- Published on
Overview
Portswigger has plethora of labs and literature to practice and learn about web app penetration testing.
I have solved around more than 65 labs at the moment ( there are around 203 labs 😱 ) in a span of 2 to 3 months. I am focusing mainly on labs that are related to server side vulnerabilities as I find it more interesting compared to client side.
Topics that have been done or are in progress
Following are topics that I have worked on:
- Authentication
- Directory Traversal
- SSRF
- Information Disclosure
- Access Control
- OS Command Injection
- Business Logic
- XXE
- File Upload
Tools
I have for all the labs utilised Burp Suite community edition. Features like intruder, repeater interceptor and exporting requests plugin were the only ones that I have utilised.
Although burp suite provides intruder to send requests sequentially but as I have been using community edition there is a limit to number of requests one can make. Hence, for such purposes I have utilised my own custom scripts to send multiple requests and exploit said vulnerability of lab.
So, Burp suite and python scripts have been my go to methods to test for vulnerabilities.