Writeup Library
4915 detailed walkthroughs across HTB, THM, and PortSwigger. Pro writeups unlock exclusive content.
Exploiting NoSQL operator injection to extract unknown fields
NoSQL injection · XESXOR
Exploiting origin server normalization for web cache deception
Web Cache Deception · XESXOR
Exploiting path delimiters for web cache deception
Web Cache Deception · XESXOR
Exploiting path mapping for web cache deception
Web Cache Deception · XESXOR
Exploiting PHP deserialization with a pre-built gadget chain
Insecure Deserialization · XESXOR
Exploiting Ruby deserialization using a documented gadget chain
Insecure Deserialization · XESXOR
Exploiting server-side parameter pollution in a query string
API testing · XESXOR
Exploiting XInclude to retrieve files
XXE · XESXOR
Exploiting XXE to perform SSRF attacks
XXE · XESXOR
Exploiting XXE to retrieve data by repurposing a local DTD
XXE · XESXOR
Exploiting XXE using external entities to retrieve files
XXE · XESXOR
Exploiting XXE via image file upload
XXE · XESXOR
File path traversal, traversal sequences stripped non-recursively
Directory-traversal · XESXOR
File path traversal, validation of file extension with null byte bypass
Directory-traversal · XESXOR
File path traversal, validation of start of path
Directory-traversal · XESXOR
File path traversal,simple case
Directory-traversal · XESXOR
File path traversal,traversal sequences blocked with absolute path bypass
Directory-traversal · XESXOR
File path traversal,traversal-sequences stripped with superfluous URL-decode
Directory-traversal · XESXOR
Finding and exploiting an unused API endpoint
API testing · XESXOR
Flawed enforcement of business rules
Business logic vulnerabilities · XESXOR
Forced OAuth profile linking
Oauth · XESXOR
High-level logic vulnerability
Business logic vulnerabilities · XESXOR
Host header authentication bypass
HTTP Host header attacks · XESXOR
Host validation bypass via connection state attack
HTTP Host header attacks · XESXOR
Inconsistent handling of exceptional input
Business logic vulnerabilities · XESXOR
Inconsistent security controls
Business logic vulnerabilities · XESXOR
Infinite money logic flaw
Business logic vulnerabilities · XESXOR
Information disclosure in error messages
Information Disclosure · XESXOR
Information disclosure in version control history
Information Disclosure · XESXOR
Information disclosure on debug page
Information Disclosure · XESXOR