PortSwigger → AYSEC Mapping

The free PortSwigger Web Security Academy mapped to AppSec modules.

PortSwigger Web Security Academy — Mapping to AYSEC Modules

PortSwigger publishes a 100% free, world-class web AppSec curriculum at https://portswigger.net/web-security. Every AYSEC AppSec module should reference these labs.

---

Why This Matters

• Free.
• Maintained by the makers of Burp Suite.
• Industry-standard for web AppSec preparation.
• The Burp Suite Certified Practitioner (BSCP) exam is built on these labs.

---

All Topic Areas Mapped

AYSEC-106 Module 04 — Authentication

PortSwigger Auth labs:

• Username enumeration via different responses (Apprentice)
• Username enumeration via subtly different responses (Practitioner)
• Username enumeration via response timing (Practitioner)
• Vulnerabilities in password-based login
• Broken brute-force protection (multiple credentials per request)
• 2FA simple bypass (Apprentice)
• 2FA broken logic (Practitioner)
• Brute-forcing a stay-logged-in cookie (Expert)
• Offline password cracking (Apprentice)

AYSEC-106 Module 04 — JWT Attacks

• JWT authentication bypass via unverified signature (Apprentice)
• JWT authentication bypass via flawed signature verification (Practitioner)
• JWT authentication bypass via weak signing key (Practitioner)
• JWT authentication bypass via jwk header injection (Practitioner)
• JWT authentication bypass via jku header injection (Expert)
• JWT authentication bypass via algorithm confusion (Expert)

AYSEC-106 Module 05 — Access Control / IDOR

• Unprotected admin functionality (Apprentice)
• Unprotected admin functionality with unpredictable URL (Apprentice)
• User role controlled by request parameter (Apprentice)
• URL-based access control can be circumvented (Practitioner)
• Method-based access control can be circumvented (Practitioner)
• Multi-step process with no access control on one step (Practitioner)
• Insecure direct object references (Apprentice)
• User ID controlled by request parameter (Apprentice)
• User ID controlled by request parameter with data leakage in redirect (Apprentice)
• User ID controlled by request parameter with password disclosure (Practitioner)
• Insecure direct object references on file system access (Practitioner)

AYSEC-106 Module 06 — SQL Injection

Apprentice tier:

• SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
• SQL injection vulnerability allowing login bypass

Practitioner tier:

• SQL injection UNION attack, determining the number of columns
• SQL injection UNION attack, finding a column containing text
• SQL injection UNION attack, retrieving data from other tables
• SQL injection UNION attack, retrieving multiple values in a single column
• SQL injection attack, querying the database type and version (Oracle / non-Oracle)
• SQL injection attack, listing the database contents on non-Oracle databases
• Blind SQL injection with conditional responses
• Blind SQL injection with conditional errors
• Blind SQL injection with time delays
• Blind SQL injection with time delays and information retrieval
• Blind SQL injection with out-of-band interaction
• Blind SQL injection with out-of-band data exfiltration

Expert tier:

• SQL injection with filter bypass via XML encoding

AYSEC-106 Module 07 — XSS

Apprentice tier (~10 labs):

• Reflected XSS into HTML context with nothing encoded
• Stored XSS into HTML context with nothing encoded
• DOM XSS in document.write sink using source location.search
• DOM XSS in innerHTML sink using source location.search
• DOM XSS in jQuery anchor href attribute sink using location.search source
• DOM XSS in jQuery selector sink using a hashchange event
• Reflected XSS into attribute with angle brackets HTML-encoded
• Stored XSS into anchor href attribute with double quotes HTML-encoded
• Reflected XSS into a JavaScript string with angle brackets HTML encoded
• DOM XSS in document.write sink using source location.search inside a select element
• DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded

Practitioner tier (~15 labs):

• Reflected DOM XSS
• Stored DOM XSS
• Exploiting cross-site scripting to steal cookies
• Exploiting cross-site scripting to capture passwords
• Exploiting XSS to perform CSRF
• Reflected XSS into HTML context with most tags and attributes blocked
• Reflected XSS into HTML context with all tags blocked except custom ones
• Reflected XSS with some SVG markup allowed
• Reflected XSS in canonical link tag
• Reflected XSS into a JavaScript string with single quote and backslash escaped
• Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped
• Reflected XSS in a JavaScript URL with some characters blocked
• Reflected XSS protected by very strict CSP, with dangling markup attack
• Reflected XSS protected by CSP, with CSP bypass

