# WEB

## WEB

- [La Biblia del Hacking en Web](https://books.spartan-cybersec.com/web/la-biblia-del-hacking-en-web.md): Desarrollado por Spartan-Cybersecurity
- [ADVERTENCIA](https://books.spartan-cybersec.com/web/la-biblia-del-hacking-en-web/advertencia.md)
- [Conoce a tu academia](https://books.spartan-cybersec.com/web/la-biblia-del-hacking-en-web/conoce-a-tu-academia.md): ¿Quienes somos?
- [Conoce a tu instructor](https://books.spartan-cybersec.com/web/la-biblia-del-hacking-en-web/conoce-a-tu-instructor.md)
- [Aprende Hacking Web con los laboratorios de PortSwigger](https://books.spartan-cybersec.com/web/la-biblia-del-hacking-en-web/aprende-hacking-web-con-los-laboratorios-de-portswigger.md)
- [¿SQL Injection?](https://books.spartan-cybersec.com/web/sql-injection/sql-injection.md)
- [Lab 1: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data](https://books.spartan-cybersec.com/web/sql-injection/lab-1-sql-injection-vulnerability-in-where-clause-allowing-retrieval-of-hidden-data.md): https://portswigger.net/web-security/sql-injection/lab-retrieve-hidden-data
- [Lab 2: SQL injection vulnerability allowing login bypass](https://books.spartan-cybersec.com/web/sql-injection/lab-2-sql-injection-vulnerability-allowing-login-bypass.md): https://portswigger.net/web-security/sql-injection/lab-login-bypass
- [Lab 3: SQL injection attack, querying the database type and version on Oracle](https://books.spartan-cybersec.com/web/sql-injection/lab-3-sql-injection-attack-querying-the-database-type-and-version-on-oracle.md): https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-oracle
- [Lab 4: SQL injection attack, querying the database type and version on MySQL and Microsoft](https://books.spartan-cybersec.com/web/sql-injection/lab-4-sql-injection-attack-querying-the-database-type-and-version-on-mysql-and-microsoft.md): https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-mysql-microsoft
- [Lab 5: SQL injection attack, listing the database contents on non-Oracle databases](https://books.spartan-cybersec.com/web/sql-injection/lab-5-sql-injection-attack-listing-the-database-contents-on-non-oracle-databases.md): https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-non-oracle
- [Lab 6: SQL injection attack, listing the database contents on Oracle](https://books.spartan-cybersec.com/web/sql-injection/lab-6-sql-injection-attack-listing-the-database-contents-on-oracle.md): https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-oracle
- [¿XSS?](https://books.spartan-cybersec.com/web/cross-site-scripting/xss.md)
- [Lab 1: Reflected XSS into HTML context with nothing encoded](https://books.spartan-cybersec.com/web/cross-site-scripting/lab-1-reflected-xss-into-html-context-with-nothing-encoded.md): https://portswigger.net/web-security/cross-site-scripting/reflected/lab-html-context-nothing-encoded
- [Lab 2: Stored XSS into HTML context with nothing encoded](https://books.spartan-cybersec.com/web/cross-site-scripting/lab-2-stored-xss-into-html-context-with-nothing-encoded.md): https://portswigger.net/web-security/cross-site-scripting/stored/lab-html-context-nothing-encoded
- [Lab 3: DOM XSS in document.write sink using source location.search](https://books.spartan-cybersec.com/web/cross-site-scripting/lab-3-dom-xss-in-document.write-sink-using-source-location.search.md): https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink
- [Lab 4: DOM XSS in innerHTML sink using source location.search](https://books.spartan-cybersec.com/web/cross-site-scripting/lab-4-dom-xss-in-innerhtml-sink-using-source-location.search.md): https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-innerhtml-sink
- [Lab 5: DOM XSS in jQuery anchor href attribute sink using location.search source](https://books.spartan-cybersec.com/web/cross-site-scripting/lab-5-dom-xss-in-jquery-anchor-href-attribute-sink-using-location.search-source.md): https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-jquery-href-attribute-sink
- [¿Clickjacking?](https://books.spartan-cybersec.com/web/clickjacking/clickjacking.md)
