Personal notes and cheat sheets from PortSwigger Web Security Academy labs, organized by vulnerability category.
44 labs solved across 11 categories — new labs solved and published daily. Business Logic Vulnerabilities in progress.
Each file covers one category. Every solved lab gets logged as: Approach → Why → Tool.
- Access Control — 13 labs
- Authentication Failures — 6 labs
- SQL Injection — 5 labs
- XSS (Cross-Site Scripting) — 5 labs
- SSRF (Server-Side Request Forgery) — 4 labs
- CSRF (Cross-Site Request Forgery) — 4 labs
- Security Misconfiguration — 1 lab (includes CORS)
- Path Traversal — 1 lab
- Cryptographic Failures — 1 lab (includes JWT signature bypass)
- Insecure Deserialization — 1 lab
- Business Logic Vulnerabilities/Flaws — 3 labs
Each entry follows this structure:
## Category: <Category> → <Lab name>
**Approach:** <what I did, what is the exact approach I take>
**Why:** <why it worked / the underlying concept>
**Tool:** <tools used>