Burp Web Security Academy - Practitioner Labs Walkthrough

Identify the number of columns in a union-based sql injection and find the text-capable column. Retrieve the string from that column and verify by rendering it.

Illustrates a union-based sql injection attack to retrieve data from other tables, including usernames and passwords from the users table, and demonstrates using those credentials to access the administrator account.

Demonstrates a union-based sql injection to retrieve multiple columns by concatenating username and password into a single column using pipes and tilde as a separator.

Explore practical sql injection techniques to query Oracle database type and version using union select and from dual, and exfiltrate the banner with Oracle-specific commands.

Master SQL injection techniques to query the database type and version on MySQL and Microsoft SQL, using union-based exfiltration and the Microsoft-specific hash syntax.

Explore sql injection techniques on non-oracle databases to enumerate tables and columns using information_schema. Retrieve usernames and passwords from a users table via union-based queries.

Master blind sql injection with conditional errors by testing the tracking id cookie and case statements, then automate administrator password discovery with sqlmap and burp intruder on Oracle.

Explore blind sql injection with time delays to extract database information using time-based conditions, sleep tests, and sqlmap, targeting cookies and administrator credentials.

Explore sql injection with filter bypass via xml encoding, showing how a web application firewall can be circumvented using burp extensions to test a stock check vulnerability.

Demonstrates a dom xss vulnerability using location search and document.write sink inside a select element, showing how unsanitized user input can be reflected as page content.

Explore a client-side dom xss in AngularJS expressions using angle brackets and html-encoded quotes. Test NG app attributes and curly brace expressions to trigger an xss payload in the dom.

Examine a reflected dom xss lab that traces how untrusted input flows from a source through an insecure function and eval, enabling a javascript payload via ajax and json results.

Explore how cross-site scripting can be chained to execute CSRF attacks and enable account takeover, including reading and using CSRF tokens to change user emails.

Explore reflected cross-site scripting in an HTML context with all common tags blocked, using a custom tag with onfocus to bypass filters, and deliver a payload via an iframe.

Explore exploiting a reflected XSS in a JavaScript string by testing HTML-encoded angle brackets and quotes, bypassing filters to trigger an alert via Burp Repeater.

Explore a stored XSS vulnerability in a blog's onclick event, where angle brackets and double quotes are HTML-encoded, and learn how encoded payloads can bypass filters to trigger scripts.

Explore the sea surf lab to understand how CSRF token validation can depend on the request method, and how switching from post to get can bypass the token with proof-of-concept.

Examine cross-site request forgery in the Burp Web Security Academy lab, showing how csrf token presence governs protection and how removing the token enables an email change.

Illustrates how cross-site request forgery tokens not tied to a user session enable attack via token reuse across two sessions, with a practical POC using Burp and an exploit server.

Explore a cross-site request forgery where the csrf key is tied to a non-session cookie, enabling attacker-controlled token reuse and cookie injection via a proof-of-concept request.

Explore how a csrf token duplicated in a cookie enables token reuse and cookie injection to perform an email update via a crafted payload.

Demonstrates how sameSite lax can be bypassed via method override to facilitate a CSRF-style attack in a controlled lab, highlighting cookie behavior and attack vectors.

Explore how SameSite Strict cookies prevent CSRF and how attackers can exploit client-side redirects and misconfigurations to bypass defenses, including cookie attributes, redirects, and get vs post vulnerabilities.

Discover how a same-site strict bypass via a sibling domain enables exfiltration of chat data through cross-site websocket hijacking, demonstrated with burp collaborator.

Explore how SameSite lax cookies can be bypassed during an OAuth login by forcing a cookie refresh within the first 120 seconds, enabling a csrf-like email-change exploit.

Demonstrates a csrf vulnerability where referrer validation fails when the header is missing, and shows how a no-referrer meta tag enables bypass to alter a victim's email.

This lab shows exploiting clickjacking to trigger dom-based xss via an unprotected x-frame header in a submit feedback form, using an iframe to pass payloads through get and post requests.

Conduct a multi-step clickjacking attack to force a delete-account confirmation flow through an iframe overlay, coordinating clicks across pages and different browsers.

Demonstrates a DOM XSS attack using web messages and JSON.parse within an iframe, exploiting unsanitized URLs and a JavaScript payload delivered via postMessage.

Demonstrate a dom-based open redirect by manipulating a URL parameter via an onClick event to redirect users to a chosen page. Verify the vulnerability by redirecting to an exploit server.

Explore dom-based cookie manipulation by showing how recently visited product cookies can trigger a cross-site scripting payload via an iframe and onload, exploiting cookie poisoning.

Demonstrate blind xxe with out-of-band interaction by injecting an external entity into xml input, triggering burp collaborator dns and http requests as a proof-of-concept.

Demonstrate exploiting blind xxe to exfiltrate data using a malicious external DTD, showing the external entity attack flow with Burp collaborator verification.

Learn to exploit blind xxy to retrieve data via error messages by hosting an external dtd and triggering error outputs through xml input in a burp repeater lab.

Exploiting XML external entity (XXE) via image file uploads, this lab demonstrates using an SVG payload processed by Apache Batik to trigger external file reads and bypass filters.

Explore server-side request forgery (ssrf) and filter bypass through an open redirect vulnerability. See how open redirects can reach a private admin panel and enable xref or cross-site scripting opportunities.

Master blind ssrf with out-of-band detection by modifying the referrer header to trigger Burp collaborator interactions, revealing DNS requests and an HTTP GET.

Learn about http request smuggling using the cl.te vulnerability. The lab demonstrates encoding disagreements between front-end and back-end servers and how to smuggle a request using content-length and transfer-encoding headers.

Explore http request smuggling by obfuscating the transfer-encoding header to show how duplicate headers affect front-end and back-end servers, and detect it with the http smuggler extension.

Practice confirming a CL.TE vulnerability through HTTP request smuggling by crafting a smuggled request with content-length and transfer-encoding, observing a second 404 response.

Demonstrates http request smuggling to confirm a TE.CL vulnerability via differential responses between front-end and back-end servers lacking chunked encoding, using a smuggled post to trigger a 404.

Exploit http request smuggling to bypass front-end security controls and delete the user Carlos via a TCL-assisted attack using content-length and chunked encoding.

Explore exploiting http request smuggling to reveal front-end request rewriting, bypass the admin panel with a smuggled header, and perform a get request to delete a user.

Explore http request smuggling concepts in a hands-on lab, revealing how vulnerable back-end and front-end handling can expose cookies and session data, with timing considerations and practical challenges.

Explore exploiting http request smuggling to deliver reflected xss by abusing the user agent header, validating reflection, and using Burp Suite tools like Repeater and extension smuggler.

Explore response queue poisoning via http2 request smuggling in a burp academy lab, showing how smuggled requests capture administrator cookies to access the admin panel and delete a user.

Explore h2 cl request smuggling by detecting how an unsanitized content-length in http/2 front ends can be smuggled to an http/1.1 back end, enabling redirects and document.cookie alerts.

Demonstrates http/2 request smuggling via carriage return line feed injection, exploiting header sanitization flaws between http/2 front end and http/1.1 back end using transfer encoding to reveal a vulnerability.