About CurlSwiggerLabs

CurlSwiggerLabs is a notebook for learning web security from the protocol upward. Each writeup solves a PortSwigger Web Security Academy lab while slowing down at the parts that are usually hidden behind a graphical client.

Why curl?

curl makes every important choice visible: the URL, method, headers, body, cookies, redirects, and TLS behavior. That constraint is useful. If a request only works after a particular flag or byte changes, the writeup has to explain why instead of hiding the detail in a saved Burp tab.

How the writeups work

The goal is not to avoid Burp. It remains the right proxy for inspecting traffic and the labs are solved through it when interception matters. The goal is to separate what the server receives from what any one client displays, then rebuild the exploit with small, repeatable commands or scripts.

Beginner-friendly, without skipping the protocol

Each article introduces the background needed for the lab, walks through the HTTP exchange, and finishes with mitigations for people building applications. Explanations begin with the approachable version, then keep going when headers, encodings, signatures, or parser differences deserve a closer look.