PortSwigger · Web Security Academy

Catálogo: 262 labs indexados de PortSwigger Web Security Academy. Cada lab enlaza al ejercicio oficial y a la solución de PortSwigger. La cobertura del sitemap oficial es parcial; falta XSS, autenticación, business logic y otros topics que se irán incorporando manualmente.

Access Control Vulnerabilities (13)

Lab	Dificultad	Skills	Oficial
Insecure direct object references	APPRENTICE	Access Control / IDOR	Abrir
Unprotected admin functionality	APPRENTICE	Access Control / IDOR	Abrir
Unprotected admin functionality with unpredictable URL	APPRENTICE	Access Control / IDOR	Abrir
User ID controlled by request parameter	APPRENTICE	Access Control / IDOR	Abrir
User ID controlled by request parameter with data leakage in redirect	APPRENTICE	Access Control / IDOR	Abrir
User ID controlled by request parameter with password disclosure	APPRENTICE	Access Control / IDOR	Abrir
User ID controlled by request parameter, with unpredictable user IDs	APPRENTICE	Access Control / IDOR	Abrir
User role can be modified in user profile	APPRENTICE	Access Control / IDOR	Abrir
User role controlled by request parameter	APPRENTICE	Access Control / IDOR	Abrir
Method-based access control can be circumvented	PRACTITIONER	Access Control / IDOR	Abrir
Multi-step process with no access control on one step	PRACTITIONER	Access Control / IDOR	Abrir
Referer-based access control	PRACTITIONER	Access Control / IDOR	Abrir
URL-based access control can be circumvented	PRACTITIONER	Access Control / IDOR	Abrir

API Testing (5)

Lab	Dificultad	Skills	Oficial
Exploiting an API endpoint using documentation	APPRENTICE	API Testing	Abrir
Exploiting server-side parameter pollution in a REST URL	APPRENTICE	API Testing	Abrir
Exploiting a mass assignment vulnerability	PRACTITIONER	API Testing	Abrir
Exploiting server-side parameter pollution in a query string	PRACTITIONER	API Testing	Abrir
Finding and exploiting an unused API endpoint	PRACTITIONER	API Testing	Abrir

Authentication Vulnerabilities (14)

Lab	Dificultad	Skills	Oficial
2FA bypass using a brute-force attack	APPRENTICE	Authentication Vulnerabilities · Remote Code Execution (RCE)	Abrir
2FA simple bypass	APPRENTICE	Authentication Vulnerabilities	Abrir
Broken brute-force protection, multiple credentials per request	APPRENTICE	Authentication Vulnerabilities · Remote Code Execution (RCE)	Abrir
Password reset broken logic	APPRENTICE	Authentication Vulnerabilities	Abrir
Username enumeration via different responses	APPRENTICE	Authentication Vulnerabilities	Abrir
2FA broken logic	PRACTITIONER	Authentication Vulnerabilities	Abrir
Broken brute-force protection, IP block	PRACTITIONER	Authentication Vulnerabilities · Remote Code Execution (RCE)	Abrir
Brute-forcing a stay-logged-in cookie	PRACTITIONER	Authentication Vulnerabilities	Abrir
Offline password cracking	PRACTITIONER	Authentication Vulnerabilities	Abrir
Password brute-force via password change	PRACTITIONER	Authentication Vulnerabilities · Remote Code Execution (RCE)	Abrir
Password reset poisoning via middleware	PRACTITIONER	Authentication Vulnerabilities	Abrir
Username enumeration via account lock	PRACTITIONER	Authentication Vulnerabilities	Abrir
Username enumeration via response timing	PRACTITIONER	Authentication Vulnerabilities	Abrir
Username enumeration via subtly different responses	PRACTITIONER	Authentication Vulnerabilities	Abrir

Clickjacking (5)

Lab	Dificultad	Skills	Oficial
Basic clickjacking with CSRF token protection	APPRENTICE	Clickjacking · CSRF (Cross-Site Request Forgery)	Abrir
Clickjacking with a frame buster script	APPRENTICE	Clickjacking	Abrir
Clickjacking with form input data prefilled from a URL parameter	APPRENTICE	Clickjacking	Abrir
Exploiting clickjacking vulnerability to trigger DOM-based XSS	PRACTITIONER	Clickjacking · Cross-Site Scripting (XSS)	Abrir
Multistep clickjacking	PRACTITIONER	Clickjacking	Abrir

