> ## Content Index > Fetch the complete content index at: https://niklas-heringer.com/llms.txt > Use this file to discover other available public pages before exploring further. # A Small Prep Session: PortSwigger Beginner Labs - URL: https://niklas-heringer.com/penetration-testing/exam-prep-three/ - Published: 2025-07-17T15:31:00.000Z - Updated: 2025-11-19T18:36:43.000Z - Description: A short and focused session working through some beginner-level labs from PortSwigger, revisiting the fundamentals of web vulnerabilities like XSS, SQLi, and authentication bypasses. - Author: Niklas Heringer - Tags: exam-prep, portswigger, xss, sql-injection, penetration-testing Welcome back you guys to my final preparation round for the upcoming *penetration testing exam tomorrow.* > Let us walk through some nice *exercises, labs and tutorials*, let's checkout writeups and what else we can do to prepare a bit. # PortSwigger Lab: Path Traversal Let's start out with [this PortSwigger Lab](https://portswigger.net/web-security/file-path-traversal/lab-simple?ref=niklas-heringer.com). ![portswigger_path_traversal_parameter.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_path_traversal_parameter.png) The base traversal payloads of `product?productId=/etc/passwd` or `product?productId=../../../../../etc/passwd` do not work. In the code i find: `` This seems to be another `GET` parameter. ![portswigger_path_traversal_shadows.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_path_traversal_shadows.png) > Aha so it would've returned it to us if it did exist ![portswigger_path_traversal_solved.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_path_traversal_solved.png) Yep, there we go. The next step could've been e.g. encoding our path traversal, as nicely outlined in [this great article](https://www.yeswehack.com/learn-bug-bounty/practical-guide-path-traversal-attacks?ref=niklas-heringer.com). # PortSwigger Lab: Remote code execution via web shell upload Next up is [this pretty lab](https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload?ref=niklas-heringer.com). This time, we're provided login creds, we'll now use to log in. ![portswigger_file_upload_logged_in.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_file_upload_logged_in.png) There is the **vulnerable file upload hehe.** > We'll **create a test file** and catch the request with burpsuite, because remember: **FIRST, always use something as a normal user would.** Don't directly throw stuff against it. ```bash touch test.php # returns: The file avatars/test.php has been uploaded. ``` okay, let's try the webshell: ```bash ``` ![portswigger_file_upload_webshell.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_file_upload_webshell.png) > I had to click on the non-loading image and select "Open in new Tab". There you'd find the path is actually `files/avatars/shell.php`. ![portswigger_file_upload_webshell_success.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_file_upload_webshell_success.png) Then we can just `cat /home/carlos/secret` as instructed on the page. **NICE.** # PortSwigger Lab: SQL Injection vulnerability allowing login bypass ![portswigger_sql_injection_auth_bypass_site.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_sql_injection_auth_bypass_site.png) ```sql username: administrator' OR 1=1 -- - password: any you want ``` > That did the job. We hand in the `administrator` account name, close the field with `'`, connect a definitely true statement afterwards with `OR`, then commenting out the rest with `--`; after that we had an extra ` -` cause an empty comment is not always valid so you need something actually in the comment. # PortSwigger Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data ![portswigger_sql_injection_where_vuln.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_sql_injection_where_vuln.png) > Select "**URL-encode as you type**" by right-click in burpsuite, so we can write the following payload: ```sql Gifts' AND released = 0 -- - ``` this did indeed show an unreleased item buut i guess they wanted all, so: ```sql ' OR released = 0 -- - ``` did the job! ## PortSwigger Lab: OS command injection ![portswigger_command_injection.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_command_injection.png) The setup mentions something about the **stock checker**. ![portswigger_command_injection_solved.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_command_injection_solved.png) That was straight-forward. # PortSwigger Lab: Unprotected admin functionality ![portswigger_unprotected_admin_func_site.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_unprotected_admin_func_site.png) > **Why am i screenshotting everything?** As a best practice, you should do that in all your engagements. Here i actually didn't know how to proceed. Let's take a look at `/robots.txt` as the hints argue. ![portswigger_unprotected_admin_func_robots.png](https://storage.ghost.io/c/a1/92/a19235e1-df52-43a1-9f25-1151fdb92c82/content/images/2025/11/portswigger_unprotected_admin_func_robots.png) > We visited that and boom - looking for the `/robots.txt` so directly seems.. idk, i'll have to think about that one. Along with those, i just went through my notes a bit. I think i'll leave it at that for today. It was a pleasure, **as always**.