TJCHacking

Web Security Academy | SQLi | 1 - Retrieve Hidden Data

Web Security Academy | SQLi | 2 - Login Bypass

Web Security Academy | SQLi | 3 - Determine Number of Columns

Web Security Academy | SQLi | 4 - Find Column Containing Text

Web Security Academy | SQLi | 5 - Retrieve Data from other Tables

Web Security Academy | SQLi | 6 - Retrieve Multiple Values in a Single Column

Web Security Academy | SQLi | 7 - Querying Database Version Oracle

Web Security Academy | SQLi | 8 - Querying Database Version MySQL Microsoft

Web Security Academy | SQLi | 9 - Listing Database Contents Non-Oracle

Web Security Academy | SQLi | 10 - Listing Database Contents Oracle

Web Security Academy | SQLi | 11 - Conditional Responses

Web Security Academy | SQLi | 12 - Conditional Errors

Web Security Academy | XXE | 2 - Exploiting XXE to Perform SSRF Attacks

Web Security Academy | Information Disclosure | 3 - Source Code Disclosure Via Backup Files

Web Security Academy | File Upload | 7 - Web Shell Upload Via Race Condition

Web Security Academy | File Upload | 1 - Remote Code Execution Via Web Shell Upload

Web Security Academy | Prototype Pollution | 4 - Client-Side Prototype Pollution Third-Party Library

Web Security Academy | File Upload | 6 - Remote Code Execution Via Polyglot Web Shell Upload

Web Security Academy | Sqli | Visible Error-Based Sql Injection

Web Security Academy | OS Command Injection | 1 - Simple

Web Security Academy | SSTI | 2 - Server-Side Template Injection in Code Context

Web Security Academy | Websockets | 3 - Cross-Site Websocket Hijacking

Web Security Academy | Websockets | 1 - Manipulating Websocket Messages To Exploit Vulnerabilities

Web Security Academy | Authentication | 14 - 2Fa Bypass Using A Brute-Force Attack

Web Security Academy | Access Control | 1 - Unprotected Admin Functionality

Web Security Academy | File Upload | 2 - Web Shell Upload Via Content-Type Restriction Bypass

Web Security Academy | Insecure Deserialization | 4 - Arbitrary Object Injection In PHP

Web Security Academy | XSS | 12 - Reflected DOM XSS

Web Security Academy | File Upload | 4 - Web Shell Upload Via Extension Blacklist Bypass

Web Security Academy | File Upload | 5 - Web Shell Upload Via Obfuscated File Extension

Web Security Academy | Web Cache Poisoning | 7 - Parameter Cloaking

Web Security Academy | Prototype Pollution | 9 - Remote Code Execution Via Server-Side Prototype

Portswigger's Web Security Academy Mystery Challenges

Web Security Academy | Web Cache Poisoning | 5 - Web Cache Poisoning Via An Unkeyed Query String

Web Security Academy | Insecure Deserialization | 5 - Exploiting Java Deserialization Apache Commons

Web Security Academy | Information Disclosure | 4 - Authentication Bypass Via Information Disclosure

Web Security Academy | Insecure Deserialization | 8 - Developing A Custom Gadget Chain For Java Des

Web Security Academy | XSS | 22 - JavaScript String Angle Brackets Double Quotes Encoded Single...

Web Security Academy | XSS | 30 - CSP Bypass

CTF Write-up | CSAW 2022 | Crypto | Gotta Crack Them All

Web Security Academy | Prototype Pollution | 6 - Privilege Escalation Via Server-Side Prototype P...

Web Security Academy | Insecure Deserialization | 3 - Using Application Functionality To Exploit

Web Security Academy | XSS | 8 - HREF Attribute Double Quotes HTML Encoded

Web Security Academy | CSRF | 11 - Samesite Strict Bypass Via Sibling Domain

Web Security Academy | Insecure Deserialization | 2 - Modifying Serialized Data Types

Web Security Academy | Web Cache Poisoning | 6 - Web Cache Poisoning Via An Unkeyed Query Parameter

Web Security Academy | Access Control | 2 - Unprotected Admin Functionality with Unpredictable URL