CORS (3)

Lab	Dificultad	Skills	Oficial
CORS vulnerability with basic origin reflection	APPRENTICE	CORS (Cross-Origin Resource Sharing)	Abrir
CORS vulnerability with trusted null origin	APPRENTICE	CORS (Cross-Origin Resource Sharing)	Abrir
CORS vulnerability with trusted insecure protocols	PRACTITIONER	CORS (Cross-Origin Resource Sharing)	Abrir

Cross-Site Scripting (XSS) (28)

Lab	Dificultad	Skills	Oficial
DOM XSS in document.write sink using source location.search	APPRENTICE	Cross-Site Scripting (XSS) · Remote Code Execution (RCE)	Abrir
DOM XSS in innerHTML sink using source location.search	APPRENTICE	Cross-Site Scripting (XSS) · Remote Code Execution (RCE)	Abrir
DOM XSS in jQuery anchor href attribute sink using location.search source	APPRENTICE	Cross-Site Scripting (XSS) · Remote Code Execution (RCE)	Abrir
DOM XSS in jQuery selector sink using a hashchange event	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
Reflected XSS in a JavaScript URL with some characters blocked	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
Reflected XSS into a JavaScript string with angle brackets HTML encoded	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
Reflected XSS into attribute with angle brackets HTML-encoded	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
Reflected XSS into HTML context with nothing encoded	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
Reflected XSS protected by CSP, with CSP bypass	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
Reflected XSS with event handlers and href attributes blocked	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
Stored XSS into anchor href attribute with double quotes HTML-encoded	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
Stored XSS into HTML context with nothing encoded	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
DOM XSS in document.write sink using source location.search inside a select element	PRACTITIONER	Cross-Site Scripting (XSS) · Remote Code Execution (RCE)	Abrir
Exploiting cross-site scripting to capture passwords	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Exploiting cross-site scripting to steal cookies	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Exploiting XSS to bypass CSRF defenses	PRACTITIONER	Cross-Site Scripting (XSS) · CSRF (Cross-Site Request Forgery)	Abrir
Reflected DOM XSS	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Reflected XSS in canonical link tag	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Reflected XSS into a JavaScript string with single quote and backslash escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Reflected XSS into HTML context with all tags blocked except custom ones	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Reflected XSS into HTML context with most tags and attributes blocked	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Reflected XSS protected by very strict CSP, with dangling markup attack	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Reflected XSS with some SVG markup allowed	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Stored DOM XSS	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir

CSRF (Cross-Site Request Forgery) (12)

Lab	Dificultad	Skills	Oficial
CSRF vulnerability with no defenses	APPRENTICE	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where Referer validation depends on header being present	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token is duplicated in cookie	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token is not tied to user session	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token is tied to non-session cookie	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token validation depends on request method	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF where token validation depends on token being present	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
CSRF with broken Referer validation	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
SameSite Lax bypass via cookie refresh	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
SameSite Lax bypass via method override	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
SameSite Strict bypass via client-side redirect	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir
SameSite Strict bypass via sibling domain	PRACTITIONER	CSRF (Cross-Site Request Forgery)	Abrir

Insecure Deserialization (10)

Lab	Dificultad	Skills	Oficial
Developing a custom gadget chain for Java deserialization	APPRENTICE	Insecure Deserialization	Abrir
Developing a custom gadget chain for PHP deserialization	APPRENTICE	Insecure Deserialization	Abrir
Modifying serialized objects	APPRENTICE	Insecure Deserialization	Abrir
Using PHAR deserialization to deploy a custom gadget chain	APPRENTICE	Insecure Deserialization	Abrir
Arbitrary object injection in PHP	PRACTITIONER	Insecure Deserialization	Abrir
Exploiting Java deserialization with Apache Commons	PRACTITIONER	Insecure Deserialization	Abrir
Exploiting PHP deserialization with a pre-built gadget chain	PRACTITIONER	Insecure Deserialization	Abrir
Exploiting Ruby deserialization using a documented gadget chain	PRACTITIONER	Insecure Deserialization	Abrir
Modifying serialized data types	PRACTITIONER	Insecure Deserialization	Abrir
Using application functionality to exploit insecure deserialization	PRACTITIONER	Insecure Deserialization	Abrir

