Writeups

Vulnerability writeups

Every category from PortSwigger's Web Security Academy — 30 categories, ~270 labs in total. Lab counts are accurate as of this page's last update; individual writeups are added here as each lab is completed.

Server-Side Topics

SQL Injection

18 labs

Writeups coming soon

Authentication

14 labs

Writeups coming soon

Path Traversal

6 labs

Writeups coming soon

Command Injection

5 labs

Writeups coming soon

Business Logic Vulnerabilities

11 labs

Writeups coming soon

Information Disclosure

5 labs

Writeups coming soon

Access Control

13 labs

Writeups coming soon

File Upload Vulnerabilities

7 labs

Writeups coming soon

Race Conditions

6 labs

Writeups coming soon

Server-Side Request Forgery (SSRF)

7 labs

Writeups coming soon

XXE Injection

9 labs

Writeups coming soon

NoSQL Injection

4 labs

Writeups coming soon

API Testing

5 labs

Writeups coming soon

Web Cache Deception

5 labs

Writeups coming soon

Client-Side Topics

Cross-Site Scripting (XSS)

30 labs

Writeups coming soon

Cross-Site Request Forgery (CSRF)

12 labs

Writeups coming soon

Cross-Origin Resource Sharing (CORS)

3 labs

Writeups coming soon

Clickjacking

5 labs

Writeups coming soon

DOM-Based Vulnerabilities

7 labs

Writeups coming soon

WebSockets

3 labs

Writeups coming soon

Advanced Topics

Insecure Deserialization

10 labs

Writeups coming soon

Web LLM Attacks

7 labs

Writeups coming soon

GraphQL API Vulnerabilities

5 labs

Writeups coming soon

Server-Side Template Injection

7 labs

Writeups coming soon

Web Cache Poisoning

13 labs

Writeups coming soon

HTTP Host Header Attacks

7 labs

Writeups coming soon

HTTP Request Smuggling

22 labs

Writeups coming soon

OAuth Authentication

6 labs

Writeups coming soon

JWT Attacks

8 labs

Writeups coming soon

Prototype Pollution

10 labs

Writeups coming soon

Essential Skills

2 labs

Writeups coming soon

Categories and lab counts sourced from portswigger.net/web-security/all-topics. As writeups are published, each lab will get its own page linked from its category card.