A walkthrough of exploiting a Union-based SQL Injection vulnerability in a broken search feature on Infinity platform. By identifying the correct number of columns and injecting into a POST parameter, we successfully dumped sensitive data from the database.

A walkthrough of exploiting a Union-based SQL Injection vulnerability in a broken search feature on Infinity platform. By identifying the correct number of columns and injecting into a POST parameter, we successfully dumped sensitive data from the database.

Walkthrough of the Conversor machine – web app XSLT injection, credential cracking from SQLite, and sudo privilege escalation with needrestart.

A detailed walkthrough of the Expressway machine, covering IPsec enumeration, PSK hash cracking, and Sudo host-based privilege escalation.

PortSwigger Web Security Academy - File upload vulnerabilities labs

RootMe challenge walkthrough - Command Injection

RootMe challenge walkthroughs - NoSql Injection Authentication, String, Numeric, Error, Time Based, Blind

PortSwigger Web Security Academy - NoSQL injection labs

PortSwigger Web Security Academy - OS Command Injection labs

RootMe challenge walkthroughs - SQL Injection Authentication, String, Numeric, Error, Time Based, Blind

RootMe challenge walkthroughs - JavaScript Source, Obfuscation, and Authentication

PortSwigger challenge walkthroughs - File Path Traversal