Categoría: Portswigger Lab

Exploiting NoSQL operator injection to extract unknown fields

Exploiting NoSQL injection to extract data

Exploiting NoSQL operator injection to bypass authentication

Detecting NoSQL injection

Stored XSS into anchor href attribute with double quotes HTML-encoded

Reflected XSS into attribute with angle brackets HTML-encoded

DOM XSS in jQuery selector sink using a hashchange event

Web shell upload via obfuscated file extension

Manipulating WebSocket messages to exploit vulnerabilities

Blind SSRF with out-of-band detection