Web Security Academy

If you have a list of usernames and a list of passwords, and you want to try every combination, use the cluster bomb attack.

IDORs & BACs are still the most reported vulnerabilities 🔝 Explore our free lab to understand how this vulnerability works, guided by @hacksplained 👇 portswigger.net/web-security/a…

Introducing Burp AT. Agentic AI for human-led pentesting, with Burp Suite’s proven tools, your project context, and purpose-built skills. Now live in public beta for Burp Suite Professional users. portswigger.net/blog/introduci…

@NetworkChuck 👀

Got a Raspberry Pi? (Any model works!) You can turn it into a portable hacking rig with Kali Linux. #RaspberryPi #KaliLinux

Excited to share that I've just joined the @PortSwiggerRes team. Having gotten an early look at what the team is bringing to @BlackHatEvents, I can safely say this year is going to be epic!

I haven't posted a crazy XSS vector for a while... Works on every browser

Our newest labs are all about hacking LLMs. You'll learn: 🟧 What's an LLM? 🟧 Prompt injection 🟧 Exploiting LLM APIs, functions, and plugins 🟧 AI-powered scanner vulnerabilities 🟧 Defending against LLM attacks Sound good? Get started here. 👇 portswigger.net/web-security/l…

Burp Intruder has 4 attack types 👇 🔶 Sniper - One payload list in one position 🔶 Battering Ram - Same payload in multiple positions 🔶 Pitchfork - Different payload sets in parallel 🔶 Clusterbomb - All combinations of multiple payload sets Try it out 🧪

A simple bypass through IP based application blocklisting 👇 X-Forwarded-For can be used to bypass the IP based blocklisting if the application is configured to trust this header.

When you have an exam tomorrow but you can't stop Web Security Academy

Ambiguous URLs are behind many SSRF, CORS, and redirect flaws, but most bypasses are scattered and undocumented. This cheat sheet consolidates payloads, encodings, and IP tricks into one place to assist your testing. Check it out: portswigger.net/web-security/s…

Learn to hack with Portswigger Web Security Academy! Why? Our labs: 🔶 are based on real-world scenarios 🔶 have integrated learning paths 🔶 are 100% FREE You can literally start right now. 👇 portswigger.net/users/register

"kid":"../../dev/null" That’s a classic path traversal payload weaponized inside a JWT Key ID (kid) header. Battle-tested libraries drop these requests, but custom or legacy JWT implementations may still fall for it. Try it out here! 👇 portswigger.net/web-security/j…

<img src=x onerror=alert(1)> An alert box popped! ⚠️ What next? Popping an alert box is just the start. Dig deep and turn it into a full account takeover, data theft, or lateral movement. Find out how here 👇 portswigger.net/web-security/c…

The field of desync flaws arising from deep implementation bugs is absolutely wild. This finding from @calif_io using a fake pseudo-header than gets weaponized by a dodgy length calculation is a great example

@lanlico @1Iucas Welcome!

Depois de me lascar na parte de defesa (só 45k/mes) é hora de aprender um pouco mais de offsec e ganhar dinheiro igual o @1Iucas I completed the Web Security Academy lab: Unprotected admin functionality @WebSecAcademy portswigger.net/web-security/a…

@EthicalHac58447 Awesome, that's a tricky one!

I completed the Web Security Academy lab: Cross-site WebSocket hijacking @WebSecAcademy portswigger.net/web-security/w…

@cyberzee_ Nice one, 190 to go!

Day 10/200 I completed the Web Security Academy lab: HTTP request smuggling, basic CL.TE vulnerability @WebSecAcademy portswigger.net/web-security/r… #200daysshowupchallenge