Writeup Library
4915 detailed walkthroughs across HTB, THM, and PortSwigger. Pro writeups unlock exclusive content.
CUSTOM
Lab 304 — TeamVault — Broken Access Control in GraphQL Mutation
Web · XESXOR
Medium4 min
CUSTOM
Lab 304 — TeamVault — Broken Access Control in GraphQL Mutation
Web · XESXOR
Medium4 min
CUSTOM
Lab 305 — TeamSync — SAML Signature Bypass to Admin Takeover
Web · XESXOR
Medium4 min
CUSTOM
Lab 305 — TeamSync — SAML Signature Bypass to Admin Takeover
Web · XESXOR
Medium4 min
CUSTOM
Lab 307 — CrewHub — File Upload RCE via Polyglot JPG/PHP
Web · XESXOR
Medium4 min
CUSTOM
Lab 307 — CrewHub — File Upload RCE via Polyglot JPG/PHP
Web · XESXOR
Medium4 min
CUSTOM
PROLab 308 — MetricFlow — Reflected XSS via RFC2109 Cookie Parsing WAF Bypass
Web · XESXOR
Hard8 min
CUSTOM
PROLab 308 — MetricFlow — Reflected XSS via RFC2109 Cookie Parsing WAF Bypass
Web · XESXOR
Hard8 min
CUSTOM
Lab 31 — PayStream — IDOR in GraphQL Billing API
Web · XESXOR
Medium3 min
CUSTOM
Lab 31 — PayStream — IDOR in GraphQL Billing API
Web · XESXOR
Medium3 min
CUSTOM
Lab 310 — PlanForge
Web · XESXOR
Easy4 min
CUSTOM
Lab 310 — PlanForge
Web · XESXOR
Easy4 min
CUSTOM
Lab 312 — BuildStream — Zip Slip Path Traversal in Artifact Upload
Web · XESXOR
Medium3 min
CUSTOM
Lab 312 — BuildStream — Zip Slip Path Traversal in Artifact Upload
Web · XESXOR
Medium3 min
CUSTOM
PROLab 313 — ThreadForge — PHAR Deserialization Chain via Backup Leak & Chunked Upload
Web · XESXOR
Hard3 min
CUSTOM
PROLab 313 — ThreadForge — PHAR Deserialization Chain via Backup Leak & Chunked Upload
Web · XESXOR
Hard3 min
CUSTOM
Lab 314 — PixVault — ExifTool DjVu RCE via Image Upload
Web · XESXOR
Medium6 min
CUSTOM
Lab 314 — PixVault — ExifTool DjVu RCE via Image Upload
Web · XESXOR
Medium6 min
CUSTOM
Lab 315 — PulseMetrics — SSRF Chain to SSTI via Internal Services
Web · XESXOR
Medium4 min
CUSTOM
Lab 315 — PulseMetrics — SSRF Chain to SSTI via Internal Services
Web · XESXOR
Medium4 min
CUSTOM
Lab 316 — InsightForge — JWT Secret Leak to RCE via Command Injection
Web · XESXOR
Medium3 min
CUSTOM
Lab 316 — InsightForge — JWT Secret Leak to RCE via Command Injection
Web · XESXOR
Medium3 min
CUSTOM
PROLab 317 — DataInsights — H2 JDBC Connection String Injection to RCE
Web · XESXOR
Hard4 min
CUSTOM
PROLab 317 — DataInsights — H2 JDBC Connection String Injection to RCE
Web · XESXOR
Hard4 min
CUSTOM
PROLab 318 — VaultDrop — Padding Oracle to RCE via Storage Zone Controller
Web · XESXOR
Hard7 min
CUSTOM
PROLab 318 — VaultDrop — Padding Oracle to RCE via Storage Zone Controller
Web · XESXOR
Hard6 min
CUSTOM
Lab 319 — PageForge — Chained Path Traversal to RCE via Asset Bundler
Web · XESXOR
Medium6 min
CUSTOM
Lab 319 — PageForge — Chained Path Traversal to RCE via Asset Bundler
Web · XESXOR
Medium5 min
CUSTOM
Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion
Web · XESXOR
Medium3 min
CUSTOM
Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion
Web · XESXOR
Medium3 min