PentesterLab
@PentesterLab

Don’t just learn tools and payloads. Learn why vulnerabilities exist. Hands-on web hacking, security code review, and real-world CVE labs.

 Melbourne, Victoria
pentesterlab.com/
Joined December 2011
💥🐹 4 new Go Code Review Labs just dropped! 🐹💥 Read the code, peek at the diff, find the bug. Sharpen your skills: pentesterlab.com/badges/gola…

PentesterLab: Learn with our Golang Code Review Badge

The Golang Code Review Badge is our badge dedicated to code review in Golang. It covers the discovery of weaknesses and vulnerabilities using source code review.

pentesterlab.com
5
11
93
31,854
Our Black Friday Special is now live: pentesterlab.com/pro One-year: US$146.52 instead of US$199.99 Student (3-month): US$27.99 instead of US$34.99 Happy Hacking!

Advanced Web Hacking Labs and Security Code Review Training | PentesterLab PRO

Access advanced web hacking labs, in-depth video walkthroughs, and security code review training built around real vulnerabilities, exploitation techniques, and practical AppSec skills.

pentesterlab.com
27
180
7,790
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet !! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet !!
171
1,148
1,893
Giveaway time! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!
177
1,081
1,897
Giveaway time! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!
154
1,041
1,886
Giveaway time! To celebrate 80k followers! We are going to give a 1-month voucher to **80** people who RT this tweet (picked randomly)! We are going to send our socks, t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet (picked randomly)!!
170
1,414
1,802
Giveaway time! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!
137
1,025
1,804
Thanks everyone for your support! Let's do it now! We will give away 140 x 1-month subscription. To enter you just need to interact with this tweet (like/RT/...)!
PentesterLab
@PentesterLab
13 Aug 2022
We were planning 70 x 1-month voucher for our 70k followers. We are going to double it (140 x 1-month) if we reach 70k followers before the end of Def Con!
356
875
1,770
Giveaway time! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!
156
975
1,722
Giveaway time! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!
148
903
1,669
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
107
968
1,643
113,994
Giveaway time! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!
142
954
1,619
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
109
962
1,580
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
165
1,003
1,610
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
128
954
1,543
Giveaway time! To celebrate 60k followers! We are going to send our new socks and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-month voucher to **60** people who RT this tweet!
151
1,016
1,560
🍾🪩🪅🎉🥳Giveaway time! 🥳🎉🪅🪩🍾 We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!
112
828
1,506
Giveaway time! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-year voucher to someone who RT this tweet!
127
873
1,467
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
114
836
1,418
98,636
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
99
861
1,401
97,253
Giveaway time! To celebrate 50k followers! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !! And we are going to give a 1-month voucher to **50** people who RT this tweet!
122
886
1,421
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
114
878
1,379
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
93
805
1,355
10 more sleeps before our BLACK FRIDAY SPECIAL! Let's do a Giveaway in the meantime! We are going to: * Send a swag pack to one person who follows @PentesterLab and RT this tweet!! * Give 12-month voucher to someone who follows @PentesterLab and ♥️ this tweet!!
136
824
1,333
Ok, let's try to do a swag giveaway. We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !!
103
112
1,375
Black Friday Giveaway! Make sure you check our deals: pentesterlab.com/pro We are going to send a t-shirt and a few goodies to one person who retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!

Advanced Web Hacking Labs and Security Code Review Training | PentesterLab PRO

Access advanced web hacking labs, in-depth video walkthroughs, and security code review training built around real vulnerabilities, exploitation techniques, and practical AppSec skills.

pentesterlab.com
109
805
1,322
Another giveaway! We are going to send a t-shirt and a few goodies (including socks) to one person who follows @PentesterLab and retweets this tweet !! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet !!

ALT Giveaway Giveawaytime GIF

127
812
1,283
Time for another swag giveaway! We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !!
109
116
1,317
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
72
776
1,277
Time for another swag giveaway! You know the drill: We are going to send a t-shirt and few goodies to one person who follows @PentesterLab and likes this tweet !!
109
105
1,278
Every Single Time...
12
156
1,209
59,650
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
73
695
1,213
80,937
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
92
767
1,188
Another Black Friday Giveaway! Make sure you check our deals: pentesterlab.com/pro We are going to send a t-shirt and a few goodies to one person who retweets this tweet!! And we are going to give a 12-month voucher to someone who likes this tweet!!

