116 matches found
research-labs
Researcher's labs This repository contains a number of intentionally vulnerable applications that you can use to explore vulnerabilities found by PortSwigger Research. Note that you can find many free online labs designed by PortSwigger Research in the Web Security Academy. Table of contents...
PortSwigger-Web-Security-Academy
PortSwigger-Web-Security-Academy The interesting cases and m0r3 With nu11secur1ty 😎 Report as of June 2022 JWT - Module:...
Burp-Suite-Certified-Practitioner-Exam-Study
Burp Suite Certified Practitioner Exam Study This is my study notes with over a 110 PortSwigger Academy Labs. I used these labs to pass the Burp Suite Certified Practitioner Exam 2023. My BSCP qualification. For more informaion go to PortSwigger Academy to get latest learning materials. SCANNING ...
url-cheatsheet-data
URL validation bypass cheat sheet data This is the data that powers the PortSwigger URL validation bypass cheat sheet. We have put this data on Github so the community can contribute vectors via pull requests. Contributing To contribute, please create a pull request with changes to the JSON data...
autopentest-ai
AutoPentest An agentic pentesting MCP server that automates web application penetration testing using the full OWASP Web Security Testing Guide and PortSwigger Web Security Academy technique references. Point it at a target — it crawls your app, maps every endpoint, then spawns role-specialized...
BSCP-EXAM-GUIDE-BY-N3OARI-2026
README.MD MARCH 2026 This repo contains each cheatsheet along with its respective most important labs. Each topic includes its own cheatsheet/methodology, the most relevant labs, and useful resources. ⭐This is the result of months of work — I hope you find it helpful. If you do, please leave a...
bambdas
Bambda scripts Welcome to the official Bambda scripts repository from PortSwigger. This repo contains a collection of scripts developed by both PortSwigger and the community with 🧡 📑 On this page Types of Bambda scripts Repository contents Importing scripts into Burp Updating scripts in your...
echteeteepee
HTTP/1 Desync Vulnerability Testing Tools This repository contains defensive security tools for detecting HTTP/1 request smuggling desync vulnerabilities based on groundbreaking research by James Kettle of PortSwigger. Research Attribution This work is directly inspired by and implements techniqu...
50-Days-Of-SQLi
50-Days-Of-SQLi Q. Why I am starting this? I have always struggled as a bug hunter. Whenever I read anything new I learn from it but hardly implement it. And because of that whenever I read anything now, it feels like I know it and so couldn't digest complete information that the writeup has to...
security-writeups
Security Writeups Write-ups and teaching-style scripts from CTF rooms and lab exercises I've worked through, mainly TryHackMe and PortSwigger. Each folder ships with a "teaching version" script where I've deliberately left the key values blank. If you fill them in from a writeup instead of the...
Imperva Customers Protected Against Novel HTTP Desync Attacks
TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently...
PortSwigger Web Security: Incomplete fix for CVE-2022-35406: meta-redirect content-type check bypassable via parameter injection
The fix for CVE-2022-35406 1541301 stops Burp from following a redirect when the response Content-Type/Content-Disposition would prevent HTML rendering. The check substring-matches html in the raw Content-Type instead of parsing the media type. A text/plain response can smuggle the token via a...
portswigger-labs
PortSwigger Web Security Academy — Lab Notes Notes from compl...
portswigger-sqli-labs
PortSwigger Web Security Academy — SQL Injection Labs All 18...
portswigger-xss-labs
PortSwigger Web Security Academy — XSS Labs All 30 Completed...
Web-Security-Notes
Web-Security-Notes Per...
Portswigger_SQLI_LABs_code_review
PortSwigger SQL Injection Labs — Local Docker Recreations Sel...