PortSwigger Web Security Academy labs solved with curl.https://curlswiggerlabs.echoesofwhoami.com/en-ushttps://curlswiggerlabs.echoesofwhoami.com/remote-code-execution-via-server-side-prototype-pollution/https://curlswiggerlabs.echoesofwhoami.com/remote-code-execution-via-server-side-prototype-pollution/From 2015 with the standard ES6, the fiction of classes was half baked into sugar syntax on top of the prototype mess so developers could write class MyObject {...} and pretend they were in Java. Today we'll see how to exploit the foundation of this language to achieve Remote Code ExecutionSat, 01 Aug 2026 00:00:00 GMTPrototype Pollutionhttps://curlswiggerlabs.echoesofwhoami.com/http-request-smuggling-confirming-cl-te-via-differential-responses/https://curlswiggerlabs.echoesofwhoami.com/http-request-smuggling-confirming-cl-te-via-differential-responses/Confirm a CL.TE desync by controlling raw HTTP/1.1 bytes and turning a smuggled request prefix into a differential 404 response.Sun, 26 Jul 2026 00:00:00 GMTHTTP Request Smugglinghttps://curlswiggerlabs.echoesofwhoami.com/jwt-authentication-bypass-via-unverified-signature/https://curlswiggerlabs.echoesofwhoami.com/jwt-authentication-bypass-via-unverified-signature/How to exploit a server that doesn't verify JWT signatures by simply modifying the token payload to impersonate the administrator and bypass authentication.Tue, 18 Mar 2025 00:00:00 GMTJWThttps://curlswiggerlabs.echoesofwhoami.com/jwt-authentication-bypass-via-algorithm-confusion/https://curlswiggerlabs.echoesofwhoami.com/jwt-authentication-bypass-via-algorithm-confusion/How to exploit a JWT algorithm confusion vulnerability by switching from RS256 to HS256 and using the server's public key as the HMAC symmetric secret to forge administrator tokens.Thu, 13 Mar 2025 00:00:00 GMTJWThttps://curlswiggerlabs.echoesofwhoami.com/jwt-authentication-bypass-via-kid-header-path-traversal/https://curlswiggerlabs.echoesofwhoami.com/jwt-authentication-bypass-via-kid-header-path-traversal/How to exploit a path traversal vulnerability in the JWT kid header parameter to forge administrator tokens by pointing the key lookup to /dev/null.Thu, 13 Mar 2025 00:00:00 GMTJWThttps://curlswiggerlabs.echoesofwhoami.com/oauth-account-hijacking-via-redirect-uri/https://curlswiggerlabs.echoesofwhoami.com/oauth-account-hijacking-via-redirect-uri/How to exploit a misconfigured OAuth provider that doesn't validate the redirect_uri parameter, allowing an attacker to steal authorization codes and hijack user accounts.Tue, 04 Mar 2025 00:00:00 GMTOAuthhttps://curlswiggerlabs.echoesofwhoami.com/jwt-authentication-bypass-via-weak-signing-key/https://curlswiggerlabs.echoesofwhoami.com/jwt-authentication-bypass-via-weak-signing-key/How to exploit weak JWT signing keys by bruteforcing the secret to forge administrator tokens and bypass authentication.Thu, 27 Feb 2025 00:00:00 GMTJWThttps://curlswiggerlabs.echoesofwhoami.com/php-deserialization-arbitrary-object-injection/https://curlswiggerlabs.echoesofwhoami.com/php-deserialization-arbitrary-object-injection/How to exploit PHP insecure deserialization to inject arbitrary objects and trigger magic methods for remote file deletion.Sat, 22 Feb 2025 00:00:00 GMTObject Injection (PHP)https://curlswiggerlabs.echoesofwhoami.com/ssrf-filter-bypass-open-redirection/https://curlswiggerlabs.echoesofwhoami.com/ssrf-filter-bypass-open-redirection/How to bypass SSRF filters using an open redirection vulnerability, exploiting a chained attack to access internal admin interfaces.Thu, 20 Feb 2025 00:00:00 GMTSSRF