Advanced Web Hacking Labs and Security Code Review Training | PentesterLab PRO

Access advanced web hacking labs, in-depth video walkthroughs, and security code review training built around real vulnerabilities, exploitation techniques, and practical AppSec skills.

pentesterlab.com
84
704
1,145
Final Giveaway! This time for #Cyber Monday Make sure you check our deals: pentesterlab.com/pro We are going to send a t-shirt and a few goodies to one person who retweets this tweet!! And we are going to give a 12-month voucher to someone who likes this tweet!!

Advanced Web Hacking Labs and Security Code Review Training | PentesterLab PRO

Access advanced web hacking labs, in-depth video walkthroughs, and security code review training built around real vulnerabilities, exploitation techniques, and practical AppSec skills.

pentesterlab.com
56
606
1,087
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
99
677
1,043
58,675
We were planning 70 x 1-month voucher for our 70k followers. We are going to double it (140 x 1-month) if we reach 70k followers before the end of Def Con!
119
310
1,100
🎉🥳🎉 We just reached 110K followers! 🎉🥳🎉 🎉🥳🎉🥳Let's celebrate! 🎉🥳🎉🥳 We are going to give a 1-month voucher to 110 people who RT this tweet and follow @PentesterLab (picked randomly)!
101
840
734
77,436
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
78
508
779
40,814
Want to bypass WAF when exploiting CVE-2019-5418 ? curl -H 'Accept: ../../../../../../e*c/p*s*d{{' http://server/...
14
258
796
Two more days before our Black Friday specials! And we just reached 90K followers! Let's celebrate! We are going to give a 1-month voucher to 90 people who RT this tweet and follow @PentesterLab (picked randomly)!
71
910
744
Time for another giveaway! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!
64
466
764
50,120
Not going to show off but some of our labs cover how to access the source code of an HTML page.
25
68
708
To celebrate our new channel piped.video/@AppSecSchool! We are going to send a t-shirt and a few goodies to one person who follows @PentesterLab and retweets this tweet!! And we are going to give a 12-month voucher to someone who follows @PentesterLab and likes this tweet!!

AppSecSchool

Hi, welcome to our new youtube channel named AppSecSchool. Our goal with this channel is to cover the less technical aspects of Application Security, especially for people working or wanting to work...

youtube.com
62
402
659
46,127
3
81
647
24,841
We put together a small XSS challenge: http://157.230.239.59:1234/ The goal is to get an alert box using a script tag.
45
74
441
113,567
Two new wallpapers are now available! pentesterlab.com/wallpapers Dark mode vs light mode...
18
46
402
🚨🚨🚨 Too many people miss critical vulnerabilities because they assume a GET request can't have a body! 🚨🚨🚨 This is how you can send such a request using #curl: $ curl '0.0.0.0:1234/download?filename=TEST' --data 'filename=../../../../../../../etc/passwd' -X GET
nc running in a terminal with the GET request containing a body

ALT nc running in a terminal with the GET request containing a body

4
72
406
24,917
Articles worth reading discovered last week: 🗞️ hipotermia.pw/bb/http-desync… 🗞️ gitlab.com/gitlab-com/gl-sec… 🗞️ teddit.net/r/crypto/comments… 🗞️ know.bishopfox.com/research/… 🗞️ diverto.github.io/2019/11/18…

hipotermia - HTTP Request Smuggling + IDOR

A bug chain of HTTP Request Smuggling and an IDOR which allows to retrieve user sensitive data

hipotermia.pw
1
161
381
We just released our JSON Web tokens cheatsheet: assets.pentesterlab.com/jwt_…
2
164
364
You pop a shell, what is the first command you run?
225
26
363
And we just released our latest challenge: Log4j Remote Code Execution: pentesterlab.com/exercises/l…
5
88
367
We would like to welcome our new team member: Jia Tan! Jia will work on a set of challenges for our "Supply Chain" badge!!
14
35
329
36,521
Their only weakness...
3
51
314
23,145
8
37
296
21,433
Just in case someone wonders: bcrypt.
14
26
271
Good articles discovered last week: 🗞️ blog.tint0.com/2019/03/a-sag… 🗞️ medium.com/@sharan.panegav/a… 🗞️ people.eng.unimelb.edu.au/vj…

A Saga of Code Executions on Zimbra

Zimbra is well known for its signature email product, Zimbra Collaboration Suite. Putting client-side vulnerabilities aside, Zimbra seems to...