DOM-based Vulnerabilities (7)

Lab	Dificultad	Skills	Oficial
Clobbering DOM attributes to bypass HTML filters	APPRENTICE	Clobbering DOM attributes to bypass HTML filters DOM-based Vulnerabilities	Abrir
Exploiting DOM clobbering to enable XSS	APPRENTICE	Cross-Site Scripting (XSS)	Abrir
DOM XSS using web messages	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
DOM XSS using web messages and a JavaScript URL	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
DOM XSS using web messages and JSON.parse	PRACTITIONER	Cross-Site Scripting (XSS)	Abrir
DOM-based cookie manipulation	PRACTITIONER	DOM-based cookie manipulation DOM-based Vulnerabilities	Abrir
DOM-based open redirection	PRACTITIONER	DOM-based open redirection DOM-based Vulnerabilities	Abrir

Essential Skills (2)

Lab	Dificultad	Skills	Oficial
Discovering vulnerabilities quickly with targeted scanning	PRACTITIONER	Discovering vulnerabilities quickly with targeted scanning Essential Skills	Abrir
Scanning non-standard data structures	PRACTITIONER	Scanning non-standard data structures Essential Skills	Abrir

Directory / Path Traversal (6)

Lab	Dificultad	Skills	Oficial
File path traversal, simple case	APPRENTICE	Directory / Path Traversal	Abrir
File path traversal, traversal sequences blocked with absolute path bypass	PRACTITIONER	Directory / Path Traversal	Abrir
File path traversal, traversal sequences stripped non-recursively	PRACTITIONER	Directory / Path Traversal	Abrir
File path traversal, traversal sequences stripped with superfluous URL-decode	PRACTITIONER	Directory / Path Traversal	Abrir
File path traversal, validation of file extension with null byte bypass	PRACTITIONER	Directory / Path Traversal	Abrir
File path traversal, validation of start of path	PRACTITIONER	Directory / Path Traversal	Abrir

File Upload Vulnerabilities (7)

Lab	Dificultad	Skills	Oficial
Remote code execution via web shell upload	APPRENTICE	File Upload Vulnerabilities · Remote Code Execution (RCE)	Abrir
Web shell upload via Content-Type restriction bypass	APPRENTICE	File Upload Vulnerabilities	Abrir
Web shell upload via race condition	APPRENTICE	File Upload Vulnerabilities · Race Conditions	Abrir
Remote code execution via polyglot web shell upload	PRACTITIONER	File Upload Vulnerabilities · Remote Code Execution (RCE)	Abrir
Web shell upload via extension blacklist bypass	PRACTITIONER	File Upload Vulnerabilities	Abrir
Web shell upload via obfuscated file extension	PRACTITIONER	File Upload Vulnerabilities	Abrir
Web shell upload via path traversal	PRACTITIONER	File Upload Vulnerabilities · Directory / Path Traversal	Abrir

GraphQL (5)

Lab	Dificultad	Skills	Oficial
Accessing private GraphQL posts	APPRENTICE	GraphQL Vulnerabilities	Abrir
Accidental exposure of private GraphQL fields	PRACTITIONER	GraphQL Vulnerabilities	Abrir
Bypassing GraphQL brute force protections	PRACTITIONER	Brute Force / Rate-Limit Bypass · GraphQL Vulnerabilities · Remote Code Execution (RCE)	Abrir
Finding a hidden GraphQL endpoint	PRACTITIONER	GraphQL Vulnerabilities	Abrir
Performing CSRF exploits over GraphQL	PRACTITIONER	GraphQL Vulnerabilities · CSRF (Cross-Site Request Forgery)	Abrir

HTTP Host Header Attacks (5)

Lab	Dificultad	Skills	Oficial
Host header authentication bypass	APPRENTICE	Authentication Vulnerabilities · HTTP Host Header Attacks	Abrir
Host validation bypass via connection state attack	PRACTITIONER	HTTP Host Header Attacks	Abrir
Routing-based SSRF	PRACTITIONER	HTTP Host Header Attacks · Server-Side Request Forgery	Abrir
SSRF via flawed request parsing	PRACTITIONER	HTTP Host Header Attacks · Server-Side Request Forgery	Abrir
Web cache poisoning via ambiguous requests	PRACTITIONER	Web Cache Attacks (Poisoning / Deception) · HTTP Host Header Attacks	Abrir

