Burp Web Security Academy - Practitioner Labs Walkthrough

Determine the number of columns in a sql injection union attack on the category filter by using union select with null values and url encoding.

Identify the number of columns in a union-based sql injection and find the text-capable column. Retrieve the string from that column and verify by rendering it.

Illustrates a union-based sql injection attack to retrieve data from other tables, including usernames and passwords from the users table, and demonstrates using those credentials to access the administrator account.

Demonstrates a union-based sql injection to retrieve multiple columns by concatenating username and password into a single column using pipes and tilde as a separator.

Explore practical sql injection techniques to query Oracle database type and version using union select and from dual, and exfiltrate the banner with Oracle-specific commands.

Master SQL injection techniques to query the database type and version on MySQL and Microsoft SQL, using union-based exfiltration and the Microsoft-specific hash syntax.

Explore sql injection techniques on non-oracle databases to enumerate tables and columns using information_schema. Retrieve usernames and passwords from a users table via union-based queries.

Perform an Oracle SQL injection to enumerate tables and columns, identify the users and password fields, and exfiltrate credentials to access the administrator login.

Learn blind sql injection with conditional responses by exploiting a tracking ID cookie. Follow steps using sqlmap and burp tools to verify tables, usernames, and passwords.

Master blind sql injection with conditional errors by testing the tracking id cookie and case statements, then automate administrator password discovery with sqlmap and burp intruder on Oracle.

Explore blind sql injection with time delays in PostgreSQL, using pg_sleep to demonstrate time-based vulnerability without full database dumps—a common bug bounty tactic.

Explore blind sql injection with time delays to extract database information using time-based conditions, sleep tests, and sqlmap, targeting cookies and administrator credentials.

Learn how to perform blind sql injection with out-of-band interaction using burp collaborator to trigger external dns lookups via xml external entity injection against an oracle database.

Demonstrates blind SQL injection with out-of-band data exfiltration using an external collaborator domain to exfiltrate the administrator password from the users table.

Explore sql injection with filter bypass via xml encoding, showing how a web application firewall can be circumvented using burp extensions to test a stock check vulnerability.

Tackle a visible error-based sql injection lab that reveals a tracking cookie vulnerability, and learn to exfiltrate the administrator password from the users table via targeted queries.

Demonstrates a dom xss vulnerability using location search and document.write sink inside a select element, showing how unsanitized user input can be reflected as page content.

Explore a client-side dom xss in AngularJS expressions using angle brackets and html-encoded quotes. Test NG app attributes and curly brace expressions to trigger an xss payload in the dom.

Examine a reflected dom xss lab that traces how untrusted input flows from a source through an insecure function and eval, enabling a javascript payload via ajax and json results.

Bypass a one-shot html escape filter to trigger an alert via a comment payload, illustrating a dom-based xss and a sanitization logic flaw.

Exfiltrate cookies through cross-site scripting using Burp Collaborator payloads to demonstrate a stored XSS attack. Impersonate users by stealing the secret and session cookies for potential account takeover.

Through a hands-on lab, this lecture demonstrates how cross-site scripting can capture passwords by exfiltrating usernames and passwords via a crafted input field and Burp Collaborator payloads.

Explore how cross-site scripting can be chained to execute CSRF attacks and enable account takeover, including reading and using CSRF tokens to change user emails.

Explore reflected XSS in an HTML context with blocked tags and attributes, identify allowed tags, and craft event-driven payloads to execute in the victim's context.

Explore reflected cross-site scripting in an HTML context with all common tags blocked, using a custom tag with onfocus to bypass filters, and deliver a payload via an iframe.

Explore reflected XSS in SVG markup by brute forcing SVG tags and events to craft a payload that triggers an alert, using Burp Intruder and URL decoding techniques.

Learn how a reflected cross-site scripting payload in a canonical link tag bypasses escaping of angle brackets using access key and onClick, demonstrated through Burp Repeater with Chrome-specific behavior.

Demonstrate a reflected cross-site scripting in a JavaScript string by escaping the single quote and backslash, and inject an unsanitized script tag to execute the payload.

Explore exploiting a reflected XSS in a JavaScript string by testing HTML-encoded angle brackets and quotes, bypassing filters to trigger an alert via Burp Repeater.

Explore a stored XSS vulnerability in a blog's onclick event, where angle brackets and double quotes are HTML-encoded, and learn how encoded payloads can bypass filters to trigger scripts.

Explore a reflected XSS vulnerability inside a JavaScript template literal, where backticks, angle brackets, quotes, and Unicode escaped characters bypass filters, revealing how unsanitized input can execute code.

Explore the sea surf lab to understand how CSRF token validation can depend on the request method, and how switching from post to get can bypass the token with proof-of-concept.

Examine cross-site request forgery in the Burp Web Security Academy lab, showing how csrf token presence governs protection and how removing the token enables an email change.

Illustrates how cross-site request forgery tokens not tied to a user session enable attack via token reuse across two sessions, with a practical POC using Burp and an exploit server.

Explore a cross-site request forgery where the csrf key is tied to a non-session cookie, enabling attacker-controlled token reuse and cookie injection via a proof-of-concept request.

Explore how a csrf token duplicated in a cookie enables token reuse and cookie injection to perform an email update via a crafted payload.

Demonstrates how sameSite lax can be bypassed via method override to facilitate a CSRF-style attack in a controlled lab, highlighting cookie behavior and attack vectors.

Explore how SameSite Strict cookies prevent CSRF and how attackers can exploit client-side redirects and misconfigurations to bypass defenses, including cookie attributes, redirects, and get vs post vulnerabilities.