Expert tier:

• Reflected XSS with AngularJS sandbox escape and CSP
• Reflected XSS with AngularJS sandbox escape without strings

AYSEC-106 Module 07 — CSRF

• CSRF vulnerability with no defenses (Apprentice)
• CSRF where token validation depends on request method (Practitioner)
• CSRF where token validation depends on token being present (Practitioner)
• CSRF where token is not tied to user session (Practitioner)
• CSRF where token is tied to non-session cookie (Practitioner)
• CSRF where token is duplicated in cookie (Practitioner)
• SameSite Lax bypass via method override (Practitioner)
• SameSite Strict bypass via client-side redirect (Practitioner)
• SameSite Strict bypass via sibling domain (Expert)
• SameSite Lax bypass via cookie refresh (Expert)
• CSRF where Referer validation depends on header being present (Practitioner)
• CSRF with broken Referer validation (Practitioner)

AYSEC-106 Module 07 — CORS

• CORS vulnerability with basic origin reflection (Apprentice)
• CORS vulnerability with trusted null origin (Apprentice)
• CORS vulnerability with trusted insecure protocols (Practitioner)

AYSEC-106 Module 08 — SSRF

• Basic SSRF against the local server (Apprentice)
• Basic SSRF against another back-end system (Apprentice)
• SSRF with blacklist-based input filter (Practitioner)
• SSRF with whitelist-based input filter (Practitioner)
• SSRF with filter bypass via open redirection (Practitioner)
• Blind SSRF with out-of-band detection (Practitioner)
• Blind SSRF with Shellshock exploitation (Expert)
• SSRF via DNS rebinding (Expert)

AYSEC-106 Module 08 — XXE

• Exploiting XXE using external entities to retrieve files (Apprentice)
• Exploiting XXE to perform SSRF attacks (Apprentice)
• Blind XXE with out-of-band interaction (Practitioner)
• Blind XXE with out-of-band interaction via XML parameter entities (Practitioner)
• Exploiting blind XXE to retrieve data via error messages (Practitioner)
• Exploiting XInclude to retrieve files (Practitioner)
• Exploiting XXE via image file upload (Practitioner)

AYSEC-106 Module 08 — File Upload

• Remote code execution via web shell upload (Apprentice)
• Web shell upload via Content-Type restriction bypass (Practitioner)
• Web shell upload via path traversal (Practitioner)
• Web shell upload via extension blacklist bypass (Practitioner)
• Web shell upload via obfuscated file extension (Practitioner)
• Remote code execution via polyglot web shell upload (Practitioner)
• Web shell upload via race condition (Expert)

AYSEC-106 Module 08 — Deserialization

• Modifying serialized objects (Apprentice)
• Modifying serialized data types (Practitioner)
• Using application functionality to exploit insecure deserialization (Practitioner)
• Arbitrary object injection in PHP (Practitioner)
• Exploiting Java deserialization with Apache Commons (Practitioner)
• Exploiting PHP deserialization with a pre-built gadget chain (Practitioner)
• Exploiting Ruby deserialization using a documented gadget chain (Practitioner)
• Developing a custom gadget chain for Java deserialization (Expert)
• Developing a custom gadget chain for PHP deserialization (Expert)
• Using PHAR deserialization to deploy a custom gadget chain (Expert)

AYSEC-106 Module 09 — SSTI

• Basic server-side template injection (Practitioner)
• Basic server-side template injection (code context) (Practitioner)
• Server-side template injection using documentation (Practitioner)
• Server-side template injection in an unknown language with a documented exploit (Practitioner)
• Server-side template injection with information disclosure via user-supplied objects (Practitioner)
• Server-side template injection in a sandboxed environment (Expert)
• Server-side template injection with a custom exploit (Expert)

AYSEC-106 Module 09 — Race Conditions

• Limit overrun race conditions (Practitioner)
• Bypassing rate limits via race conditions (Practitioner)
• Multi-endpoint race conditions (Practitioner)
• Single-endpoint race conditions (Practitioner)
• Exploiting time-sensitive vulnerabilities (Practitioner)
• Partial construction race conditions (Expert)

