Burp Web Security Academy - Apprentice Labs Walkthrough

Explore a SQL injection vulnerability in the where clause of the product category filter that reveals hidden data in the burp web security academy apprentice labs walkthrough.

Explore a reflected cross-site scripting vulnerability in the html context where input is not encoded, demonstrated in a search feature with a script payload triggering an alert.

Explore a stored XSS into HTML context with nothing encoded by testing a blog comment field, posting a script payload, and observing the reflected payload in the page.

Demonstrate dom xss in the document.write sink using location.search as the source, and show how to inspect dom and source code to trigger an onload alert.

Demonstrate a dom xss by exploiting an inner HTML sink through a user-controlled location.search, showing how unsanitized input renders HTML and triggers in-browser payloads.

Identify and reproduce a DOM XSS vulnerability in a jQuery selector sink triggered by a hashchange event on the home page, using an exploit server and payloads to exfiltrate cookies.

Demonstrates a reflected xss vulnerability in a value attribute with angle brackets that is html-encoded, showing how to break out with quotes and an onmouseover event to trigger an alert.

Demonstrate a stored cross-site scripting vulnerability in the anchor href attribute with double quotes HTML-encoded, showing how unfiltered input can inject JavaScript that triggers an alert.

Demonstrates a reflected cross-site scripting vulnerability in a JavaScript string with HTML-encoded angle brackets. Shows breaking out of a variable to trigger an alert reflected in page, verified via Burp.

Shows a CSRF vulnerability with no protections, where an attacker can exploit an unprotected post request to change a victim's email and potentially take over the account.

Demonstrate clickjacking to prefill a form's email field via a URL parameter using an overlaying iframe, then require the user to click to submit a post request.

Explore bypassing a frame buster in clickjacking by using a sandboxed iframe with allow forms, aligning the click region, and pre-filling a user email via a sea surf token.

Explore how a basic origin reflection in cross-origin resource sharing risks exposing the api key by misconfiguring access-control-allow-origin and access-control-allow-credentials in an authenticated session.

Explains a cors vulnerability with trusted null origin by using a sandboxed iframe to set the origin to null and harvest the api key.

Explore xml external entity injection (xxe) to exfiltrate files by manipulating xml input and external entities, revealing /etc/passwd contents via a vulnerable stock endpoint.

Exploit an external entity injection to trigger SSRF, accessing an AWS EC2 metadata endpoint and exfiltrating security credentials via a crafted XML payload.

Demonstrate how basic ssrf manipulates a web app to reach internal loopback resources, access the admin interface via the stock check flow, and delete a user through url manipulation.

Explore a basic server-side request forgery attack against an internal admin panel. Access the internal system at 1921680.118:8080 to delete the user Carlos via the admin interface.

Explain an OS command injection in a simple case by controlling input to a shopping app, enabling execution of system commands like whoami, ls, and id via Burp Repeater.

Demonstrate file path traversal (directory traversal) in a simple lab by manipulating the image file parameter to access the root and view the passwd file using Burp repeater.