Information Disclosure (5)

Lab	Dificultad	Skills	Oficial
Authentication bypass via information disclosure	APPRENTICE	Information Leakage · Authentication Vulnerabilities	Abrir
Information disclosure in error messages	APPRENTICE	Information Leakage	Abrir
Information disclosure on debug page	APPRENTICE	Information Leakage	Abrir
Source code disclosure via backup files	APPRENTICE	Information Leakage · Remote Code Execution (RCE)	Abrir
Information disclosure in version control history	PRACTITIONER	Information Leakage	Abrir

JWT (JSON Web Tokens) (8)

Lab	Dificultad	Skills	Oficial
JWT authentication bypass via algorithm confusion	APPRENTICE	Authentication Vulnerabilities · JSON Web Tokens (JWT)	Abrir
JWT authentication bypass via algorithm confusion with no exposed key	APPRENTICE	Authentication Vulnerabilities · JSON Web Tokens (JWT)	Abrir
JWT authentication bypass via flawed signature verification	APPRENTICE	Authentication Vulnerabilities · JSON Web Tokens (JWT)	Abrir
JWT authentication bypass via unverified signature	APPRENTICE	Authentication Vulnerabilities · JSON Web Tokens (JWT)	Abrir
JWT authentication bypass via jku header injection	PRACTITIONER	Authentication Vulnerabilities · JSON Web Tokens (JWT)	Abrir
JWT authentication bypass via jwk header injection	PRACTITIONER	Authentication Vulnerabilities · JSON Web Tokens (JWT)	Abrir
JWT authentication bypass via kid header path traversal	PRACTITIONER	Authentication Vulnerabilities · JSON Web Tokens (JWT) · Directory / Path Traversal	Abrir
JWT authentication bypass via weak signing key	PRACTITIONER	Authentication Vulnerabilities · JSON Web Tokens (JWT)	Abrir

LLM Attacks (8)

Lab	Dificultad	Skills	Oficial
Exploiting AI agents to exfiltrate sensitive information	APPRENTICE	LLM Attacks (Prompt Injection)	Abrir
Exploiting AI agents to perform destructive actions	APPRENTICE	LLM Attacks (Prompt Injection)	Abrir
Exploiting insecure output handling in LLMs	APPRENTICE	LLM Attacks (Prompt Injection)	Abrir
Exploiting LLM APIs with excessive agency	APPRENTICE	LLM Attacks (Prompt Injection)	Abrir
Bypassing AI scanner defenses to exfiltrate sensitive information	PRACTITIONER	LLM Attacks (Prompt Injection)	Abrir
Exploiting AI agents to trigger secondary vulnerabilities	PRACTITIONER	LLM Attacks (Prompt Injection)	Abrir
Exploiting vulnerabilities in LLM APIs	PRACTITIONER	LLM Attacks (Prompt Injection)	Abrir
Indirect prompt injection	PRACTITIONER	LLM Attacks (Prompt Injection)	Abrir

Business Logic Vulnerabilities (12)

Lab	Dificultad	Skills	Oficial
Bypassing access controls using email address parsing discrepancies	APPRENTICE	Business Logic Vulnerabilities · Access Control / IDOR	Abrir
Excessive trust in client-side controls	APPRENTICE	Business Logic Vulnerabilities	Abrir
Flawed enforcement of business rules	APPRENTICE	Business Logic Vulnerabilities · Remote Code Execution (RCE)	Abrir
High-level logic vulnerability	APPRENTICE	Business Logic Vulnerabilities	Abrir
Inconsistent security controls	APPRENTICE	Business Logic Vulnerabilities	Abrir
Authentication bypass via encryption oracle	PRACTITIONER	Authentication Vulnerabilities · Business Logic Vulnerabilities	Abrir
Authentication bypass via flawed state machine	PRACTITIONER	Authentication Vulnerabilities · Business Logic Vulnerabilities	Abrir
Inconsistent handling of exceptional input	PRACTITIONER	Business Logic Vulnerabilities	Abrir
Infinite money logic flaw	PRACTITIONER	Business Logic Vulnerabilities	Abrir
Insufficient workflow validation	PRACTITIONER	Business Logic Vulnerabilities	Abrir
Low-level logic flaw	PRACTITIONER	Business Logic Vulnerabilities	Abrir
Weak isolation on dual-use endpoint	PRACTITIONER	Business Logic Vulnerabilities	Abrir

