A structured repository containing my lab writeups and notes from the PortSwigger Web Security Academy.
The goal of this repository is to document:
- Web vulnerabilities
- Exploitation techniques
- Payloads and methodology
- Real-world offensive security concepts
- Lessons learned during each lab
The repository is organized by attack categories rather than difficulty levels.
.
├── SQL-Injection/
├── Cross-Site-Scripting-XSS/
├── Cross-Site-Request-Forgery-CSRF/
├── Server-Side-Request-Forgery-SSRF/
├── Authentication/
├── Access-Control/
├── File-Upload-Vulnerabilities/
├── XXE/
├── Clickjacking/
├── Command-Injection/
├── Path-Traversal/
├── Insecure-Deserialization/
├── Business-Logic-Vulnerabilities/
├── JWT/
├── CORS/
├── SSTI/
├── WebSockets/
├── OAuth/
├── API-Testing/
├── Race-Conditions/
└── Misc/This repository serves as:
- A personal learning journal
- A reference for web exploitation techniques
- A way to track progress in web security
- A resource for revising offensive security concepts
Each lab writeup generally follows this structure:
Brief description of the vulnerability.
What the lab requires you to achieve.
How the vulnerability was identified.
Step-by-step exploitation process.
Important payloads or requests.
How the vulnerability can be prevented.
Important lessons learned.
Original PortSwigger lab URL.
These writeups are intended strictly for:
- Educational purposes
- Ethical hacking practice
- Cybersecurity training
Do not use these techniques against systems without proper authorization.
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Server-Side Request Forgery (SSRF)
- Authentication Vulnerabilities
- Access Control Issues
- XML External Entity Injection (XXE)
- File Upload Vulnerabilities
- OS Command Injection
- Path Traversal
- Insecure Deserialization
- Web Cache Poisoning
- JWT Attacks
- OAuth Vulnerabilities
- API Security Testing
- Race Conditions
- Business Logic Vulnerabilities
Labs are taken from:
PortSwigger Web Security Academy
| Category | Status |
|---|---|
| SQL Injection | In Progress |
| XSS | In Progress |
| CSRF | In Progress |
| SSRF | Planned |
| XXE | Planned |
| Authentication | In Progress |
This repository is primarily for personal learning and documentation, but suggestions and improvements are always welcome.
Special thanks to:
- PortSwigger
- The cybersecurity community
- Ethical hackers and researchers sharing knowledge openly