Link original: https://grumpz.net/pass-the-ewpt-exam-in-2023-using-free-resources-on-your-first-attempt

La última vez que accedí sale un error de SSL y no deja ver el articulo ni la web, así que utilice Wayback Machine para recuperar los links de la página web.

Cross Scripting Resources

Reflected XSS

• https://portswigger.net/web-security/cross-site-scripting/reflected
• https://brightsec.com/blog/cross-site-scripting-xss/
• https://www.youtube.com/watch?v=k4lUX55uNM0
• https://public-firing-range.appspot.com/reflected/index.html (free labs!)

Stored/Persistent XSS

• https://portswigger.net/web-security/cross-site-scripting/stored
• https://www.thesslstore.com/blog/the-ultimate-guide-to-stored-xss-attacks/
• https://www.exploit-db.com/docs/english/18895-complete-cross-site-scripting-walkthrough.pdf
• https://www.cobalt.io/blog/a-pentesters-guide-to-cross-site-scripting-xss
• https://portswigger.net/web-security/cross-site-scripting/reflected/lab-html-context-nothing-encoded (lab!)
• https://portswigger.net/web-security/cross-site-scripting/stored/lab-html-context-nothing-encoded (lab!)

SQL Injection Resources

Remember.. SQLmap is your best friend when exploiting these vulnerabilities. The -r switch goes a long way! ;-)

• https://github.com/sqlmapproject/sqlmap
• https://dl.packetstormsecurity.net/papers/cheatsheets/sqlmap-cheatsheet-1.0-SDB.pdf
• https://portswigger.net/web-security/sql-injection