NoSQL Injection (4)

Lab	Dificultad	Skills	Oficial
Detecting NoSQL injection	APPRENTICE	SQL Injection	Abrir
Exploiting NoSQL operator injection to bypass authentication	APPRENTICE	SQL Injection	Abrir
Exploiting NoSQL injection to extract data	PRACTITIONER	SQL Injection	Abrir
Exploiting NoSQL operator injection to extract unknown fields	PRACTITIONER	SQL Injection	Abrir

OAuth Authentication (6)

Lab	Dificultad	Skills	Oficial
Authentication bypass via OAuth implicit flow	APPRENTICE	Authentication Vulnerabilities · OAuth Authentication Vulnerabilities	Abrir
Stealing OAuth access tokens via a proxy page	APPRENTICE	OAuth Authentication Vulnerabilities	Abrir
Forced OAuth profile linking	PRACTITIONER	OAuth Authentication Vulnerabilities · Remote Code Execution (RCE)	Abrir
OAuth account hijacking via redirect_uri	PRACTITIONER	OAuth Authentication Vulnerabilities	Abrir
SSRF via OpenID dynamic client registration	PRACTITIONER	OAuth Authentication Vulnerabilities · Server-Side Request Forgery	Abrir
Stealing OAuth access tokens via an open redirect	PRACTITIONER	OAuth Authentication Vulnerabilities	Abrir

OS Command Injection (5)

Lab	Dificultad	Skills	Oficial
OS command injection, simple case	APPRENTICE	OS Command Injection	Abrir
Blind OS command injection with out-of-band data exfiltration	PRACTITIONER	OS Command Injection	Abrir
Blind OS command injection with out-of-band interaction	PRACTITIONER	OS Command Injection	Abrir
Blind OS command injection with output redirection	PRACTITIONER	OS Command Injection	Abrir
Blind OS command injection with time delays	PRACTITIONER	OS Command Injection	Abrir

Prototype Pollution (9)

Lab	Dificultad	Skills	Oficial
Exfiltrating sensitive data via server-side prototype pollution	APPRENTICE	Prototype Pollution	Abrir
Bypassing flawed input filters for server-side prototype pollution	PRACTITIONER	Prototype Pollution	Abrir
Client-side prototype pollution in third-party libraries	PRACTITIONER	Prototype Pollution	Abrir
Client-side prototype pollution via flawed sanitization	PRACTITIONER	Prototype Pollution	Abrir
Detecting server-side prototype pollution without polluted property reflection	PRACTITIONER	Prototype Pollution	Abrir
DOM XSS via an alternative prototype pollution vector	PRACTITIONER	Prototype Pollution · Cross-Site Scripting (XSS)	Abrir
DOM XSS via client-side prototype pollution	PRACTITIONER	Prototype Pollution · Cross-Site Scripting (XSS)	Abrir
Privilege escalation via server-side prototype pollution	PRACTITIONER	Prototype Pollution	Abrir
Remote code execution via server-side prototype pollution	PRACTITIONER	Remote Code Execution (RCE) · Prototype Pollution	Abrir

Race Conditions (6)

Lab	Dificultad	Skills	Oficial
Limit overrun race conditions	APPRENTICE	Race Conditions	Abrir
Partial construction race conditions	APPRENTICE	Race Conditions	Abrir
Bypassing rate limits via race conditions	PRACTITIONER	Race Conditions	Abrir
Exploiting time-sensitive vulnerabilities	PRACTITIONER	Race Conditions	Abrir
Multi-endpoint race conditions	PRACTITIONER	Race Conditions	Abrir
Single-endpoint race conditions	PRACTITIONER	Race Conditions	Abrir

HTTP Request Smuggling (16)