- [Lab 1: Basic clickjacking with CSRF token protection](https://books.spartan-cybersec.com/web/clickjacking/lab-1-basic-clickjacking-with-csrf-token-protection.md): https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected
- [¿Control de Acceso?](https://books.spartan-cybersec.com/web/access-control-vulnerabilities/control-de-acceso.md)
- [Lab 1: Unprotected admin functionality](https://books.spartan-cybersec.com/web/access-control-vulnerabilities/lab-1-unprotected-admin-functionality.md): https://portswigger.net/web-security/access-control/lab-unprotected-admin-functionality
- [Lab 3: User role controlled by request parameter](https://books.spartan-cybersec.com/web/access-control-vulnerabilities/lab-3-user-role-controlled-by-request-parameter.md)
- [¿Path Traversal?](https://books.spartan-cybersec.com/web/path-traversal/path-traversal.md)
- [Lab 1: File path traversal, simple case](https://books.spartan-cybersec.com/web/path-traversal/lab-1-file-path-traversal-simple-case.md): https://portswigger.net/web-security/file-path-traversal/lab-simple
- [Lab 2: File path traversal, traversal sequences blocked with absolute path bypass](https://books.spartan-cybersec.com/web/path-traversal/lab-2-file-path-traversal-traversal-sequences-blocked-with-absolute-path-bypass.md): https://portswigger.net/web-security/file-path-traversal/lab-absolute-path-bypass
- [Lab 3: File path traversal, traversal sequences stripped non-recursively](https://books.spartan-cybersec.com/web/path-traversal/lab-3-file-path-traversal-traversal-sequences-stripped-non-recursively.md): https://portswigger.net/web-security/file-path-traversal/lab-sequences-stripped-non-recursively
- [¿XML external entity?](https://books.spartan-cybersec.com/web/xml-external-entity-xxe-injection/xml-external-entity.md)
- [Lab 1: Exploiting XXE using external entities to retrieve files](https://books.spartan-cybersec.com/web/xml-external-entity-xxe-injection/lab-1-exploiting-xxe-using-external-entities-to-retrieve-files.md): https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-retrieve-files
- [Lab 2: Exploiting XXE to perform SSRF attacks](https://books.spartan-cybersec.com/web/xml-external-entity-xxe-injection/lab-2-exploiting-xxe-to-perform-ssrf-attacks.md): https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-perform-ssrf
- [Lab 3: Blind XXE with out-of-band interaction](https://books.spartan-cybersec.com/web/xml-external-entity-xxe-injection/lab-3-blind-xxe-with-out-of-band-interaction.md): https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-interaction
- [¿JWT?](https://books.spartan-cybersec.com/web/jwt/jwt.md)
- [Lab 1: JWT authentication bypass via unverified signature](https://books.spartan-cybersec.com/web/jwt/lab-1-jwt-authentication-bypass-via-unverified-signature.md): https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-unverified-signature
- [Lab 2: JWT authentication bypass via flawed signature verification](https://books.spartan-cybersec.com/web/jwt/lab-2-jwt-authentication-bypass-via-flawed-signature-verification.md): https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-flawed-signature-verification
- [Lab 3: JWT authentication bypass via weak signing key](https://books.spartan-cybersec.com/web/jwt/lab-3-jwt-authentication-bypass-via-weak-signing-key.md): https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-weak-signing-key
- [Lab 4: JWT authentication bypass via jwk header injection](https://books.spartan-cybersec.com/web/jwt/lab-4-jwt-authentication-bypass-via-jwk-header-injection.md): https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jwk-header-injection
- [Lab 5: JWT authentication bypass via jku header injection](https://books.spartan-cybersec.com/web/jwt/lab-5-jwt-authentication-bypass-via-jku-header-injection.md): https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jku-header-injection
- [¿SSRF?](https://books.spartan-cybersec.com/web/server-side-request-forgery-ssrf/ssrf.md)
- [Lab 1: Basic SSRF against the local server](https://books.spartan-cybersec.com/web/server-side-request-forgery-ssrf/lab-1-basic-ssrf-against-the-local-server.md)
