A clear path, with real depth
Start with the idea, then follow it down to the protocol detail that actually matters.
CurlSwiggerLabs
Learn web security by understanding the request.
Beginner-friendly explanations that still inspect the bytes, headers, and curl flags that make an exploit work.
What you get
Requests you can see
curl, small Python scripts, and raw HTTP instead of a stream of unexplained Repeater screenshots.
Exploits and fixes
Solve PortSwigger labs, then look at the parser, validation, or design mistake a builder should fix.
Lab writeups
Pick a category. Every writeup rebuilds the attack one request at a time and explains why it works.
DOM-based
Exploiting DOM Clobbering to Enable XSS
The sanitizer blocks every script tag. The browser doesn't care: it has been silently wiring element ids straight onto window since before sanitizers existed. Two allowed anchor tags, one obscure URI scheme, and a double-quote that shouldn't survive... But it does.
Read writeupPrototype Pollution
Remote Code Execution via Server-Side Prototype Pollution
From 2015 with the standard ES6, the fiction of classes was half baked into sugar syntax on top of the prototype mess so developers could write class MyObject {...} and pretend they were in Java. Today we'll see how to exploit the foundation of this language to achieve Remote Code Execution
Read writeupHTTP Request Smuggling
HTTP Request Smuggling: Confirming CL.TE via Differential Responses
Confirm a CL.TE desync by controlling raw HTTP/1.1 bytes and turning a smuggled request prefix into a differential 404 response.
Read writeupJWT
JWT Authentication Bypass via Unverified Signature
How to exploit a server that doesn't verify JWT signatures by simply modifying the token payload to impersonate the administrator and bypass authentication.
Read writeupJWT Authentication Bypass via Algorithm Confusion
How to exploit a JWT algorithm confusion vulnerability by switching from RS256 to HS256 and using the server's public key as the HMAC symmetric secret to forge administrator tokens.
Read writeupJWT Authentication Bypass via kid Header Path Traversal
How to exploit a path traversal vulnerability in the JWT kid header parameter to forge administrator tokens by pointing the key lookup to /dev/null.
Read writeupJWT Authentication Bypass via Weak Signing Key
How to exploit weak JWT signing keys by bruteforcing the secret to forge administrator tokens and bypass authentication.
Read writeupOAuth
OAuth Account Hijacking via redirect_uri
How to exploit a misconfigured OAuth provider that doesn't validate the redirect_uri parameter, allowing an attacker to steal authorization codes and hijack user accounts.
Read writeupObject Injection (PHP)
Arbitrary Object Injection in PHP (Insecure Deserialization)
How to exploit PHP insecure deserialization to inject arbitrary objects and trigger magic methods for remote file deletion.
Read writeupSSRF
SSRF Filter Bypass via Open Redirection
How to bypass SSRF filters using an open redirection vulnerability, exploiting a chained attack to access internal admin interfaces.
Read writeup