Lab	Dificultad	Skills	Oficial
0.CL request smuggling	APPRENTICE	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to perform web cache deception	APPRENTICE	HTTP Request Smuggling · Web Cache Attacks (Poisoning / Deception)	Abrir
Exploiting HTTP request smuggling to perform web cache poisoning	APPRENTICE	HTTP Request Smuggling · Web Cache Attacks (Poisoning / Deception)	Abrir
Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability	PRACTITIONER	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability	PRACTITIONER	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to capture other users’ requests	PRACTITIONER	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to deliver reflected XSS	PRACTITIONER	HTTP Request Smuggling · Cross-Site Scripting (XSS)	Abrir
Exploiting HTTP request smuggling to reveal front-end request rewriting	PRACTITIONER	HTTP Request Smuggling	Abrir
H2.CL request smuggling	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, basic CL.TE vulnerability	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, basic TE.CL vulnerability	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, confirming a CL.TE vulnerability via differential responses	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, confirming a TE.CL vulnerability via differential responses	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, obfuscating the TE header	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP/2 request smuggling via CRLF injection	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP/2 request splitting via CRLF injection	PRACTITIONER	HTTP Request Smuggling	Abrir

Server-Side Template Injection (SSTI) (7)

Lab	Dificultad	Skills	Oficial
Server-side template injection in a sandboxed environment	APPRENTICE	SSTI (Server-Side Template Injection)	Abrir
Server-side template injection with a custom exploit	APPRENTICE	SSTI (Server-Side Template Injection)	Abrir
Basic server-side template injection	PRACTITIONER	SSTI (Server-Side Template Injection)	Abrir
Basic server-side template injection (code context)	PRACTITIONER	SSTI (Server-Side Template Injection)	Abrir
Server-side template injection in an unknown language with a documented exploit	PRACTITIONER	SSTI (Server-Side Template Injection)	Abrir
Server-side template injection using documentation	PRACTITIONER	SSTI (Server-Side Template Injection)	Abrir
Server-side template injection with information disclosure via user-supplied objects	PRACTITIONER	SSTI (Server-Side Template Injection) · Information Leakage	Abrir

SQL Injection (18)

Lab	Dificultad	Skills	Oficial
SQL injection vulnerability allowing login bypass	APPRENTICE	SQL Injection	Abrir
SQL injection vulnerability in WHERE clause allowing retrieval of hidden data	APPRENTICE	SQL Injection	Abrir
Blind SQL injection with conditional errors	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with conditional responses	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with out-of-band data exfiltration	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with out-of-band interaction	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with time delays	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with time delays and information retrieval	PRACTITIONER	SQL Injection	Abrir
SQL injection attack, listing the database contents on non-Oracle databases	PRACTITIONER	SQL Injection	Abrir
SQL injection attack, listing the database contents on Oracle	PRACTITIONER	SQL Injection	Abrir
SQL injection attack, querying the database type and version on MySQL and Microsoft	PRACTITIONER	SQL Injection	Abrir
SQL injection attack, querying the database type and version on Oracle	PRACTITIONER	SQL Injection	Abrir
SQL injection UNION attack, determining the number of columns returned by the query	PRACTITIONER	SQL Injection	Abrir
SQL injection UNION attack, finding a column containing text	PRACTITIONER	SQL Injection	Abrir
SQL injection UNION attack, retrieving data from other tables	PRACTITIONER	SQL Injection	Abrir
SQL injection UNION attack, retrieving multiple values in a single column	PRACTITIONER	SQL Injection	Abrir
SQL injection with filter bypass via XML encoding	PRACTITIONER	SQL Injection	Abrir
Visible error-based SQL injection	PRACTITIONER	SQL Injection	Abrir

SSRF (Server-Side Request Forgery) (7)

Lab	Dificultad	Skills	Oficial
Basic SSRF against another back-end system	APPRENTICE	Server-Side Request Forgery	Abrir
Basic SSRF against the local server	APPRENTICE	Server-Side Request Forgery	Abrir
Blind SSRF with Shellshock exploitation	APPRENTICE	Shellshock (CVE-2014-6271) · Server-Side Request Forgery	Abrir
SSRF with whitelist-based input filter	APPRENTICE	Server-Side Request Forgery	Abrir
Blind SSRF with out-of-band detection	PRACTITIONER	Server-Side Request Forgery	Abrir
SSRF with blacklist-based input filter	PRACTITIONER	Server-Side Request Forgery	Abrir
SSRF with filter bypass via open redirection vulnerability	PRACTITIONER	Server-Side Request Forgery	Abrir

