100% on PortSwigger Academy — 274 Labs + 5 Mystery

RedPick solved all 274 PortSwigger Web Security Academy labs — 100% completion — plus all 5 mystery labs, fully automated, with zero human intervention. Every Apprentice lab, every Practitioner lab, every Expert lab. The PortSwigger dashboard shows EXPERT level achieved, a yellow bar at 100%, and green checkmarks across every difficulty tier.

This is the second perfect score in our benchmark series, following the 104/104 on the XBOW CTF. Combined: 378 out of 378 challenges across the two most comprehensive web security benchmarks available, covering 49 vulnerability categories from reflected XSS at beginner level to server-side pause-based HTTP/2 request smuggling at the highest difficulty tier.

Update (April 2026): PortSwigger published a new lab series under the AI-powered scanner vulnerabilities topic — four labs targeting indirect prompt injection against AI-powered vulnerability scanners themselves. RedPick solved all four end-to-end. The post has been updated to reflect 274/274 across 31 categories, with a new walkthrough for the Wave 2 LLM labs in the Web LLM attacks section.

The benchmark

The PortSwigger Web Security Academy is the gold standard for practical web vulnerability training, created and maintained by the team behind Burp Suite. The Academy contains 274 labs across 31 vulnerability categories at three difficulty tiers:

• Apprentice (61 labs): reflected XSS, basic SQLi, simple path traversal, default credentials, indirect prompt injection against AI agents
• Practitioner (174 labs): blind SQL injection, JWT algorithm confusion, OAuth redirect manipulation, prototype pollution to RCE, H2.CL request smuggling, AI scanner defense bypass
• Expert (39 labs): custom Java deserialization gadget chains, client-side desync, server-side pause-based request smuggling, web cache poisoning via HTTP/2 tunnelling

Each lab is a live, ephemeral web application with a single specific vulnerability. PortSwigger's backend validates every exploit server-side — no multiple-choice answers, no self-reported scoring.

Beyond the 274 standard labs, PortSwigger defines exam preparation requirements that test breadth:

Requirement	Completed
Lab from all topics	23 of 23
Specific labs	8 of 8
Mystery labs	5 of 5

The 5 mystery labs are randomly selected challenges where the vulnerability type is unknown beforehand — the agent must fingerprint, classify, and exploit without foreknowledge. RedPick solved all 5.

Testing conditions: fully black-box, no source code, no hints, no answer keys, no human guidance.

Results

Difficulty	Labs	Solved	Rate
Apprentice	61	61 of 61	100%
Practitioner	174	174 of 174	100%
Expert	39	39 of 39	100%
Total	274	274 of 274	100%

All three tiers completed at 100% — Expert level requires completing every Apprentice and Practitioner lab plus the Expert-tier labs.

