Writeup Library
4915 detailed walkthroughs across HTB, THM, and PortSwigger. Pro writeups unlock exclusive content.
CUSTOM
Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal
Web · XESXOR
Medium4 min
CUSTOM
Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal
Web · XESXOR
Medium4 min
CUSTOM
Lab 230 — DocuNest — Stored XSS via DOM Clobbering
Web · XESXOR
Medium5 min
CUSTOM
Lab 230 — DocuNest — Stored XSS via DOM Clobbering
Web · XESXOR
Medium5 min
CUSTOM
Lab 231 — PagePulse — XSS via Web Cache Poisoning
Web · XESXOR
Medium5 min
CUSTOM
Lab 231 — PagePulse — XSS via Web Cache Poisoning
Web · XESXOR
Medium4 min
CUSTOM
PROLab 232 — WikiFlow — Stored XSS via DOM Clobbering + Service Worker Hijacking
Web · XESXOR
Hard7 min
CUSTOM
PROLab 232 — WikiFlow — Stored XSS via DOM Clobbering + Service Worker Hijacking
Web · XESXOR
Hard7 min
CUSTOM
Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection
Web · XESXOR
Easy3 min
CUSTOM
Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection
Web · XESXOR
Easy3 min
CUSTOM
Lab 234 — RouteForge — HTTP Request Smuggling via Obs-Fold Header Parsing
Web · XESXOR
Medium5 min
CUSTOM
Lab 234 — RouteForge — HTTP Request Smuggling via Obs-Fold Header Parsing
Web · XESXOR
Medium5 min
CUSTOM
Lab 235 — CloudPulse — Cross-Tenant JWT Replay via Missing Tenant Binding
Web · XESXOR
Medium7 min
CUSTOM
Lab 235 — CloudPulse — Cross-Tenant JWT Replay via Missing Tenant Binding
Web · XESXOR
Medium7 min
CUSTOM
Lab 236 — PulseAlert — Blind SSTI via Notification Template Engine
Web · XESXOR
Medium4 min
CUSTOM
Lab 236 — PulseAlert — Blind SSTI via Notification Template Engine
Web · XESXOR
Medium4 min
CUSTOM
Lab 237 — MailCraft — SSTI in Email Template Preview
Web · XESXOR
Medium3 min
CUSTOM
Lab 237 — MailCraft — SSTI in Email Template Preview
Web · XESXOR
Medium4 min
CUSTOM
Lab 238 — PulseWatch — SQL Injection in Collector Configuration
Web · XESXOR
Medium5 min
CUSTOM
Lab 238 — PulseWatch — SQL Injection in Collector Configuration
Web · XESXOR
Medium5 min
CUSTOM
Lab 24 — SheetMetric — XXE via Malicious Excel Upload
Web · XESXOR
Easy6 min
CUSTOM
Lab 24 — SheetMetric — XXE via Malicious Excel Upload
Web · XESXOR
Easy6 min
CUSTOM
Lab 240 — DeployForge — Prototype Pollution to RCE via Lodash Merge
Web · XESXOR
Medium6 min
CUSTOM
Lab 240 — DeployForge — Prototype Pollution to RCE via Lodash Merge
Web · XESXOR
Medium5 min
CUSTOM
Lab 241 — LedgerFlow — XXE via Encoding Bypass in Excel Import
Web · XESXOR
Medium6 min
CUSTOM
Lab 241 — LedgerFlow — XXE via Encoding Bypass in Excel Import
Web · XESXOR
Medium6 min
CUSTOM
Lab 243 — VendorNest — SSTI in Product Descriptions via Blade Template Engine
Web · XESXOR
Easy5 min
CUSTOM
Lab 243 — VendorNest — SSTI in Product Descriptions via Blade Template Engine
Web · XESXOR
Easy5 min
CUSTOM
Lab 244 — ChatDesk — SSRF in SMS Webhook Media Processing
Web · XESXOR
Medium3 min
CUSTOM
Lab 244 — ChatDesk — SSRF in SMS Webhook Media Processing
Web · XESXOR
Medium2 min