Writeup Library
4915 detailed walkthroughs across HTB, THM, and PortSwigger. Pro writeups unlock exclusive content.
Insecure direct object references
Access Control · XESXOR
Insufficient workflow validation
Business logic vulnerabilities · XESXOR
JWT authentication bypass via flawed signature verification
JWT · XESXOR
JWT authentication bypass via jku header injection
JWT · XESXOR
JWT authentication bypass via jwk header injection
JWT · XESXOR
JWT authentication bypass via kid header path traversal
JWT · XESXOR
JWT authentication bypass via unverified signature
JWT · XESXOR
JWT authentication bypass via weak signing key
JWT · XESXOR
LAB 1 - OS command injection, simple case [APPRENTICE]
Command_injection · XESXOR
Limit overrun race conditions
Race Conditions · XESXOR
Low-level logic flaw
Business logic vulnerabilities · XESXOR
Manipulating the WebSocket handshake to exploit vulnerabilities
WebSockets · XESXOR
Manipulating WebSocket messages to exploit vulnerabilities
WebSockets · XESXOR
Method-based access control can be circumvented
Access Control · XESXOR
Modifying serialized data types
Insecure Deserialization · XESXOR
Modifying serialized objects
Insecure Deserialization · XESXOR
Multi-step process with no access control on one step
Access Control · XESXOR
Notes :
Authentication · XESXOR
OAuth account hijacking via redirect uri
Oauth · XESXOR
Offline password cracking
Authentication · XESXOR
OS command injection, simple case
Command_injection · XESXOR
Password brute-force via password change
Authentication · XESXOR
Password reset broken logic
Authentication · XESXOR
Password reset poisoning via middleware
Authentication · XESXOR
Referer-based access control
Access Control · XESXOR
Reflected XSS into HTML context with all tags blocked except custom ones
Cross Site Scripting · XESXOR
Reflected XSS into HTML context with most tags and attributes blocked
Cross Site Scripting · XESXOR
Reflected XSS into HTML context with nothing encoded
Cross Site Scripting · XESXOR
Remote code execution via polyglot web shell upload
File_Upload · XESXOR
Remote code execution via web shell upload
File_Upload · XESXOR