| Vunerabilities | Labs | Web |
|---|---|---|
| SQL Injection | completed | completed |
| Insecure Deserialization | completed | completed |
| File upload | completed | completed |
| Cross-site scripting | completed | completed |
| Server-side template injection | completed | completed |
| Path Traversal | completed | completed |
| Specs | Value |
|---|---|
| OS | Kali Linux |
| Webserver | Nginx |
| Language | PHP |
| Database | MariaDB |
A website with normal login: completed
With picture upload in comments: completed
A newspaper website: done
XSS with comments: done
Change the ownership of the upload directory to user www-data:
sudo chown -R www-data:www-data img/comments
Note: Insecure Deserialization vulnerability in this lab only works on PHP 7.4 or below because it's PHAR Deserialization.