Diego Fidalgo (chengo): write-upsTechnical write-ups: labs, CTFs, exams and the paths in between.https://chengo.dev/enPortSwigger Academy Labs Walkthroughhttps://chengo.dev/writeups/portswigger_walkthrough/https://chengo.dev/writeups/portswigger_walkthrough/A walkthrough series of PortSwigger Web Security Academy labs, covering the topics included in the Burp Suite Certified Practitioner (BSCP) exam.Mon, 31 Aug 2026 08:30:01 GMTwalkthroughportswiggerbscpPortSwigger Walkthrough - Exploiting AI agents to perform destructive actionshttps://chengo.dev/writeups/web-llm-ai-agents-destructive-actions/https://chengo.dev/writeups/web-llm-ai-agents-destructive-actions/Walkthrough of PortSwigger's 'Exploiting AI agents to perform destructive actions' lab.Mon, 31 Aug 2026 08:30:00 GMTwalkthroughportswiggerbscpweb-llmPortSwigger Walkthrough - Exploiting AI agents to exfiltrate sensitive informationhttps://chengo.dev/writeups/web-llm-ai-agents-exfiltrate-info/https://chengo.dev/writeups/web-llm-ai-agents-exfiltrate-info/Walkthrough of PortSwigger's 'Exploiting AI agents to exfiltrate sensitive information' lab.Mon, 31 Aug 2026 08:30:00 GMTwalkthroughportswiggerbscpweb-llmPortSwigger Walkthrough - Exploiting AI agents to trigger secondary vulnerabilitieshttps://chengo.dev/writeups/web-llm-ai-agents-trigger-secondary-vulns/https://chengo.dev/writeups/web-llm-ai-agents-trigger-secondary-vulns/Walkthrough of PortSwigger's 'Exploiting AI agents to trigger secondary vulnerabilities' lab.Mon, 31 Aug 2026 08:30:00 GMTwalkthroughportswiggerbscpweb-llmPortSwigger Walkthrough - Exploiting LLM APIs with excessive agencyhttps://chengo.dev/writeups/web-llm-apis-excessive-agency/https://chengo.dev/writeups/web-llm-apis-excessive-agency/Walkthrough of PortSwigger's 'Exploiting LLM APIs with excessive agency' lab.Mon, 31 Aug 2026 08:30:00 GMTwalkthroughportswiggerbscpweb-llmPortSwigger Walkthrough - Bypassing AI scanner defenses to exfiltrate sensitive informationhttps://chengo.dev/writeups/web-llm-bypassing-ai-scanner-defenses/https://chengo.dev/writeups/web-llm-bypassing-ai-scanner-defenses/Walkthrough of PortSwigger's 'Bypassing AI scanner defenses to exfiltrate sensitive information' lab.Mon, 31 Aug 2026 08:30:00 GMTwalkthroughportswiggerbscpweb-llmPortSwigger Walkthrough - Exploiting vulnerabilities in LLM APIshttps://chengo.dev/writeups/web-llm-exploiting-vulns-llm-apis/https://chengo.dev/writeups/web-llm-exploiting-vulns-llm-apis/Walkthrough of PortSwigger's 'Exploiting vulnerabilities in LLM APIs' lab.Mon, 31 Aug 2026 08:30:00 GMTwalkthroughportswiggerbscpweb-llmPortSwigger Walkthrough - Indirect prompt injectionhttps://chengo.dev/writeups/web-llm-indirect-prompt-injection/https://chengo.dev/writeups/web-llm-indirect-prompt-injection/Walkthrough of PortSwigger's 'Indirect prompt injection' lab.Mon, 31 Aug 2026 08:30:00 GMTwalkthroughportswiggerbscpweb-llmPortSwigger Walkthrough - CORS vulnerability with basic origin reflectionhttps://chengo.dev/writeups/cors-basic-origin-reflection/https://chengo.dev/writeups/cors-basic-origin-reflection/Walkthrough of PortSwigger's 'CORS vulnerability with basic origin reflection' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpcorsPortSwigger Walkthrough - CORS vulnerability with trusted insecure protocolshttps://chengo.dev/writeups/cors-trusted-insecure-protocols/https://chengo.dev/writeups/cors-trusted-insecure-protocols/Walkthrough of PortSwigger's 'CORS vulnerability with trusted insecure protocols' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpcorsPortSwigger Walkthrough - CORS vulnerability with trusted null