- [¿OS Command Injection?](https://books.spartan-cybersec.com/web/os-command-injection/os-command-injection.md)
- [Lab 1: OS command injection, simple case](https://books.spartan-cybersec.com/web/os-command-injection/lab-1-os-command-injection-simple-case.md)
- [¿Authentication?](https://books.spartan-cybersec.com/web/authentication/authentication.md)
- [Lab 1: Username enumeration via different responses](https://books.spartan-cybersec.com/web/authentication/lab-1-username-enumeration-via-different-responses.md)
- [¿HTTP request smuggling?](https://books.spartan-cybersec.com/web/http-request-smuggling/http-request-smuggling.md)
- [Lab 1: HTTP request smuggling, confirming a CL.TE vulnerability via differential responses](https://books.spartan-cybersec.com/web/http-request-smuggling/lab-1-http-request-smuggling-confirming-a-cl.te-vulnerability-via-differential-responses.md): https://portswigger.net/web-security/request-smuggling/finding/lab-confirming-cl-te-via-differential-responses
- [¿Server-side template injection?](https://books.spartan-cybersec.com/web/server-side-template-injection/server-side-template-injection.md)
- [Lab 1: Basic server-side template injection](https://books.spartan-cybersec.com/web/server-side-template-injection/lab-1-basic-server-side-template-injection.md): https://portswigger.net/web-security/server-side-template-injection/exploiting/lab-server-side-template-injection-basic
- [Lab 1: DOM XSS using web messages](https://books.spartan-cybersec.com/web/dom-based-vulnerabilities/lab-1-dom-xss-using-web-messages.md): https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages
- [Lab 2: DOM XSS using web messages and a JavaScript URL](https://books.spartan-cybersec.com/web/dom-based-vulnerabilities/lab-2-dom-xss-using-web-messages-and-a-javascript-url.md): https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages-and-a-javascript-url
- [Lab #1: Manipulating WebSocket messages to exploit vulnerabilities](https://books.spartan-cybersec.com/web/websockets/lab-1-manipulating-websocket-messages-to-exploit-vulnerabilities.md): https://portswigger.net/web-security/websockets/lab-manipulating-messages-to-exploit-vulnerabilities
- [¿Prototype Pollution?](https://books.spartan-cybersec.com/web/prototype-pollution/prototype-pollution.md)
- [Lab 1: Client-side prototype pollution via browser APIs](https://books.spartan-cybersec.com/web/prototype-pollution/lab-1-client-side-prototype-pollution-via-browser-apis.md): https://portswigger.net/web-security/prototype-pollution/client-side/browser-apis/lab-prototype-pollution-client-side-prototype-pollution-via-browser-apis
- [Utilizando DOM Invader](https://books.spartan-cybersec.com/web/prototype-pollution/lab-1-client-side-prototype-pollution-via-browser-apis/utilizando-dom-invader.md)
- [Lab 2: DOM XSS via client-side prototype pollution](https://books.spartan-cybersec.com/web/prototype-pollution/lab-2-dom-xss-via-client-side-prototype-pollution.md): https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-dom-xss-via-client-side-prototype-pollution
- [Lab 3: DOM XSS via an alternative prototype pollution vector](https://books.spartan-cybersec.com/web/prototype-pollution/lab-3-dom-xss-via-an-alternative-prototype-pollution-vector.md): https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-dom-xss-via-an-alternative-prototype-pollution-vector
- [Utilizando DOM Invader](https://books.spartan-cybersec.com/web/prototype-pollution/lab-3-dom-xss-via-an-alternative-prototype-pollution-vector/utilizando-dom-invader.md)
- [Lab 4: Client-side prototype pollution via flawed sanitization](https://books.spartan-cybersec.com/web/prototype-pollution/lab-4-client-side-prototype-pollution-via-flawed-sanitization.md): https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-client-side-prototype-pollution-via-flawed-sanitization
- [Lab 5: Client-side prototype pollution in third-party libraries](https://books.spartan-cybersec.com/web/prototype-pollution/lab-5-client-side-prototype-pollution-in-third-party-libraries.md): https://portswigger.net/web-security/prototype-pollution/client-side/lab-prototype-pollution-client-side-prototype-pollution-in-third-party-libraries
