Insecure Deserialization #6 | Exploiting PHP deserialization with a pre-built gadget chain | 2026 CryptHawk

3 views - 7 hours ago

Multi-step Process With No Access Control On One Step | [Access Control Lab 12] [PortSwigger] [2026] CryptHawk

15 views - 1 month ago

Broken Brute-force Protection, Multiple Credentials Per Request | [Hackvertor] [Burp CE] [2026] CryptHawk

27 views - 2 months ago

User role can be modified in user profile | [PortSwigger] [Broken Access Control] [2026] CryptHawk

18 views - 1 month ago

Password Brute-force via Password Change | [Turbo Intruder] [Burp CE] [2026] CryptHawk

62 views - 2 months ago

Offline Password Cracking | [PortSwigger] [Burp CE] [2026] CryptHawk

46 views - 2 months ago

Insecure Direct Object References | [PortSwigger] [Burp] [2026] CryptHawk

30 views - 1 month ago

Brute Forcing A Stay Logged In Cookie | [OWASP ZAP] [2026] CryptHawk

32 views - 2 months ago

Unprotected Admin Functionality | [Portswigger] [Broken Access Control] [2026] CryptHawk

21 views - 2 months ago

User role controlled by request parameter | [Portswigger] [Broken Access Control] [2026] CryptHawk

38 views - 1 month ago

User ID Controlled by request parameter with data leakage in redirect |[PortSwigger] [Burp] [2026] CryptHawk

14 views - 1 month ago

Insecure Deserialization Lab #5 | Exploiting Java deserialization with Apache Commons | PortSwigger CryptHawk

13 views - 3 days ago

User ID controlled by request parameter with password disclosure |[PortSwigger] [Burp] [2026] CryptHawk

40 views - 1 month ago

Infinite Money Logic Flaw | [PortSwigger] [Burp] [Turbo Intruder] [2026] CryptHawk

84 views - 1 month ago

Referer Based Access Control | [Access Control Lab #13] [PortSwigger] [2026] CryptHawk

21 views - 1 month ago

2FA Bypass Using a Brute-force Attack | [Turbo Intruder] [Burp CE] [2026] CryptHawk

263 views - 2 months ago

User ID Controlled By Request Parameter, With Unpredictable User IDs | [PortSwigger] [2026] CryptHawk

14 views - 1 month ago

Method Based Access Control Can Be Circumvented | [Access Control Lab #11] [PortSwigger] [2026] CryptHawk

15 views - 1 month ago

Username Enumeration via Response Timing |[BURP CE] [FFUF] [FAST] [2026] CryptHawk

51 views - 2 months ago

URL-Based Access Control Can Be Circumvented | [Access Control Lab #10] [PortSwigger] [2026] CryptHawk

33 views - 1 month ago