Writeup Library
4915 detailed walkthroughs across HTB, THM, and PortSwigger. Pro writeups unlock exclusive content.
2FA broken logic
Authentication · XESXOR
2FA bypass using a brute-force attack
Authentication · XESXOR
2FA simple bypass
Authentication · XESXOR
Arbitrary object injection in PHP
Insecure Deserialization · XESXOR
Authentication bypass via encryption oracle
Business logic vulnerabilities · XESXOR
Authentication bypass via flawed state machine
Business logic vulnerabilities · XESXOR
Authentication bypass via information disclosure
Information Disclosure · XESXOR
Authentication bypass via OAuth implicit flow
Oauth · XESXOR
Basic clickjacking with CSRF token protection
Clickjacking · XESXOR
Basic password reset poisoning
HTTP Host header attacks · XESXOR
Basic server-side template injection
SSTI · XESXOR
Basic server-side template injection (code context)
SSTI · XESXOR
Basic SSRF against another back-end system
SSRF · XESXOR
Basic SSRF against the local server
SSRF · XESXOR
Blind OS command injection with out-of-band data exfiltration
Command_injection · XESXOR
Blind OS command injection with out-of-band data exfiltration[whoami]
Command_injection · XESXOR
Blind OS command injection with output redirection
Command_injection · XESXOR
Blind OS command injection with time delays
Command_injection · XESXOR
Blind SQL injection with conditional errors
SQL_injection · XESXOR
Blind SQL injection with conditional responses
SQL_injection · XESXOR
Blind SQL injection with out-of-band data exfiltration
SQL_injection · XESXOR
Blind SQL injection with out-of-band interaction
SQL_injection · XESXOR
Blind SQL injection with time delays
SQL_injection · XESXOR
Blind SQL injection with time delays and information retrieval
SQL_injection · XESXOR
Blind SSRF with out-of-band detection
SSRF · XESXOR
Blind SSRF with Shellshock exploitation
SSRF · XESXOR
Blind XXE with out-of-band interaction
XXE · XESXOR
Blind XXE with out-of-band interaction via XML parameter entities
XXE · XESXOR
Broken brute-force protection, IP block
Authentication · XESXOR
Broken brute-force protection, multiple credentials per request
Authentication · XESXOR