Agent skill · security · aradotso
websecurityacademy-solutions
Solutions and walkthroughs for PortSwigger Web Security Academy labs covering SQLi, XSS, CSRF, SSRF, and 30+ vulnerability categories
Why this skill is useful
Adds comprehensive solutions and exploitation techniques for over 30 vulnerability types, including executable code snippets for real-world penetration testing.
What it needs
Requires git installed locally. About 7k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
WebSecurityAcademy Solutions Skill by ara.so — Security Skills collection. This repository provides comprehensive solutions, walkthroughs, and video tutorials for all PortSwigger Web Security Academy labs. It covers 30+ vulnerability categories including SQL Injection, XSS, CSRF, SSRF, SSTI, XXE, and emerging attack vectors like Web LLM attacks and Race Conditions. What This Project Does WebSecurityAcademy provides: Step-by-step lab solutions for all PortSwigger Web Security Academy challenges Video walkthroughs demonstrating exploitation techniques Difficulty-graded labs (Apprentice, Practitioner, Expert) Practical attack patterns for real-world penetration testing Coverage of 30+ vulnerability types from OWASP Top 10 and beyond Installation Repository Structure Key Vulnerability Categories SQL Injection Basic SQLi - WHERE Clause Bypass UNION-based SQLi Blind SQLi with Conditional Responses Cross-Site Scripting (XSS) Reflected XSS Stored XSS DOM XSS XSS Exploitation Server-Side Request Forgery (SSRF) Basic SSRF Against Local Server SSRF Against Backend Systems Bypassing SSRF Filters Blind SSRF with Out-of-Band Detection Cross-Site Request Forgery (CSRF) Basic CSRF Attack CSRF Token Bypass - Method Override CSRF Token Bypass - Session/Cookie Mismatch SameSite Cookie Bypass XML External Entity (XXE) Injection Basic XXE - File Retrieval XXE to SSRF Blind XXE - Out-of-Band Blind XXE - Data Exfiltration Server-Side Template Injection (SSTI) Detecting SSTI Jinja2/Python Exploitation FreeMarker Exploitation JWT Attacks JWT None Algorithm Bypass JWT Algorithm Confusion JWT Kid Parameter Injection Command Injection Basic Command Injection Blind Command Injection with Output Redirection Path Traversal Basic Path Traversal Bypass Techniques Race Conditions Limit Overrun Race Condition Single-Packet Attack NoSQL Injection Authentication Bypass Data Extraction GraphQL API Vulnerabilities Introspection Query Query for Sensitive Data Mutation Attack Web LLM Attacks Prompt Injecti …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/websecurityacademy-solutions