SUMMARY.md

Table of contents

• ✍️ Writeups and Walkthroughs
• THM
  • Simple CTF
  • RootMe
  • Eternal Blue
  • Vulnversity
  • Pickle Rick
  • Brooklyn Nine Nine
  • Kenobi
  • Bounty Hacker
  • Overpass
  • LazyAdmin
  • Ignite
  • Bolt
  • Agent Sudo
  • Anonymous
  • Startup
  • Wgel
  • Lian_Yu
  • Blog
  • ColdBox
  • H4cked
  • Smag Grotto
  • Ice
  • Blaster
  • The Sticker Shop
  • 🔟 OWASP
    • 1️⃣ Injection
  • Active Directory Basics
  • Attacktive Directory
  • Post-Exploitation Basics
• HackTheBox
  • Bank
  • Active
  • Devel
  • Delivery
  • Analytics
  • Bashed
  • Valentine
  • Sau
  • Sunday
  • Cap
• Vulnhub
  • Brainpain (BoF)
• DockerLabs
  • Trust
  • Upload
  • Vacaciones
• DVWA
  • Install and configure DVWA
  • Command Injection
  • CSRF
  • File Inclusion
  • SQL Injection
  • SQLi Blind
• Mutillidae II
  • Install & configure OWASP Mutillidae II
  • SQLi
    • SQLi Login Bypass
    • Extracting Data
    • Finding Number of Columns
    • Pivoting with SQL injection
  • Command Injection
    • Extracting User Accounts
    • Web Shell
  • IDOR & File Inclusion
    • Edit Another User's Profile
    • Extracting User Accounts
    • Extracting User Accounts with Local File Inclusion
    • Web Shell with Remote File Inclusion (RFI)
  • XSS
    • XSS Reflected
    • XSS Stored
    • XSS DOM-Based
• Secure Bank
  • Install & configure Secure Bank
  • -----
    • SQLi Login Bypass
    • Extracting Data
    • Finding Number of Columns
    • Pivoting with SQL injection
  • -----
    • Extracting User Accounts
    • Web Shell
  • IDOR & File Inclusion
    • Edit Another User's Profile
    • Extracting User Accounts
    • Extracting User Accounts with Local File Inclusion
    • Web Shell with Remote File Inclusion (RFI)
  • XSS
    • XSS Reflected
    • XSS Stored
    • XSS DOM-Based
• PortSwigger - Web Security Academy
  • Burp Suite Config
  • Server-side vulnerabilities
    • Path traversal
      • File path traversal, simple case
    • Access control
      • Unprotected admin functionality
      • Unprotected admin functionality with unpredictable URL
      • User role controlled by request parameter
      • User ID controlled by request parameter, with unpredictable user IDs
      • User ID controlled by request parameter with password disclosure
    • Authentication
    • Server-side request forgery (SSRF)
    • File upload vulnerabilities
    • OS command injection
    • SQL injection
  • SQL Injection (SQLi)
    • SQLi Login Bypass
    • Extracting Data
    • Finding Number of Columns
    • Pivoting with SQL injection
  • -----
    • Extracting User Accounts
    • Web Shell
  • XSS
    • XSS Reflected
    • XSS Stored
    • XSS DOM-Based