AYSEC-106 Module 09 — Business Logic

• Excessive trust in client-side controls (Apprentice)
• High-level logic vulnerability (Apprentice)
• Low-level logic flaw (Practitioner)
• Inconsistent security controls (Practitioner)
• Flawed enforcement of business rules (Practitioner)
• Authentication bypass via flawed state machine (Practitioner)
• Inconsistent handling of exceptional input (Practitioner)
• Weak isolation on dual-use endpoint (Practitioner)
• Insufficient workflow validation (Practitioner)
• Infinite money logic flaw (Practitioner)
• Bypassing access controls using email address parsing discrepancies (Practitioner)

AYSEC-106 Module 10 — APIs

• Exploiting API endpoints using documentation (Apprentice)
• Exploiting server-side parameter pollution in a query string (Practitioner)
• Finding and exploiting an unused API endpoint (Practitioner)
• Exploiting a mass assignment vulnerability (Practitioner)
• Exploiting server-side parameter pollution in a REST URL (Expert)

AYSEC-106 Module 11 — HTTP Request Smuggling

• HTTP request smuggling, basic CL.TE vulnerability (Practitioner)
• HTTP request smuggling, basic TE.CL vulnerability (Practitioner)
• HTTP request smuggling, obfuscating the TE header (Practitioner)
• HTTP request smuggling, confirming a CL.TE vulnerability via differential responses (Practitioner)
• HTTP request smuggling, confirming a TE.CL vulnerability via differential responses (Practitioner)
• Exploiting HTTP request smuggling to bypass front-end security controls (CL.TE) (Practitioner)
• Exploiting HTTP request smuggling to bypass front-end security controls (TE.CL) (Practitioner)
• Exploiting HTTP request smuggling to reveal front-end request rewriting (Practitioner)
• Exploiting HTTP request smuggling to capture other users' requests (Practitioner)
• Exploiting HTTP request smuggling to deliver reflected XSS (Practitioner)
• Response queue poisoning via H2.TE request smuggling (Expert)
• H2.CL request smuggling (Expert)
• HTTP/2 request smuggling via CRLF injection (Expert)
• HTTP/2 request splitting via CRLF injection (Expert)
• CL.0 request smuggling (Expert)
• Exploiting HTTP request smuggling to perform web cache deception (Expert)
• Browser-powered request smuggling via Client-Side Desync (Expert)

AYSEC-106 Module 11 — Web Cache Poisoning

• Web cache poisoning with an unkeyed header (Practitioner)
• Web cache poisoning with an unkeyed cookie (Practitioner)
• Web cache poisoning with multiple headers (Practitioner)
• Targeted web cache poisoning using an unknown header (Practitioner)
• Web cache poisoning via an unkeyed query string (Practitioner)
• Web cache poisoning via an unkeyed query parameter (Practitioner)
• Parameter cloaking (Practitioner)
• Web cache poisoning via a fat GET request (Practitioner)
• URL normalization (Practitioner)
• Web cache poisoning via host header (Expert)
• Web cache poisoning via ambiguous requests (Expert)
• Web cache poisoning by exploiting a cyclic dependency (Expert)
• Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria (Expert)
• Combining web cache poisoning vulnerabilities (Expert)

---

How to Use

For every AYSEC-106 module, after the "Hands-On" task, list:

• The set of PortSwigger labs covering that topic.
• Difficulty tier (Apprentice / Practitioner / Expert).
• Total estimated time.

Promote PortSwigger as the mandatory practice — it's free and best-in-class.

---

Total Coverage

PortSwigger publishes ~250 labs across 30+ topics. They map to:

• Apprentice tier (~85 labs) — beginner-friendly.
• Practitioner tier (~115 labs) — covers the BSCP exam scope.
• Expert tier (~50 labs) — advanced research-grade.

Completing all Practitioner labs is the path to the Burp Suite Certified Practitioner exam.

---

Total Time Estimate

For a determined student:

• Apprentice tier: ~80 hours.
• Practitioner tier: ~250 hours.
• Expert tier: ~200 hours.

Around 530 hours of free, top-quality lab work. Track this in your AYSEC progress.