Writeup Library
4915 detailed walkthroughs across HTB, THM, and PortSwigger. Pro writeups unlock exclusive content.
CUSTOM
Lab 16 — FileGate — Authentication Bypass in API Login
Web · XESXOR
Easy4 min
CUSTOM
Lab 16 — FileGate — Authentication Bypass in API Login
Web · XESXOR
Easy4 min
CUSTOM
Lab 160 — WikiForge — Nginx Alias Path Traversal
Web · XESXOR
Easy3 min
CUSTOM
Lab 160 — WikiForge — Nginx Alias Path Traversal
Web · XESXOR
Easy3 min
CUSTOM
Lab 161 — PageForge — Path Traversal via Mixed Slash Filter Bypass
Web · XESXOR
Medium3 min
CUSTOM
Lab 161 — PageForge — Path Traversal via Mixed Slash Filter Bypass
Web · XESXOR
Medium3 min
CUSTOM
PROLab 162 — VaultDrop — File Upload Race Condition (TOCTOU)
Web · XESXOR
Hard4 min
CUSTOM
PROLab 162 — VaultDrop — File Upload Race Condition (TOCTOU)
Web · XESXOR
Hard5 min
CUSTOM
Lab 163 — PostFlow — Unrestricted File Upload via Avatar Feature
Web · XESXOR
Easy4 min
CUSTOM
Lab 163 — PostFlow — Unrestricted File Upload via Avatar Feature
Web · XESXOR
Easy4 min
CUSTOM
Lab 164 — SitePulse
Web · XESXOR
Medium4 min
CUSTOM
Lab 164 — SitePulse
Web · XESXOR
Medium4 min
CUSTOM
Lab 165 — ReplyStream — File Upload Bypass via Content-Type Validation
Web · XESXOR
Medium2 min
CUSTOM
Lab 165 — ReplyStream — File Upload Bypass via Content-Type Validation
Web · XESXOR
Medium3 min
CUSTOM
Lab 167 — PledgeFlow
Web · XESXOR
Medium5 min
CUSTOM
Lab 167 — PledgeFlow
Web · XESXOR
Medium5 min
CUSTOM
Lab 168 — MetricFlow — Insecure Deserialization via Dashboard Import
Web · XESXOR
Medium4 min
CUSTOM
Lab 168 — MetricFlow — Insecure Deserialization via Dashboard Import
Web · XESXOR
Medium4 min
CUSTOM
Lab 169 — GridPulse — Insecure Deserialization via Configuration Import
Web · XESXOR
Medium6 min
CUSTOM
Lab 169 — GridPulse — Insecure Deserialization via Configuration Import
Web · XESXOR
Medium6 min
CUSTOM
Lab 17 — DocuSign Pro — Path Traversal in Document Export
Web · XESXOR
Easy3 min
CUSTOM
Lab 17 — DocuSign Pro — Path Traversal in Document Export
Web · XESXOR
Easy3 min
CUSTOM
PROLab 170 — PulseGuard — SnakeYAML Deserialization to H2 JDBC OOB Exfiltration
Web · XESXOR
Hard5 min
CUSTOM
PROLab 170 — PulseGuard — SnakeYAML Deserialization to H2 JDBC OOB Exfiltration
Web · XESXOR
Hard5 min
CUSTOM
PROLab 171 — AssetFlow — Path Traversal to RCE via Marshal Deserialization
Web · XESXOR
Hard6 min
CUSTOM
PROLab 171 — AssetFlow — Path Traversal to RCE via Marshal Deserialization
Web · XESXOR
Hard5 min
CUSTOM
Lab 172 — PulseGuard — Insecure Deserialization via JSON.NET TypeNameHandling
Web · XESXOR
Medium5 min
CUSTOM
Lab 172 — PulseGuard — Insecure Deserialization via JSON.NET TypeNameHandling
Web · XESXOR
Medium5 min
CUSTOM
Lab 173 — ConnectHub — OAuth Open Redirect via URL Userinfo Bypass
Web · XESXOR
Medium5 min
CUSTOM
Lab 173 — ConnectHub — OAuth Open Redirect via URL Userinfo Bypass
Web · XESXOR
Medium5 min