originhttps://chengo.dev/writeups/cors-trusted-null-origin/https://chengo.dev/writeups/cors-trusted-null-origin/Walkthrough of PortSwigger's 'CORS vulnerability with trusted null origin' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpcorsPortSwigger Walkthrough - Basic SSRF against another back-end systemhttps://chengo.dev/writeups/ssrf-basic-against-backend-system/https://chengo.dev/writeups/ssrf-basic-against-backend-system/Walkthrough of PortSwigger's 'Basic SSRF against another back-end system' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpssrfPortSwigger Walkthrough - Basic SSRF against the local serverhttps://chengo.dev/writeups/ssrf-basic-against-local-server/https://chengo.dev/writeups/ssrf-basic-against-local-server/Walkthrough of PortSwigger's 'Basic SSRF against the local server' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpssrfPortSwigger Walkthrough - SSRF with blacklist-based input filterhttps://chengo.dev/writeups/ssrf-blacklist-input-filter/https://chengo.dev/writeups/ssrf-blacklist-input-filter/Walkthrough of PortSwigger's 'SSRF with blacklist-based input filter' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpssrfPortSwigger Walkthrough - Blind SSRF with out-of-band detectionhttps://chengo.dev/writeups/ssrf-blind-outofband-detection/https://chengo.dev/writeups/ssrf-blind-outofband-detection/Walkthrough of PortSwigger's 'Blind SSRF with out-of-band detection' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpssrfPortSwigger Walkthrough - SSRF with filter bypass via open redirection vulnerabilityhttps://chengo.dev/writeups/ssrf-bypass-open-redirection/https://chengo.dev/writeups/ssrf-bypass-open-redirection/Walkthrough of PortSwigger's 'SSRF with filter bypass via open redirection vulnerability' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpssrfPortSwigger Walkthrough - Cross-site WebSocket hijackinghttps://chengo.dev/writeups/websockets-cross-site-websocket-hijacking/https://chengo.dev/writeups/websockets-cross-site-websocket-hijacking/Walkthrough of PortSwigger's 'Cross-site WebSocket hijacking' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpweb-socketsPortSwigger Walkthrough - Manipulating the WebSocket handshake to exploit vulnerabilitieshttps://chengo.dev/writeups/websockets-manipulating-handshake/https://chengo.dev/writeups/websockets-manipulating-handshake/Walkthrough of PortSwigger's 'Manipulating the WebSocket handshake to exploit vulnerabilities' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpweb-socketsPortSwigger Walkthrough - Manipulating WebSocket messages to exploit vulnerabilitieshttps://chengo.dev/writeups/websockets-manipulating-messages/https://chengo.dev/writeups/websockets-manipulating-messages/Walkthrough of PortSwigger's 'Manipulating WebSocket messages to exploit vulnerabilities' lab.Tue, 25 Aug 2026 18:00:00 GMTwalkthroughportswiggerbscpweb-socketsPortSwigger Walkthrough - 2FA Broken Logichttps://chengo.dev/writeups/2fa-broken-logic/https://chengo.dev/writeups/2fa-broken-logic/Walkthrough of PortSwigger's '2FA Broken Logic' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthentication2faPortSwigger Walkthrough - 2FA Simple Bypasshttps://chengo.dev/writeups/2fa-simple-bypass/https://chengo.dev/writeups/2fa-simple-bypass/Walkthrough of PortSwigger's '2FA Simple Bypass' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthentication2faPortSwigger Walkthrough - Broken brute-force protection, IP blockhttps://chengo.dev/writeups/broken-brute-force-ip-block/https://chengo.dev/writeups/broken-brute-force-ip-block/Walkthrough of PortSwigger's 'Broken brute-force