autopentest-ai

AutoPentest An agentic pentesting MCP server that automates web application penetration testing using the full OWASP Web Security Testing Guide and PortSwigger Web Security Academy technique references. Point it at a target — it crawls your app, maps every endpoint, then spawns role-specialized...

Burp-Suite-Certified-Practitioner-Exam-Study

Burp Suite Certified Practitioner Exam Study This is my study notes with over a 110 PortSwigger Academy Labs. I used these labs to pass the Burp Suite Certified Practitioner Exam 2023. My BSCP qualification. For more informaion go to PortSwigger Academy to get latest learning materials. SCANNING ...

bambdas

Bambda scripts Welcome to the official Bambda scripts repository from PortSwigger. This repo contains a collection of scripts developed by both PortSwigger and the community with 🧡 📑 On this page Types of Bambda scripts Repository contents Importing scripts into Burp Updating scripts in your...

PortSwigger-Web-Security-Academy

PortSwigger-Web-Security-Academy The interesting cases and m0r3 With nu11secur1ty 😎 Report as of June 2022 JWT - Module:...

BSCP-EXAM-GUIDE-BY-N3OARI-2026

README.MD MARZO 2026 Este repositorio contiene cada hoja de trucos junto con sus respectivos laboratorios más importantes. Cada tema incluye su propia hoja de trucos/metodología, los laboratorios más relevantes y recursos útiles. ⭐Este es el resultado de meses de trabajo — espero que te sea útil...

url-cheatsheet-data

URL validation bypass cheat sheet data This is the data that powers the PortSwigger URL validation bypass cheat sheet. We have put this data on Github so the community can contribute vectors via pull requests. Contributing To contribute, please create a pull request with changes to the JSON data...

research-labs

Researcher's labs This repository contains a number of intentionally vulnerable applications that you can use to explore vulnerabilities found by PortSwigger Research. Note that you can find many free online labs designed by PortSwigger Research in the Web Security Academy. Table of contents...

echteeteepee

HTTP/1 Desync Vulnerability Testing Tools This repository contains defensive security tools for detecting HTTP/1 request smuggling desync vulnerabilities based on groundbreaking research by James Kettle of PortSwigger. Research Attribution This work is directly inspired by and implements techniqu...

xss-cheatsheet-data

This is the data that powers the PortSwigger XSS cheat sheet. We have put this data on Github so the community can contribute vectors via pull requests. Contributing To contribute please create a pull request with changes to the JSON data. For example, to add onwaiting to the data, do: "onwaiting...

50-Days-Of-SQLi

50-Days-Of-SQLi Q. Why I am starting this? I have always struggled as a bug hunter. Whenever I read anything new I learn from it but hardly implement it. And because of that whenever I read anything now, it feels like I know it and so couldn't digest complete information that the writeup has to...

security-writeups

Security Writeups Lab write-ups from self-directed work, mostly TryHackMe, plus a PortSwigger SQLi practical. The reasoning lives on the site — the full methodology, the payloads, the parts where I went wrong first — and this repo is the index and the scripts. Nine rooms, and they are not nine...

sql-injection-labs

SQL Injection Labs — PortSwigger Web Security Academy A colle...

CVE-2026-90481

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

CVE-2026-90481

PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) versions before 2026.8 are vulnerable to an authentication bypass that can be triggered via an alternate path or channel. The provided documents do not specify the exact technical root cause or the specific component involved. N...

EUVD-2026-86005

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

PT-2026-97848

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

CVE-2026-90481: Authentication Bypass Using an Alternate Path or Channel

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

Day-22--Reflected-Cross-Site-Scripting-XSS-in-HTML-Context

Day 22: Reflected Cross-Site Scripting XSS in HTML Context...

portswigger---cross-site-scripting

portswigger-web-security-academy/ └── cross-site-scripting/...

Imperva Customers Protected Against Novel HTTP Desync Attacks

TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently...