clickjacking, UI redressing, iframe abuse, CSRF-assisted attacks, prefilled forms, and anti-frame bypass.Clickjacking

:code-branch:

DOM Vulnerabilities

DOM XSS, DOM clobbering, Web Messages, open redirects, cookie manipulation, sinks, and sources.DOM Vulnerabilities

:shuffle:

CORS

CORS misconfiguration, origin reflection, null origin trust, insecure protocols, and cross-origin credential theft.CORS

:file-code:

XXE

XML external entity injection, file read, SSRF via XXE, blind XXE, OOB exfiltration, local DTD reuse, and XInclude.XXE Injection

:server:

SSRF

Server-side request forgery, blind SSRF, blacklist bypass, whitelist bypass, internal service access, and Shellshock-based exfiltration.SSRF

:arrow-right-arrow-left:

HTTP Request Smuggling

HTTP request smuggling, CL.TE, TE.CL, HTTP/2 desync, front-end bypass, tunneling, and cache poisoning.HTTP Request Smuggling

:terminal:

Command Injection

OS command injection, blind command injection, time delays, output redirection, OOB detection, and command exfiltration.OS Command Injection

:brackets-curly:

SSTI

Server-side template injection, sandbox escape, template engine detection, documented exploits, custom payloads, and RCE.Server-Side Template Injection

:folder-tree:

Path Traversal

Path traversal, file read, traversal sequence bypass, URL decoding bypass, null byte tricks, and path validation weaknesses.Path Traversal

:user-lock:

Access Control

Broken access control, IDOR, privilege escalation, role manipulation, authorization bypass, and admin panel exposure.Access Control

:key:

Authentication

Authentication bypass, user enumeration, password reset flaws, 2FA bypass, brute force, session cookies, and account takeover.Authentication

:plug:

WebSockets

WebSocket testing, message manipulation, handshake abuse, cross-site WebSocket hijacking, and real-time application attacks.WebSockets

:face-woozy:

Web Cache Poisoning

Web cache poisoning, cache key injection, unkeyed headers, unkeyed cookies, parameter cloaking, and cache-based XSS.Web Cache Poisoning

:box-open:

Deserialization

Insecure deserialization, serialized object tampering, gadget chains, PHAR, Java, PHP, Ruby, and object injection.Insecure Deserialization

:eye:

Information Disclosure

Information disclosure, verbose errors, debug pages, backup files, exposed source code, and version control leaks.Information Disclosure

:lightbulb:

Business Logic

Business logic flaws, workflow bypass, client-side trust abuse, inconsistent controls, and application logic exploitation.Business Logic

:globe:

Host Header Attacks

Host header attacks, password reset poisoning, routing-based SSRF, cache poisoning, and ambiguous request handling.Host Header Attacks

:key:

OAuth Authentication

OAuth misconfiguration, implicit flow bypass, redirect_uri abuse, token theft, account hijacking, and OpenID SSRF.OAuth Authentication

:file-arrow-up:

File Upload

File upload bypass, web shell upload, race conditions, validation bypass, and server-side execution.File Upload

:id-card:

JWT Attacks

JWT authentication bypass, algorithm confusion, weak keys, JWK injection, JKU injection, kid path traversal, and signature validation flaws.JWT Attacks

:suitcase:

Essential Skills

Burp Suite workflow, targeted scanning, non-standard data analysis, browser testing, and PortSwigger lab methodology.Essential Skills

:code-branch:

Prototype Pollution

Prototype pollution, client-side DOM XSS, server-side prototype pollution, filter bypass, privilege escalation, and RCE.Prototype Pollution

:diagram-project:

GraphQL

GraphQL testing, introspection, private fields, CSRF, brute force bypass, cached endpoints, and IDOR.GraphQL

:stopwatch:

Race Conditions

Race conditions, single-packet attacks, rate-limit bypass, partial construction races, time-sensitive flaws, and Burp Repeater workflows.Race Conditions

:database:

NoSQL Injection

NoSQL injection, MongoDB operator injection, authentication bypass, hidden field extraction, and data exfiltration.NoSQL Injection

:plug:

API Testing

API testing, server-side parameter pollution, REST endpoint discovery, mass assignment, OpenAPI documentation abuse, and hidden API exploitation.API Testing

:brain:

LLM Web Attacks

Prompt injection, insecure LLM tool use, excessive agency, output handling flaws, and LLM API exploitation.LLM Web Attacks

:shield-halved:

Web Cache Deception

Web cache deception, path mapping quirks, cacheable private responses, delimiter abuse, and origin normalization issues.Web Cache Deception
\## Certification and Exam Preparation

:shield:

BSCP Certification Guide

BSCP Certification Practical Guide notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.BSCP and Practice Exams

:shield:

BSCP Practice Exam 1

BSCP Practice Exam 1 Writeup notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.BSCP Practice Exam 1 Writeup

:shield:

BSCP Practice Exam 2

BSCP Practice Exam 2 Writeup notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.BSCP Practice Exam 2 Writeup

:question:

PortSwigger Study Notes

Community BSCP study notes and exam preparation references.https://github.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study

:question:

BSCP Reference Repository

Additional BSCP study references and practice material.https://github.com/DingyShark/BurpSuiteCertifiedPractitioner
PortSwigger Web Security Academy and BSCP study reference
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/web.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.