Categoría: Portswigger Lab

Bypassing GraphQL brute force protections

Finding a hidden GraphQL endpoint

OAuth account hijacking via redirect_uri

Forced OAuth profile linking

SSRF via OpenID dynamic client registration

Password brute-force via password change

Password reset poisoning via middleware

Offline password cracking

Brute-forcing a stay-logged-in cookie

2FA broken logic