portswigger 33
- Lab 02: Exploiting NoSQL operator injection to bypass authentication
- Lab 01: Detecting NoSQL Injection
- Lab 3: Exploiting a mass assignment vulnerability
- Lab 2: Finding and exploiting an unused API endpoint
- Lab 1: Exploiting an API endpoint using documentation
- Lab 13: Password brute-force via password change
- Lab 11: Password reset broken logic
- Lab 10: Offline password cracking
- Lab 09: Brute-forcing a stay-logged-in cookie
- Lab 08: 2FA broken logic
- Lab 07: 2FA simple bypass
- Lab 06: Broken brute-force protection, multiple credentials per request
- Lab 05: Username enumeration via account lock
- Lab 04 : Broken brute-force protection, IP block
- Lab 03: Username enumeration via response timing
- Lab 02: Username enumeration via subtly different responses
- Lab 01 : Username enumeration via different responses
- Lab 03: Cross-site WebSocket hijacking
- Lab 02: Manipulating the WebSocket handshake to exploit vulnerabilities
- Lab 01: Manipulating WebSocket messages to exploit vulnerabilities
- Lab 13: Referer-based access control
- Lab 12: Multi-step process with no access control on one step
- Lab 11 : Insecure direct object references
- Lab 10: User ID controlled by request parameter with password disclosure
- Lab 09: User ID controlled by request parameter with data leakage in redirect
- Lab 08: User ID controlled by request parameter, with unpredictable user IDs
- Lab 07: User ID controlled by request parameter
- Lab 06: Method-based access control can be circumvented
- Lab 05: URL-based access control can be circumvented
- Lab 04: User role can be modified in user profile
- Lab 03: User role controlled by request parameter
- Lab 02: Unprotected admin functionality with unpredictable URL
- Lab 01: Unprotected Admin Functionality