BSCP Practice Exam 1 풀이 (PortSwigger Academy)

PortSwigger BSCP Practice Exam 1을 단계별로 분석하고 공격 흐름을 정리

2026/04/08 Web Security, Writeup

Prototype Pollution 실습(2) - DOM XSS via an alternative prototype pollution vector (PortSwigger Academy)

alternative prototype pollution vector를 이용해 Object.prototype을 오염시키고, eval gadget을 통해 DOM XSS를 발생시키는 과정

2026/03/30 Web Security, Prototype Pollution, DOM XSS, Lab

Prototype Pollution 실습(1) - DOM XSS via client-side prototype pollution (PortSwigger Academy)

query string를 통한 client-side prototype pollution으로 Object.prototype을 오염시키고, gadget을 이용해 DOM XSS를 발생시키는 과정

2026/03/29 Web Security, Prototype Pollution, Lab

GraphQL 실습(5) - Performing CSRF exploits over GraphQL (PortSwigger Academy)

GraphQL endpoint의 CSRF 취약점을 이용해 피해자의 이메일을 변경하는 과정

2026/03/28 Web Security, GraphQL, Lab

GraphQL 실습(4) - Bypassing GraphQL brute force protections (PortSwigger Academy)

GraphQL alias를 이용해 rate limit을 우회하고 brute force 공격을 수행하는 과정

2026/03/28 Web Security, GraphQL, Lab