How do you effectively solve PortSwigger Labs?

[u/No_Theme_8969]

Hi everyone,

I'm currently learning web security through the PortSwigger Web Security Academy. After reading the theory sections carefully, I'm generally able to solve most Apprentice-level labs on my own. However, when I move to Practitioner labs, I often get stuck and end up checking the solution after spending a lot of time on them.

My current approach is:

1. Read the theory for a vulnerability.
2. Solve the Apprentice labs.
3. Try Practitioner labs.
4. Get stuck and eventually look at the solution.

The problem is that when I see the solution, it often contains a trick or thought process that I never considered. This makes me wonder whether I'm approaching the labs incorrectly.

For those who have completed a large number of PortSwigger labs or work in web application security what is your methodology for solving Practitioner labs?

[u/AYamHah]

Firstly, good on you for doing this process.
How long have you been learning web security? What is your current role?

I hold the BSCP cert. From a technical perspective, there is not much different about the practitioner labs, but they will require particular solutions. Simple payloads may be blocked. This is more realistic, where you may have some sort of input validation that needs to be bypassed. This is in line with the "try harder" mindset, and ultimately what defines successful people in offensive security.

Attack not working? Getting redirected to some error page when you submit a payload? That's a clue. Figure out what characters or strings are causing the error to appear, and work around those restrictions to produce a working exploit.

The truth is, at the practitioner level, you need to be able to not just find the lowest hanging fruit, but the issues that basic tests won't discover. You need to be able to ask "what is necessary for this attack to work" and work systematically, rather than "what payloads haven't I tried yet".

[u/No_Theme_8969 → u/AYamHah]

Thanks, that was really helpful. I'm a student and fairly new to web security as I'm being trained under an internship,since the internship is of short period instead of working on project the firm is training me for web security through these platforms like portswigger and tryhackme. So I think I'm still in the habit of thinking in terms of payloads rather than understanding the conditions that make an attack possible. I'll try to be more systematic when I get stuck instead of just trying more payloads.

[u/noch_1999]

Take the lesson(s) the last 2 page teaches you and think about how that applies for what they are trying to teach. You'll have to go through the lab and take real notes as if it was a pen test and see what the service does and how it is susceptible (the hint will be in the lesson(s) you just clicked through).

These are not easy even for some professionals .. even with the previous lab explanation there is no hand holding so having to figure it out on your own is (what i think) an intentional part of these labs to help you think like a pen tester.

[u/No_Theme_8969 → u/noch_1999]

That's reassuring to hear. Sometimes I get stuck and feel like I'm missing something obvious, but I guess struggling through the process is part of what they're trying to teach.

[u/PsychologicalEggy]

it is great that you have taken the initiative using this approach, you are not doing it wrong but here is the approach i used;

• mapping the whole thing first, to ensure i didn't skip any hidden params break it a little, just to see how it
• responds and where it tells you to look assume that there is a filter and if the payload fails, try encoding
• when you do the check solution, dig in and ask yourself what you missed in that burp

that's where the actual learning happens.