protection' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationbrute-forcePortSwigger Walkthrough - Brute-forcing a stay-logged-in cookiehttps://chengo.dev/writeups/brute-forcing-stay-logged-in-cookie/https://chengo.dev/writeups/brute-forcing-stay-logged-in-cookie/Walkthrough of PortSwigger's 'Brute-forcing a stay-logged-in cookie' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationbrute-forcePortSwigger Walkthrough - Offline password crackinghttps://chengo.dev/writeups/offline-password-cracking/https://chengo.dev/writeups/offline-password-cracking/Walkthrough of PortSwigger's 'Offline password cracking' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationcrackingPortSwigger Walkthrough - Password brute-force via password changehttps://chengo.dev/writeups/password-brute-force-via-password-change/https://chengo.dev/writeups/password-brute-force-via-password-change/Walkthrough of PortSwigger's 'Password brute-force via password change' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationbrute-forcePortSwigger Walkthrough - Password reset broken logichttps://chengo.dev/writeups/password-reset-broken-logic/https://chengo.dev/writeups/password-reset-broken-logic/Walkthrough of PortSwigger's 'Password reset broken logic' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationresetPortSwigger Walkthrough - Password reset poisoning via middlewarehttps://chengo.dev/writeups/password-reset-poisoning-via-middleware/https://chengo.dev/writeups/password-reset-poisoning-via-middleware/Walkthrough of PortSwigger's 'Password reset poisoning via middleware' lab: steal a reset token by spoofing the X-Forwarded-Host header.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationresetPortSwigger Walkthrough - File path traversal, traversal sequences blocked with absolute path bypasshttps://chengo.dev/writeups/path-traversal-sequences-blocked-absolute-path-bypass/https://chengo.dev/writeups/path-traversal-sequences-blocked-absolute-path-bypass/Walkthrough of PortSwigger's 'File path traversal, traversal sequences blocked with absolute path bypass' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscppath-traversalPortSwigger Walkthrough - File path traversal, traversal sequences stripped non-recursivelyhttps://chengo.dev/writeups/path-traversal-sequences-stripped-non-recursively/https://chengo.dev/writeups/path-traversal-sequences-stripped-non-recursively/Walkthrough of PortSwigger's 'File path traversal, traversal sequences stripped non-recursively' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscppath-traversalPortSwigger Walkthrough - File path traversal, traversal sequences stripped with superfluous URL-decodehttps://chengo.dev/writeups/path-traversal-sequences-stripped-superfluous-url/https://chengo.dev/writeups/path-traversal-sequences-stripped-superfluous-url/Walkthrough of PortSwigger's 'File path traversal, traversal sequences stripped with superfluous URL-decode' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscppath-traversalPortSwigger Walkthrough - File path traversal, simple casehttps://chengo.dev/writeups/path-traversal-simple-case/https://chengo.dev/writeups/path-traversal-simple-case/Walkthrough of PortSwigger's 'File path traversal, simple case' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscppath-traversalPortSwigger Walkthrough - File path traversal, validation of file extension with null byte bypasshttps://chengo.dev/writeups/path-traversal-validation-file-extension-null-byte-bypass/https://chengo.dev/writeups/path-traversal-validation-file-extension-null-byte-bypass/Walkthrough of PortSwigger's 'File path traversal, validation of file