Burp Web Security Academy - Practitioner Labs Walkthrough

Identify the number of columns in a union-based sql injection and find the text-capable column. Retrieve the string from that column and verify by rendering it.

Illustrates a union-based sql injection attack to retrieve data from other tables, including usernames and passwords from the users table, and demonstrates using those credentials to access the administrator account.

Explore practical sql injection techniques to query Oracle database type and version using union select and from dual, and exfiltrate the banner with Oracle-specific commands.

Master blind sql injection with conditional errors by testing the tracking id cookie and case statements, then automate administrator password discovery with sqlmap and burp intruder on Oracle.

Explore blind sql injection with time delays to extract database information using time-based conditions, sleep tests, and sqlmap, targeting cookies and administrator credentials.

Explore sql injection with filter bypass via xml encoding, showing how a web application firewall can be circumvented using burp extensions to test a stock check vulnerability.

Explore a client-side dom xss in AngularJS expressions using angle brackets and html-encoded quotes. Test NG app attributes and curly brace expressions to trigger an xss payload in the dom.

Explore how cross-site scripting can be chained to execute CSRF attacks and enable account takeover, including reading and using CSRF tokens to change user emails.

Explore reflected cross-site scripting in an HTML context with all common tags blocked, using a custom tag with onfocus to bypass filters, and deliver a payload via an iframe.

Explore exploiting a reflected XSS in a JavaScript string by testing HTML-encoded angle brackets and quotes, bypassing filters to trigger an alert via Burp Repeater.

Illustrates how cross-site request forgery tokens not tied to a user session enable attack via token reuse across two sessions, with a practical POC using Burp and an exploit server.

Explore a cross-site request forgery where the csrf key is tied to a non-session cookie, enabling attacker-controlled token reuse and cookie injection via a proof-of-concept request.

Explore how a csrf token duplicated in a cookie enables token reuse and cookie injection to perform an email update via a crafted payload.

Explore how SameSite Strict cookies prevent CSRF and how attackers can exploit client-side redirects and misconfigurations to bypass defenses, including cookie attributes, redirects, and get vs post vulnerabilities.

Discover how a same-site strict bypass via a sibling domain enables exfiltration of chat data through cross-site websocket hijacking, demonstrated with burp collaborator.

Demonstrates a csrf vulnerability where referrer validation fails when the header is missing, and shows how a no-referrer meta tag enables bypass to alter a victim's email.

This lab shows exploiting clickjacking to trigger dom-based xss via an unprotected x-frame header in a submit feedback form, using an iframe to pass payloads through get and post requests.

Conduct a multi-step clickjacking attack to force a delete-account confirmation flow through an iframe overlay, coordinating clicks across pages and different browsers.

Demonstrates a DOM XSS attack using web messages and JSON.parse within an iframe, exploiting unsanitized URLs and a JavaScript payload delivered via postMessage.

Demonstrate a dom-based open redirect by manipulating a URL parameter via an onClick event to redirect users to a chosen page. Verify the vulnerability by redirecting to an exploit server.

Explore dom-based cookie manipulation by showing how recently visited product cookies can trigger a cross-site scripting payload via an iframe and onload, exploiting cookie poisoning.

Demonstrate blind xxe with out-of-band interaction by injecting an external entity into xml input, triggering burp collaborator dns and http requests as a proof-of-concept.

Demonstrate exploiting blind xxe to exfiltrate data using a malicious external DTD, showing the external entity attack flow with Burp collaborator verification.

Learn to exploit blind xxy to retrieve data via error messages by hosting an external dtd and triggering error outputs through xml input in a burp repeater lab.

Exploiting XML external entity (XXE) via image file uploads, this lab demonstrates using an SVG payload processed by Apache Batik to trigger external file reads and bypass filters.

Explore server-side request forgery (ssrf) and filter bypass through an open redirect vulnerability. See how open redirects can reach a private admin panel and enable xref or cross-site scripting opportunities.

Practice confirming a CL.TE vulnerability through HTTP request smuggling by crafting a smuggled request with content-length and transfer-encoding, observing a second 404 response.

Demonstrates http request smuggling to confirm a TE.CL vulnerability via differential responses between front-end and back-end servers lacking chunked encoding, using a smuggled post to trigger a 404.

Explore exploiting http request smuggling to deliver reflected xss by abusing the user agent header, validating reflection, and using Burp Suite tools like Repeater and extension smuggler.

Explore response queue poisoning via http2 request smuggling in a burp academy lab, showing how smuggled requests capture administrator cookies to access the admin panel and delete a user.

Demonstrates http/2 request smuggling via carriage return line feed injection, exploiting header sanitization flaws between http/2 front end and http/1.1 back end using transfer encoding to reveal a vulnerability.