Skip to content

Back to the catalog

Fr6ey/WebSecurityAcademy
github.comrepo

Fr6ey/WebSecurityAcademy

A GitHub repo indexing solutions for PortSwigger's Web Security Academy labs, organized by difficulty, covering SQL injection, XSS, CSRF, XXE, SSRF, HTTP request smuggling, deserialization, access control, JWT, prototype pollution, GraphQL, race conditions, NoSQL injection, and LLM/AI-agent exploitation labs.

TL;DR Solutions index for PortSwigger Web Security Academy labs covering nearly every web vulnerability class.
Open original ↗
Document

What it is

This is a GitHub README that indexes solutions to PortSwigger Web Security Academy labs. Each entry is a lab title tagged Apprentice, Practitioner or Expert. The repo URL is under the account ntrunr, while the catalog title names Fr6ey.

Coverage beyond the summary

The summary lists 14 topic families. The page also covers:

  • Clickjacking, CORS, OS command injection, server-side template injection, and file path traversal.
  • Authentication (username enumeration, 2FA bypass, brute-force protection) and WebSockets.
  • Web cache poisoning and web cache deception, including cache key injection and exact-match cache rules.
  • Information disclosure, business logic flaws, and Host header attacks.
  • OAuth, file upload (web shells, polyglots, race condition), and API testing (mass assignment, server-side parameter pollution).
  • DOM-based topics: web messages, DOM clobbering, open redirection, and cookie manipulation.

Several of the newest lab types appear:

  • Smuggling variants: 0.CL, CL.0, client-side desync, and server-side pause-based smuggling.
  • HTTP/2 smuggling: H2.CL and request tunnelling.
  • Four AI agent labs: destructive actions, data exfiltration, secondary vulnerabilities, and bypassing AI scanner defenses.

The first entry is a "Mystery lab challenge".

Depth by topic

Request smuggling has about 22 labs, XSS about 30, and SQL injection 18, so these are the best-covered areas. Expert-tier labs appear in smuggling, cache poisoning, deserialization (custom Java and PHP gadget chains, PHAR), XXE (repurposing a local DTD), and prototype pollution.

Entries marked "Youtube Video" have a video walkthrough. These are the SSRF, path traversal, web cache poisoning, business logic, JWT, prototype pollution, GraphQL, race condition, NoSQL, API testing, LLM and AI agent, and web cache deception sections, plus the first deserialization lab. XSS, SQL injection, CSRF, XXE, smuggling, OAuth, file upload, and access control entries carry no video marker.

Caveats

The fetched text contains only lab titles, difficulty tags, and video markers. It shows no write-ups, payloads, or commands, so the quality and completeness of the solutions behind each entry cannot be judged from it. It also does not show whether the solutions are text, code, or links elsewhere. Check a few entries before relying on the repo as a study reference.

Technologies named here

Related in Learning