extension with null byte bypass' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscppath-traversalPortSwigger Walkthrough - File path traversal, validation of start of pathhttps://chengo.dev/writeups/path-traversal-validation-start-path/https://chengo.dev/writeups/path-traversal-validation-start-path/Walkthrough of PortSwigger's 'File path traversal, validation of start of path' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscppath-traversalPortSwigger Walkthrough - Username enumeration via account lockhttps://chengo.dev/writeups/username-enum-account-lock/https://chengo.dev/writeups/username-enum-account-lock/Walkthrough of PortSwigger's 'Username enumeration via account lock' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationuser-enumerationPortSwigger Walkthrough - Username enumeration via different responseshttps://chengo.dev/writeups/username-enum-different-responses/https://chengo.dev/writeups/username-enum-different-responses/Walkthrough of PortSwigger's 'Username enumeration via different responses' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationuser-enumerationPortSwigger Walkthrough - Username enumeration via response timinghttps://chengo.dev/writeups/username-enum-response-timing/https://chengo.dev/writeups/username-enum-response-timing/Walkthrough of PortSwigger's 'Username enumeration via response timing' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationuser-enumerationPortSwigger Walkthrough - Username enumeration via subtly different responseshttps://chengo.dev/writeups/username-enum-subtly-different-responses/https://chengo.dev/writeups/username-enum-subtly-different-responses/Walkthrough of PortSwigger's 'Username enumeration via subtly different responses' lab.Sun, 28 Jun 2026 11:30:00 GMTwalkthroughportswiggerbscpauthenticationuser-enumerationDVWA Complete Walkthroughhttps://chengo.dev/writeups/dvwa_walkthrough/https://chengo.dev/writeups/dvwa_walkthrough/A complete (more or less) walkthrough of the Damn Vulnerable Web Application (DVWA) for security testing and learning purposes.Sat, 20 Dec 2025 11:00:19 GMTwalkthroughdvwaDVWA Walkthrough I - Brute Forcehttps://chengo.dev/writeups/brute-force_dvwa_walkthrough/https://chengo.dev/writeups/brute-force_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 1, Brute Force.Sat, 20 Dec 2025 11:00:18 GMTwalkthroughdvwaburpsuitebrute-forceDVWA Walkthrough II - Command Injectionhttps://chengo.dev/writeups/command-injection_dvwa_walkthrough/https://chengo.dev/writeups/command-injection_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 2, Command Injection.Sat, 20 Dec 2025 11:00:17 GMTwalkthroughdvwaburpsuitecommand-injectionDVWA Walkthrough III - Cross Site Request Forgery (CSRF)https://chengo.dev/writeups/csrf_dvwa_walkthrough/https://chengo.dev/writeups/csrf_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 3, Cross Site Request Forgery (CSRF).Sat, 20 Dec 2025 11:00:16 GMTwalkthroughdvwaburpsuitecsrfDVWA Walkthrough IV - File Inclusionhttps://chengo.dev/writeups/file-inclusion_dvwa_walkthrough/https://chengo.dev/writeups/file-inclusion_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 4, File Inclusion.Sat, 20 Dec 2025 11:00:15 GMTwalkthroughdvwaburpsuitefile-inclusionlocalremoteDVWA Walkthrough V - File Uploadhttps://chengo.dev/writeups/file-upload_dvwa_walkthrough/https://chengo.dev/writeups/file-upload_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 5, File Upload.Sat, 20 Dec 2025 11:00:14 GMTwalkthroughdvwaburpsuitefile-uploadshellreverseDVWA Walkthrough VI - Insecure