blog.tint0.com
2
110
280
5
28
267
21,527
The LinkedIn profile vs the DEF CON photo
19
15
260
17,703
Doing an internal pentest in an unpatched Windows environment.
Consulting Comedy
3
33
264
22,400
Our latest exercise on PDF SSRF based on the excellent talk from @daeken and @NahamSec at DefCon 2019 is now available: pentesterlab.com/exercises/p…
2
66
252
Pentester pro tip: After a successful engagement, encrypt all the client’s files. Give them the full ransomware experience and watch how fast that invoice gets paid.
15
34
244
16,519
How it started. How it is going.
5
13
249
हमने अभी 13 घंटे के वीडियो के लिए हिंदी में सबटाइटल जारी किए हैं! 12 महीने का वाउचर जीतने का मौका पाने के लिए रीट्वीट करें
47
218
241
Five activities every web hacker should do at least once: 1. Read the source code of an HTTP request parser 2. Write a small web application with registration, authentication, file upload... 3. Read an RFC 4. Participate in a Capture The Flag competition. 5. Fix a vulnerability in an open-source project.
1
56
234
24,455
We are partnering with @Bugcrowd to help researchers find more and better bugs: bugcrowd.com/blog/bugcrowd_p… !!! P1📈 P5📉

Bugcrowd + PentesterLab — Learn Web Hacking Easier! | @Bugcrowd

As we open a new year, Bugcrowd is continuing to drive toward its goal of continued investment in the development of its researchers. We are overwhelmingly proud to announce that we’re partnering...

bugcrowd.com
5
60
241
Articles worth reading discovered last week: 🗞️ rcesecurity.com/2019/09/H1-4… 🗞️ blog.evilpacket.net/2019/lev… 🗞️medium.com/@cc1h2e1/write-up…
1
83
231
🎉🎉 50k followers!! 🎉🎉 🎉🎉 Thanks everyone for your support!🎉🎉
22
12
222
How it started: How it’s going:
2
11
209
PentesterLab PRO is 5 years old...
23
4
217
Stop reading dozens of hacking/security books. Focus on taking action: ‣ Hands-on learning ‣ Hack on real applications/networks (open source projects, bug bounty...) ‣ Read write-ups (CTF, bug bounty, vulnerability research...) ‣ Meet like-minded people (twitter, discord, meetups, conferences) ‣ Learn to read/write code
3
31
172
18,652
And our Black Friday Sale is Live: pentesterlab.com/pro 2*13.37% off on the one year subscription!
10
64
211
🗞 synacktiv.com/publications/e… 🗞 omar0x01.medium.com/hubspot-… 🗞 semgrep.dev/blog/2022/xml-se… 🗞 blog.trailofbits.com/2023/02… 🗞 portswigger.net/research/ser… 🗞 github.com/haproxy/haproxy/c… 🗞 blog.yeswehack.com/talent-de… 🗞 labs.ioactive.com/2023/02/ad… 🗞 pathonproject.com/zb/?9133a2… #PentesterLabWeekly

Exploiting a remote heap overflow with a custom TCP stack

Exploiting a remote heap overflow with a custom TCP stack

synacktiv.com
2
61
201
20,088
Articles worth reading discovered last week: 🗞️ blog.intothesymmetry.com/202… 🗞️ medium.com/@renwa/bypass-sam… 🗞️ medium.com/@alex.birsan/the-… 🗞️ googleprojectzero.blogspot.c…

Bypass SameSite Cookies Default to Lax and get CSRF

SameSite=Lax Cookies by Default is a new browser feature we will look at how to bypass it and what is the security concerns with it..

medium.com
2
88
204
Articles worth reading discovered last week: 🗞 github.com/scarvell/advisori… 🗞 breaking-bits.gitbook.io/bre… 🗞 security.humanativaspa.it/zy… 🗞 i.blackhat.com/EU-22/Wednesd… 🗞 daniel.haxx.se/blog/2022/12/… 🗞 bugs.chromium.org/p/project-… 🗞 gosecure.net/blog/2019/05/02… 🗞 pathonproject.com/zb/?d384df… #PentesterLabWeek
2
56
192
29,579
As usual, PentesterLab will be running a Black Friday special on the week of the 27th of November. Stay tune.
8
26
192
For people who haven't seen it before, make sure you check our JWT Security Cheatsheet: assets.pentesterlab.com/jwt_…
1
72
191
Happy 2022! Don't stop learning and hack the planet!
5
15
188
🤫🤫🤫 /100 🤫🤫🤫
37
63
178
Our booth at CyberSec Asia
3
6
162
21,074
Articles worth reading discovered last week: 🗞️ msreverseengineering.com/blo… 🗞️ portswigger.net/blog/http-de… 🗞️ [PDF] i.blackhat.com/USA-19/Wednes… 🗞️ imperialviolet.org/2019/08/1…

