Writeup Library
4915 detailed walkthroughs across HTB, THM, and PortSwigger. Pro writeups unlock exclusive content.
CUSTOM
Lab 139 — HireFlow — XXE via XML Application Intake
Web · XESXOR
Easy2 min
CUSTOM
Lab 139 — HireFlow — XXE via XML Application Intake
Web · XESXOR
Easy2 min
CUSTOM
Lab 14 — SoundMart — Race Condition in Coupon Redemption
Web · XESXOR
Medium5 min
CUSTOM
Lab 14 — SoundMart — Race Condition in Coupon Redemption
Web · XESXOR
Medium4 min
CUSTOM
Lab 140 — Pressboard — XXE via RSS Feed Import
Web · XESXOR
Easy3 min
CUSTOM
Lab 140 — Pressboard — XXE via RSS Feed Import
Web · XESXOR
Easy3 min
CUSTOM
Lab 142 — TalentFlow — XXE via Resume Upload
Web · XESXOR
Easy5 min
CUSTOM
Lab 142 — TalentFlow — XXE via Resume Upload
Web · XESXOR
Easy5 min
CUSTOM
Lab 143 — SprintBase — XXE in PowerPoint File Upload
Web · XESXOR
Easy6 min
CUSTOM
Lab 143 — SprintBase — XXE in PowerPoint File Upload
Web · XESXOR
Easy6 min
CUSTOM
Lab 144 — InsightForge — Blind XXE via XML Data Import
Web · XESXOR
Easy4 min
CUSTOM
Lab 144 — InsightForge — Blind XXE via XML Data Import
Web · XESXOR
Easy4 min
CUSTOM
Lab 145 — RankPulse — XXE via Sitemap XML Parsing
Web · XESXOR
Easy4 min
CUSTOM
Lab 145 — RankPulse — XXE via Sitemap XML Parsing
Web · XESXOR
Easy5 min
CUSTOM
Lab 148 — VaultPay — CSRF in Payment Provider OAuth Callback
Web · XESXOR
Medium6 min
CUSTOM
Lab 148 — VaultPay — CSRF in Payment Provider OAuth Callback
Web · XESXOR
Medium6 min
CUSTOM
Lab 15 — ProfileHub — IDOR in User Profile API
Web · XESXOR
Easy4 min
CUSTOM
Lab 15 — ProfileHub — IDOR in User Profile API
Web · XESXOR
Easy4 min
CUSTOM
Lab 152 — BrightPages — Cross-Site WebSocket Hijacking (CSWSH)
Web · XESXOR
Medium7 min
CUSTOM
Lab 152 — BrightPages — Cross-Site WebSocket Hijacking (CSWSH)
Web · XESXOR
Medium7 min
CUSTOM
Lab 153 — FlowDesk — CSRF Account Takeover via Email Change
Web · XESXOR
Easy4 min
CUSTOM
Lab 153 — FlowDesk — CSRF Account Takeover via Email Change
Web · XESXOR
Easy4 min
CUSTOM
Lab 155 — DataCraft — Path Traversal via Archive Import (Zip Slip)
Web · XESXOR
Medium4 min
CUSTOM
Lab 155 — DataCraft — Path Traversal via Archive Import (Zip Slip)
Web · XESXOR
Medium4 min
CUSTOM
Lab 156 — IntegraFlow — Path Traversal via Double URL Encoding
Web · XESXOR
Medium4 min
CUSTOM
Lab 156 — IntegraFlow — Path Traversal via Double URL Encoding
Web · XESXOR
Medium3 min
CUSTOM
Lab 158 — PageCraft — Twig Template Path Traversal via Namespace Bypass
Web · XESXOR
Medium4 min
CUSTOM
Lab 158 — PageCraft — Twig Template Path Traversal via Namespace Bypass
Web · XESXOR
Medium4 min
CUSTOM
Lab 159 — ShareVault — Path Traversal via Filter Bypass in File Download
Web · XESXOR
Medium5 min
CUSTOM
Lab 159 — ShareVault — Path Traversal via Filter Bypass in File Download
Web · XESXOR
Medium6 min