Learning security in the open :)

Stored XSS into HTML context with nothing encoded

stored XSS lab where a blog comment is saved as is and rendered back with zero encoding on every visit.

Reflected XSS into HTML context with nothing encoded

XSS lab where the search parameter is echoed straight into the HTML body with zero encoding

SQL injection with filter bypass via XML encoding

Blind SQL injection with out-of-band data exfiltration

Blind SQL injection with no readable feedback at all, solved by smuggling the administrator's password out through a DNS lookup, hiding the stolen data inside the domain name itself using an XXE-driven subquery

Blind SQL injection with out-of-band interaction

Blind SQL injection with zero visible feedback, no errors, delays, or content differences to read, solved by pairing SQLi with an XXE trick to force an Oracle database into making a DNS lookup to Burp Collaborator

Blind SQL injection with time delays and information retrieval

Blind SQL injection with no visible errors or response differences, solved purely by timing the database's own hesitation - using pg_sleep as a true/false switch and a single-threaded Burp Intruder attack to read the administrator's password one clock tick at a time

Visible error-based SQL injection

Error-based SQL injection that forces the database to leak data through its own type conversion errors - casting subquery results to int, fighting a cookie length limit, and reading the administrator's credentials straight out of the error message.