CAPTCHAhttps://chengo.dev/writeups/insecure-captcha_dvwa_walkthrough/https://chengo.dev/writeups/insecure-captcha_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 6, Insecure CAPTCHA.Sat, 20 Dec 2025 11:00:13 GMTwalkthroughdvwaburpsuitecaptchaDVWA Walkthrough VII - SQL Injectionhttps://chengo.dev/writeups/sqli_dvwa_walkthrough/https://chengo.dev/writeups/sqli_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 7, SQL Injection.Sat, 20 Dec 2025 11:00:12 GMTwalkthroughdvwaburpsuitesqliDVWA Walkthrough VIII - SQL Injection (Blind)https://chengo.dev/writeups/blind-sqli_dvwa_walkthrough/https://chengo.dev/writeups/blind-sqli_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 8, SQL Injection (Blind).Sat, 20 Dec 2025 11:00:11 GMTwalkthroughdvwaburpsuitesqliblindDVWA Walkthrough IX - Weak Session IDshttps://chengo.dev/writeups/weak-ids_dvwa_walkthrough/https://chengo.dev/writeups/weak-ids_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 9, Weak Session IDs.Sat, 20 Dec 2025 11:00:10 GMTwalkthroughdvwaburpsuitesessionidDVWA Walkthrough X - DOM Based Cross Site Scripting (XSS)https://chengo.dev/writeups/dom-xss_dvwa_walkthrough/https://chengo.dev/writeups/dom-xss_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 10, DOM Based Cross Site Scripting (XSS).Sat, 20 Dec 2025 11:00:09 GMTwalkthroughdvwaburpsuitexssdomDVWA Walkthrough XI - Reflected Cross Site Scripting (XSS)https://chengo.dev/writeups/reflected-xss_dvwa_walkthrough/https://chengo.dev/writeups/reflected-xss_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 11, Reflected Cross Site Scripting (XSS).Sat, 20 Dec 2025 11:00:08 GMTwalkthroughdvwaburpsuitexssreflectedDVWA Walkthrough XII - Stored Cross Site Scripting (XSS)https://chengo.dev/writeups/stored-xss_dvwa_walkthrough/https://chengo.dev/writeups/stored-xss_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 12, Stored Cross Site Scripting (XSS).Sat, 20 Dec 2025 11:00:07 GMTwalkthroughdvwaburpsuitexssstoredDVWA Walkthrough XIII - Content-Security Policy Bypasshttps://chengo.dev/writeups/csp-bypass_dvwa_walkthrough/https://chengo.dev/writeups/csp-bypass_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) part 13, Content-Security Policy (CSP) Bypass.Sat, 20 Dec 2025 11:00:06 GMTwalkthroughdvwaburpsuitecspbypassDVWA Walkthrough XIV - JavaScript Attackshttps://chengo.dev/writeups/js-attacks_dvwa_walkthrough/https://chengo.dev/writeups/js-attacks_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 14, JavaScript Attacks.Sat, 20 Dec 2025 11:00:05 GMTwalkthroughdvwaburpsuitejavascriptDVWA Walkthrough XV - Authorisation Bypasshttps://chengo.dev/writeups/authorisation-bypass_dvwa_walkthrough/https://chengo.dev/writeups/authorisation-bypass_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 15, Authorisation Bypass.Sat, 20 Dec 2025 11:00:04 GMTwalkthroughdvwaburpsuiteauthbypassDVWA Walkthrough XVI - Open HTTP Redirecthttps://chengo.dev/writeups/open-redirect_dvwa_walkthrough/https://chengo.dev/writeups/open-redirect_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 16, Open HTTP Redirect.Sat, 20 Dec 2025 11:00:03 GMTwalkthroughdvwaburpsuitehttpopen-redirectDVWA Walkthrough XVII - Cryptographyhttps://chengo.dev/writeups/cryptography_dvwa_walkthrough/https://chengo.dev/writeups/cryptography_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 17, Cryptography.Sat, 20 Dec 2025 11:00:02 GMTwalkthroughdvwaburpsuitecryptographyDVWA Walkthrough XVIII - API Securityhttps://chengo.dev/writeups/api-sec_dvwa_walkthrough/https://chengo.dev/writeups/api-sec_dvwa_walkthrough/A walkthrough of the Damn Vulnerable Web Application (DVWA) module 18, API Security.Sat, 20 Dec 2025 11:00:01 GMTwalkthroughdvwaburpsuiteapi