Web Cache Deception (5)

Lab	Dificultad	Skills	Oficial
Exploiting exact-match cache rules for web cache deception	APPRENTICE	Web Cache Attacks (Poisoning / Deception)	Abrir
Exploiting path mapping for web cache deception	APPRENTICE	Web Cache Attacks (Poisoning / Deception)	Abrir
Exploiting cache server normalization for web cache deception	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Exploiting origin server normalization for web cache deception	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Exploiting path delimiters for web cache deception	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir

Web Cache Poisoning (13)

Lab	Dificultad	Skills	Oficial
Cache key injection	APPRENTICE	Web Cache Attacks (Poisoning / Deception)	Abrir
Combining web cache poisoning vulnerabilities	APPRENTICE	Web Cache Attacks (Poisoning / Deception)	Abrir
Internal cache poisoning	APPRENTICE	Web Cache Attacks (Poisoning / Deception)	Abrir
Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria	APPRENTICE	Web Cache Attacks (Poisoning / Deception)	Abrir
Parameter cloaking	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Targeted web cache poisoning using an unknown header	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
URL normalization	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Web cache poisoning via a fat GET request	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Web cache poisoning via an unkeyed query parameter	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Web cache poisoning via an unkeyed query string	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Web cache poisoning with an unkeyed cookie	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Web cache poisoning with an unkeyed header	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir
Web cache poisoning with multiple headers	PRACTITIONER	Web Cache Attacks (Poisoning / Deception)	Abrir

WebSockets (2)

Lab	Dificultad	Skills	Oficial
Manipulating WebSocket messages to exploit vulnerabilities	APPRENTICE	WebSockets Vulnerabilities	Abrir
Manipulating the WebSocket handshake to exploit vulnerabilities	PRACTITIONER	WebSockets Vulnerabilities	Abrir

XXE (XML External Entity) (9)

Lab	Dificultad	Skills	Oficial
Exploiting XXE to perform SSRF attacks	APPRENTICE	XML External Entity · Server-Side Request Forgery	Abrir
Exploiting XXE to retrieve data by repurposing a local DTD	APPRENTICE	XML External Entity	Abrir
Exploiting XXE using external entities to retrieve files	APPRENTICE	XML External Entity	Abrir
Blind XXE with out-of-band interaction	PRACTITIONER	XML External Entity	Abrir
Blind XXE with out-of-band interaction via XML parameter entities	PRACTITIONER	XML External Entity	Abrir
Exploiting blind XXE to exfiltrate data using a malicious external DTD	PRACTITIONER	XML External Entity	Abrir
Exploiting blind XXE to retrieve data via error messages	PRACTITIONER	XML External Entity	Abrir
Exploiting XInclude to retrieve files	PRACTITIONER	XML External Entity	Abrir
Exploiting XXE via image file upload	PRACTITIONER	XML External Entity · File Upload Vulnerabilities	Abrir

Última actualización: 2026-05-08

​PortSwigger · Web Security Academy

​Access Control Vulnerabilities (13)

​API Testing (5)

​Authentication Vulnerabilities (14)

​Clickjacking (5)

​CORS (3)

​Cross-Site Scripting (XSS) (28)

​CSRF (Cross-Site Request Forgery) (12)

​Insecure Deserialization (10)

​DOM-based Vulnerabilities (7)

​Essential Skills (2)

​Directory / Path Traversal (6)

​File Upload Vulnerabilities (7)

​GraphQL (5)

​HTTP Host Header Attacks (5)

​Information Disclosure (5)

​JWT (JSON Web Tokens) (8)

​LLM Attacks (8)

​Business Logic Vulnerabilities (12)

​NoSQL Injection (4)

​OAuth Authentication (6)

​OS Command Injection (5)

​Prototype Pollution (9)

​Race Conditions (6)

​HTTP Request Smuggling (16)

​Server-Side Template Injection (SSTI) (7)

​SQL Injection (18)

​SSRF (Server-Side Request Forgery) (7)

​Web Cache Deception (5)

​Web Cache Poisoning (13)

​WebSockets (2)

​XXE (XML External Entity) (9)