Writeup Library
4915 detailed walkthroughs across HTB, THM, and PortSwigger. Pro writeups unlock exclusive content.
CUSTOM
Lab 72 — WriteFlow — Stored XSS via WYSIWYG Editor Sanitizer Bypass
Web · XESXOR
Medium4 min
CUSTOM
Lab 72 — WriteFlow — Stored XSS via WYSIWYG Editor Sanitizer Bypass
Web · XESXOR
Medium5 min
CUSTOM
Lab 73 — NetShield — Reflected XSS via 404 Page Attribute Injection
Web · XESXOR
Medium5 min
CUSTOM
Lab 73 — NetShield — Reflected XSS via 404 Page Attribute Injection
Web · XESXOR
Medium5 min
CUSTOM
Lab 74 — DataPulse — Stored XSS via CRLF Injection in Locale Endpoint
Web · XESXOR
Medium6 min
CUSTOM
Lab 74 — DataPulse — Stored XSS via CRLF Injection in Locale Endpoint
Web · XESXOR
Medium6 min
CUSTOM
Lab 75 — StayNest — Stored XSS in Hotel Booking Form
Web · XESXOR
Medium3 min
CUSTOM
Lab 75 — StayNest — Stored XSS in Hotel Booking Form
Web · XESXOR
Medium3 min
CUSTOM
Lab 76 — DocuWeave — Stored XSS via Diagram Rendering Attribute Injection
Web · XESXOR
Medium5 min
CUSTOM
Lab 76 — DocuWeave — Stored XSS via Diagram Rendering Attribute Injection
Web · XESXOR
Medium5 min
CUSTOM
Lab 77 — WorkPulse — Stored XSS via Web Cache Poisoning
Web · XESXOR
Medium5 min
CUSTOM
Lab 77 — WorkPulse — Stored XSS via Web Cache Poisoning
Web · XESXOR
Medium5 min
CUSTOM
Lab 78 — MetricVault — NoSQL Injection in Login Authentication
Web · XESXOR
Medium3 min
CUSTOM
Lab 78 — MetricVault — NoSQL Injection in Login Authentication
Web · XESXOR
Medium3 min
CUSTOM
Lab 79 — LeadStream — Blind SQL Injection via Excel Bulk Import
Web · XESXOR
Medium6 min
CUSTOM
Lab 79 — LeadStream — Blind SQL Injection via Excel Bulk Import
Web · XESXOR
Medium6 min
CUSTOM
Lab 8 — AutoFleet — API Mass Assignment to RCE
Web · XESXOR
Easy3 min
CUSTOM
Lab 8 — AutoFleet — API Mass Assignment to RCE
Web · XESXOR
Easy3 min
CUSTOM
Lab 80 — GateGuard — SQL Injection in Organization Filter API
Web · XESXOR
Medium4 min
CUSTOM
Lab 80 — GateGuard — SQL Injection in Organization Filter API
Web · XESXOR
Medium4 min
CUSTOM
Lab 81 — InsightPulse — SQL Injection in Analytics Tracking
Web · XESXOR
Easy4 min
CUSTOM
Lab 81 — InsightPulse — SQL Injection in Analytics Tracking
Web · XESXOR
Easy4 min
CUSTOM
Lab 82 — PixelVault — SQL Injection via User-Agent in Activity Logging
Web · XESXOR
Medium5 min
CUSTOM
Lab 82 — PixelVault — SQL Injection via User-Agent in Activity Logging
Web · XESXOR
Medium5 min
CUSTOM
Lab 83 — DealStream — UNION SQL Injection in Public Search API
Web · XESXOR
Medium7 min
CUSTOM
Lab 83 — DealStream — UNION SQL Injection in Public Search API
Web · XESXOR
Medium7 min
CUSTOM
Lab 84 — PulseView
Web · XESXOR
Medium6 min
CUSTOM
Lab 84 — PulseView
Web · XESXOR
Medium6 min
CUSTOM
Lab 85 — MerchFlow — Blind HQL Injection via Unsanitized ORDER BY
Web · XESXOR
Medium5 min
CUSTOM
Lab 85 — MerchFlow — Blind HQL Injection via Unsanitized ORDER BY
Web · XESXOR
Medium5 min