Discover how a same-site strict bypass via a sibling domain enables exfiltration of chat data through cross-site websocket hijacking, demonstrated with burp collaborator.

Explore how SameSite lax cookies can be bypassed during an OAuth login by forcing a cookie refresh within the first 120 seconds, enabling a csrf-like email-change exploit.

Demonstrates a csrf vulnerability where referrer validation fails when the header is missing, and shows how a no-referrer meta tag enables bypass to alter a victim's email.

Uncover a CSRF vulnerability caused by broken referrer validation, showing how partial domain checks with evil.com enable exploitation, with a POC using Push State and a referrer policy unsafe URL.

This lab shows exploiting clickjacking to trigger dom-based xss via an unprotected x-frame header in a submit feedback form, using an iframe to pass payloads through get and post requests.

Conduct a multi-step clickjacking attack to force a delete-account confirmation flow through an iframe overlay, coordinating clicks across pages and different browsers.

Explore DOM XSS using web messages by demonstrating unvalidated origins and unsanitized inputs through postMessage between a page and an iframe, enabling DOM access exploits.

Demonstrates a dom-based xss lab using web messages and a javascript url, showing how missing sanitization in an iframe flow can trigger a print action.

Demonstrates a DOM XSS attack using web messages and JSON.parse within an iframe, exploiting unsanitized URLs and a JavaScript payload delivered via postMessage.

Demonstrate a dom-based open redirect by manipulating a URL parameter via an onClick event to redirect users to a chosen page. Verify the vulnerability by redirecting to an exploit server.

Explore dom-based cookie manipulation by showing how recently visited product cookies can trigger a cross-site scripting payload via an iframe and onload, exploiting cookie poisoning.

Explore how a cors misconfiguration with trusted insecure protocols enables an attacker to exfiltrate an administrator api key by chaining xss and cross-domain requests across vulnerable subdomains.

Demonstrate blind xxe with out-of-band interaction by injecting an external entity into xml input, triggering burp collaborator dns and http requests as a proof-of-concept.

Explore blind XXE attacks using XML parameter entities, declare and reference them with the percent sign, and verify out-of-band DNS interaction in a Burp Suite lab walkthrough.

Demonstrate exploiting blind xxe to exfiltrate data using a malicious external DTD, showing the external entity attack flow with Burp collaborator verification.

Learn to exploit blind xxy to retrieve data via error messages by hosting an external dtd and triggering error outputs through xml input in a burp repeater lab.

Learn how XInclude can bypass partial XML controls to retrieve files, demonstrated via a crafted payload that reads /etc/passwd using Burp scanner-assisted testing.

Exploiting XML external entity (XXE) via image file uploads, this lab demonstrates using an SVG payload processed by Apache Batik to trigger external file reads and bypass filters.

Demonstrates server side request forgery by bypassing a blacklist input filter to access localhost and delete a user via obfuscated, url-encoded payloads targeting the admin panel.

Explore server-side request forgery (ssrf) and filter bypass through an open redirect vulnerability. See how open redirects can reach a private admin panel and enable xref or cross-site scripting opportunities.

Master blind ssrf with out-of-band detection by modifying the referrer header to trigger Burp collaborator interactions, revealing DNS requests and an HTTP GET.

Learn about http request smuggling using the cl.te vulnerability. The lab demonstrates encoding disagreements between front-end and back-end servers and how to smuggle a request using content-length and transfer-encoding headers.

Explore http request smuggling through the te.cl vulnerability, where transfer encoding on the front end interacts with content length on the back end to smuggle a post.

Explore http request smuggling by obfuscating the transfer-encoding header to show how duplicate headers affect front-end and back-end servers, and detect it with the http smuggler extension.

Practice confirming a CL.TE vulnerability through HTTP request smuggling by crafting a smuggled request with content-length and transfer-encoding, observing a second 404 response.

Demonstrates http request smuggling to confirm a TE.CL vulnerability via differential responses between front-end and back-end servers lacking chunked encoding, using a smuggled post to trigger a 404.

Demonstrate exploiting HTTP request smuggling via CL.TE to bypass front end security, smuggling a request to access an admin panel, verify deletion, and render the admin interface.

Exploit http request smuggling to bypass front-end security controls and delete the user Carlos via a TCL-assisted attack using content-length and chunked encoding.

Explore exploiting http request smuggling to reveal front-end request rewriting, bypass the admin panel with a smuggled header, and perform a get request to delete a user.

Explore http request smuggling concepts in a hands-on lab, revealing how vulnerable back-end and front-end handling can expose cookies and session data, with timing considerations and practical challenges.

Explore exploiting http request smuggling to deliver reflected xss by abusing the user agent header, validating reflection, and using Burp Suite tools like Repeater and extension smuggler.

Explore response queue poisoning via http2 request smuggling in a burp academy lab, showing how smuggled requests capture administrator cookies to access the admin panel and delete a user.

Demonstrate http/2 request splitting via carriage return line feed injection to 1.1 back-ends, exploiting header sanitization failures to smuggle requests and compromise an administrator session to reach the admin panel.

Explore h2 cl request smuggling by detecting how an unsanitized content-length in http/2 front ends can be smuggled to an http/1.1 back end, enabling redirects and document.cookie alerts.

Demonstrates http/2 request smuggling via carriage return line feed injection, exploiting header sanitization flaws between http/2 front end and http/1.1 back end using transfer encoding to reveal a vulnerability.

Explore cl0 request smuggling by downgrading to http 1.0, exploiting a backend that ignores content-length on a static file, using burp repeater tab groups to smuggle and delete Carlos.