Automation Techniques in C++ Reverse Engineering — Möbius Strip Reverse Engineering

Here are the slides for my recent presentation at RECON, entitled "Automation Techniques in C++ Reverse Engineering". As usual, my slides use in-frame animations, so in brief, navigate them using...

msreverseengineering.com
1
55
169
What is your favorite @PentesterLab challenge/exercise so far?
66
10
165
Articles worth reading discovered last week: 🗞️ blahcat.github.io/2020/03/09… 🗞️ hackerone.com/reports/737140 🗞️ bugs.xdavidhu.me/google/2020… 🗞️ synacktiv.com/posts/exploit/…

Slack disclosed on HackerOne: Mass account takeovers using HTTP...

This researcher exploited an HTTP Request Smuggling bug on a Slack asset to perform a CL.TE-based hijack onto neighboring customer requests. This hijack forced the victim into an open-redirect that...

hackerone.com
47
161
Do you want to get better at recon❓ The first three challenges of our ReCon badge are now available: pentesterlab.com/badges/reco… ‼️ Did we mention that they are free? 🎉🥳🍾

PentesterLab: Learn with our Recon Badge

The Recon badge is our set of exercises created to help you learn Reconnaissance. From findings usual files down to DNS and TLS exploration, this badge will help you get better at finding new targets

pentesterlab.com
2
42
164
Who is your favorite hacker?
119
12
155
56,092
Just Another Job Description...
2
13
152
10,501
And a free ISO (22MB) for people who want to play with the recent #libssh bug #cve_2018_10933: isos.pentesterlab.com/cve-20… #pentesterlab
3
74
157
Every week we tweet the latest articles we discovered: 🗞 adam-p.ca/blog/2021/11/const… 🗞 haxx.in/files/dirtypipez.c 🗞 httpvoid.com/?p=Circumventin… 🗞 graplsecurity.com/post/iou-r… 🗞 slideshare.net/MarkDowd13/pr… 🗞 nickgregory.me/linux/securit… 🗞 flattsecurity.medium.com/fin… #PentesterLabWeekly
3
62
161
أصدرنا للتو ترجمات باللغة العربية لمدة 13 ساعة من مقاطع الفيديو! أعد التغريد للحصول على فرصة لربح قسيمة لمدة 12 شهرًا
16
146
147
The impact of using AI on your learning experience...
4
17
135
15,149
Is watching the videos cheating? Not at all, do what work for you! Everyone learns differently! Try on your own if that works for you, read the course if needed, watch the video if needed. A few week later, quickly go back to some challenges you struggled with.
8
16
150
🎉🎉🎉 Happy New Year !!!🎉🎉🎉
7
6
146
18,925
25k followers! 🎉🎉🎉 🥳🥳🥳 Thanks everyone for your support!
14
148
We have 3 tickets for iwcon.live/ to give away, please comment and we will pick 3 winners later today!
97
16
150
We just dropped another log4j challenge for more recent versions of Java: pentesterlab.com/exercises/l…

PentesterLab: Log4j RCE II

This exercise demonstrates the exploitation of a vulnerability in Log4j using a gadget to achieve remote code execution (RCE). It involves leveraging the JRMPListener from ysoserial to exploit the...

pentesterlab.com
1
32
143
Coming soon....
9
16
140
Articles worth reading discovered last week: 🗞️ buer.haus/2019/10/18/a-tale-… 🗞️ tagazok.virtualabs.fr/Worksh… 🗞️ cpdos.org 🗞️ shielder.it/blog/dont-open-t…
1
54
143
Replace 15 minutes of daily social media or TV time with 15 minutes of reading source code or RFC. Small changes can lead to big improvements in your hacking skills!
1
17
134
13,569
Happy New Year! pentesterlab.com/gift/6PztmV… (3-month) pentesterlab.com/gift/mwntl5… (3-month) pentesterlab.com/gift/HIslyy… (3-month)

Learn Web Penetration Testing: The Right Way

Learn Web Penetration Testing: The Right Way

pentesterlab.com
8
4
51
17,975
Articles worth reading discovered last week: 🗞️ synacktiv.com/posts/exploit/… 🗞️ blog.ropnop.com/docker-for-p… 🗞️ medium.com/@iSecMax/сookie-…
1
33
142
6
9
139
7,489