PortSwigger Academy — API Labs

Follow us on Blue Sky, Mastodon Twitter, Facebook and LinkedIn @Hackread

How Attackers Exploit Weak Access Controls & How to Defend Against It

Google Dorks are advanced search techniques that refine search results, uncover hidden information, and enhance research capabilities…

“We are what we repeatedly do. Excellence, then, is not an act, but a habit.”-Aristotle

The lab that I have worked on to experiment those methods is the one from “Escape restricted shell” on Linux privilege escalation module on…

Compromised AD via AS-REP roasting, winPEAS, and DCSync, leading to SYSTEM access and retrieval of the root flag.

By: Daniel J. Richardson III

The UK’s cybersecurity authority is advising organisations to bolster their defences against quantum computing threats by 2035, as…

I opened an account and deposited my funds. After good profits, they sent me an email about anti-money laundering and blocked my account, asking for an AML check because I deposited over $50k. They…

As technology evolves, so do cyber threats. In 2025, businesses and individuals will face increasingly sophisticated attacks, driven by AI, quantum computing, and a growing reliance on cloud and IoT…

Cybersecurity is one of the most misunderstood yet critical aspects of our digital lives.

I passed my CompTIA Security+ exam around a month ago now. I thought I would share tips and tricks to help maximise others’ chances of…

To access the machine, click on the link given below:

The “Tech_Supp0rt: 1” TryHackMe room can be found here.

It's a modern and stealthy process injection technique that involves injecting and executing code in the early stages of process creation

Arjun is HTTP Parameter Discovery Suite. This is what Arjun does, it finds valid HTTP parameters with a huge default dictionary of 25,890 parameter names.

TamaGo is a project that aims to provide compilation and execution of unencumbered Go applications for bare metal ARM System-on-Chip (SoC) components.

Medusa is an extensible framework for Android applications which automates processes and techniques practised during the malware dynamic analysis

Learn about CVE-2025-29927, a critical vulnerability in Next.js that impacts authorization checks in middleware.