PortSwigger Web Security Academy

The approach

Each lab I complete, I write up. Not the “here’s the solution” version — those already exist — but a walkthrough that explains what the vulnerability actually is, how I reasoned my way through it, and what I’d look for as a defender.

Progress

• SQL injection — completed. All labs, from basic UNION-based extraction through blind time-based to Oracle-specific tricks. Writeups landing in the garden as they’re edited.
• Cross-site scripting — in progress.
• Access control — next.

Why publish these

Two reasons. First, writing the walkthrough forces me to actually understand the technique rather than just complete the lab. Second, someone else going through the same material might find my mental model useful — the way I think about SQL injection isn’t the same way PortSwigger’s docs frame it, and it turns out that matters.