Brain Dump
187 / 187 entriesPortSwigger Web Security Academy — Complete Roadmap
A 95-lab walkthrough of the PortSwigger Web Security Academy, ordered from information disclosure and access control to JWT, GraphQL and API testing.
TryHackMe — Basic Pentesting
A TryHackMe Basic Pentesting room: SMB enumeration exposes a staff list, a private key cracks under john, and a backup file hands over the root password.
Web shell upload via path traversal
The upload folder serves PHP as plain text, so a URL-encoded ../ in the filename drops my shell one directory up where it runs.
Web shell upload via race condition
The upload writes my file into the public folder and validates it afterwards, so a shell fired in that window runs before deletion.
Web shell upload via obfuscated file extension
A null byte in the filename makes the validator see a harmless .jpg while the filesystem quietly writes out a working .php shell.
Visible error-based SQL injection
The app prints raw database errors, so I CAST a subquery to int and read the admin password straight out of the type error.
Web shell upload via extension blacklist bypass
Apache reads a .htaccess file straight from the upload folder, so a locked-down extension blacklist still turns into code execution.
Username enumeration via response timing
The login form leaks valid usernames through response timing, and a spoofed X-Forwarded-For header walks around the IP block.
User role can be modified in user profile
The email change response leaks a roleId field, so replaying the request with roleid 2 is all it takes to reach the admin panel.