- [Lab 6: Privilege escalation via server-side prototype pollution](https://books.spartan-cybersec.com/web/prototype-pollution/lab-6-privilege-escalation-via-server-side-prototype-pollution.md): https://portswigger.net/web-security/prototype-pollution/server-side/lab-privilege-escalation-via-server-side-prototype-pollution
- [Lab 7: Detecting server-side prototype pollution without polluted property reflection](https://books.spartan-cybersec.com/web/prototype-pollution/lab-7-detecting-server-side-prototype-pollution-without-polluted-property-reflection.md): https://portswigger.net/web-security/prototype-pollution/server-side/lab-detecting-server-side-prototype-pollution-without-polluted-property-reflection
- [Lab 8: Bypassing flawed input filters for server-side prototype pollution](https://books.spartan-cybersec.com/web/prototype-pollution/lab-8-bypassing-flawed-input-filters-for-server-side-prototype-pollution.md): https://portswigger.net/web-security/prototype-pollution/server-side/lab-bypassing-flawed-input-filters-for-server-side-prototype-pollution
- [Lab 9: Remote code execution via server-side prototype pollution](https://books.spartan-cybersec.com/web/prototype-pollution/lab-9-remote-code-execution-via-server-side-prototype-pollution.md): https://portswigger.net/web-security/prototype-pollution/server-side/lab-remote-code-execution-via-server-side-prototype-pollution
- [Lab 10: Exfiltrating sensitive data via server-side prototype pollution](https://books.spartan-cybersec.com/web/prototype-pollution/lab-10-exfiltrating-sensitive-data-via-server-side-prototype-pollution.md): https://portswigger.net/web-security/prototype-pollution/server-side/lab-exfiltrating-sensitive-data-via-server-side-prototype-pollution
- [Lab 1: Accessing private GraphQL posts](https://books.spartan-cybersec.com/web/graphql/lab-1-accessing-private-graphql-posts.md): https://portswigger.net/web-security/graphql/lab-graphql-reading-private-posts
- [Lab 1: Web cache poisoning with an unkeyed header](https://books.spartan-cybersec.com/web/web-cache-poisoning/lab-1-web-cache-poisoning-with-an-unkeyed-header.md): https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-with-an-unkeyed-header
- [Lab #2 - CORS vulnerability with trusted null origin](https://books.spartan-cybersec.com/web/cors/lab-2-cors-vulnerability-with-trusted-null-origin.md): https://portswigger.net/web-security/cors/lab-null-origin-whitelisted-attack
- [Lab 3: CORS vulnerability with trusted insecure protocols](https://books.spartan-cybersec.com/web/cors/lab-3-cors-vulnerability-with-trusted-insecure-protocols.md): https://portswigger.net/web-security/cors/lab-breaking-https-attack
- [Lab #1: Exploiting an API endpoint using documentation](https://books.spartan-cybersec.com/web/api-testing/lab-1-exploiting-an-api-endpoint-using-documentation.md): https://portswigger.net/web-security/api-testing/lab-exploiting-api-endpoint-using-documentation
- [Lab #2: Exploiting server-side parameter pollution in a query string](https://books.spartan-cybersec.com/web/api-testing/lab-2-exploiting-server-side-parameter-pollution-in-a-query-string.md)
- [Lab #3: Finding and exploiting an unused API endpoint](https://books.spartan-cybersec.com/web/api-testing/lab-3-finding-and-exploiting-an-unused-api-endpoint.md): https://portswigger.net/web-security/api-testing/lab-exploiting-unused-api-endpoint
- [Lab #4: Exploiting a mass assignment vulnerability](https://books.spartan-cybersec.com/web/api-testing/lab-4-exploiting-a-mass-assignment-vulnerability.md): https://portswigger.net/web-security/api-testing/lab-exploiting-mass-assignment-vulnerability
- [Lab #5: Exploiting server-side parameter pollution in a REST URL](https://books.spartan-cybersec.com/web/api-testing/lab-5-exploiting-server-side-parameter-pollution-in-a-rest-url.md): https://portswigger.net/web-security/api-testing/server-side-parameter-pollution/lab-exploiting-server-side-parameter-pollution-in-rest-url