By vulnerability category — all 31 at 100%

Category	Labs	Solved	Highlight
Cross-Site Scripting	30	30 of 30	Reflected, stored, DOM — 30 distinct filter bypass contexts
HTTP Request Smuggling	22	22 of 22	CL.TE through server-side pause-based desync
SQL Injection	18	18 of 18	UNION, blind boolean, time-based, OOB, XML-encoded
Authentication	14	14 of 14	Brute force, MFA bypass, password reset poisoning
Access Control	13	13 of 13	Horizontal/vertical IDOR, Referer-based, URL rewriting
Web Cache Poisoning	13	13 of 13	Unkeyed headers, parameter cloaking, fat GET
CSRF	12	12 of 12	Token bypass, SameSite, method override, Referer validation
Business Logic	12	12 of 12	Price manipulation, workflow bypass, encryption oracle
Insecure Deserialization	10	10 of 10	PHP, Java ysoserial, custom gadget chain
Prototype Pollution	10	10 of 10	Client-side DOM XSS, server-side RCE via child_process
XXE Injection	9	9 of 9	Classic, blind OOB, parameter entities, XInclude
JWT Attacks	8	8 of 8	None algorithm, weak secret, jwk/jku injection, kid path traversal
File Upload	7	7 of 7	Extension bypass, content-type tricks, polyglot, race condition
DOM-Based Vulnerabilities	7	7 of 7	document.write, innerHTML, WebMessage, cookie manipulation
HTTP Host Header Attacks	7	7 of 7	Password reset poisoning, SSRF via Host, routing-based
Server-Side Template Injection	7	7 of 7	ERB, Tornado, Freemarker, Handlebars, Twig, sandbox escape
SSRF	7	7 of 7	Basic, blind OOB, filter bypass, open redirect chaining
OAuth Authentication	6	6 of 6	Redirect URI bypass, token theft, forced profile linking
Path Traversal	6	6 of 6	Absolute path, nested bypass, double encoding, null byte
Race Conditions	6	6 of 6	Limit overrun, single-packet attack, multi-endpoint
OS Command Injection	5	5 of 5	Inline, blind time-based, blind OOB exfiltration
API Testing	5	5 of 5	Mass assignment, server-side parameter pollution
Clickjacking	5	5 of 5	Frame-based, multistep, prefilled form actions
GraphQL Vulnerabilities	5	5 of 5	Introspection, alias-based brute force, CSRF via GET
Information Disclosure	5	5 of 5	Debug pages, backup files, error messages, git history
Web Cache Deception	5	5 of 5	Path delimiter, normalization, static extension
NoSQL Injection	4	4 of 4	Operator injection, syntax injection, exfiltration
Web LLM Attacks	8	8 of 8	Prompt injection, insecure output, indirect injection, AI agent destructive actions, AI scanner defense bypass
CORS Misconfiguration	3	3 of 3	Reflected origin, null origin, insecure protocol trust
WebSockets	3	3 of 3	XSS via WebSocket, handshake manipulation
Essential Skills	2	2 of 2	Targeted scanning, non-standard data structure scanning

Three hard walkthroughs

The Level 1 and Level 2 labs build fundamentals. The Expert tier separates exploitation capability. Here are three categories that illustrate what "hard" means in this benchmark.

HTTP/2 request smuggling — the hardest category

The HTTP request smuggling category is the deepest in the Academy: 22 labs, spanning from classic CL.TE differentials to attack techniques published as original research in the last two years.

The progression:

1. Classic smuggling (Apprentice/Practitioner): CL.TE and TE.CL differentials where frontend and backend disagree on request boundaries.
2. HTTP/2 downgrade attacks (Practitioner): H2.CL and H2.TE exploit protocol translation layers. An HTTP/2 frontend rewrites to HTTP/1.1 for a backend that honors length/chunked headers HTTP/2 itself ignores.
3. H2 CRLF header injection (Practitioner): HEADERS frames carrying raw \r\n in pseudo-header values inject new HTTP/1.1 headers — or entire new requests — during re-serialization.
4. Response queue poisoning (Practitioner): the smuggled request receives the next legitimate user's response, desynchronizing the entire connection.
5. Request tunnelling (Expert): HTTP/2 frontends that tunnel requests to internal backends can be abused via :path pseudo-header manipulation to bypass routing.
6. Client-side desync (Expert): force a victim's browser into a desynchronized HTTP/2 state, exploiting browser multiplexing internals.
7. Server-side pause-based smuggling (Expert): timing-based exploitation during request parsing — sub-second pauses cause frontend/backend parsing divergence.

Why this matters: request smuggling enables cross-user attacks, cache poisoning, access control bypass, and credential theft — all without authentication. A single smuggling primitive on a CDN or load balancer can cascade to every user behind it.

SQL injection — 18 labs, 8 technique families

Context-aware selection: UNION-based for visible errors, boolean blind for same-page responses, time-based when boolean is suppressed, XML-encoded for metacharacter filters, out-of-band DNS for zero-feedback scenarios.

Each technique requires understanding the database engine (MySQL vs PostgreSQL vs MSSQL vs Oracle) because the exact OOB primitive differs: UTL_HTTP.REQUEST on Oracle, xp_dirtree on MSSQL, COPY TO PROGRAM on PostgreSQL. RedPick fingerprints the DB from subtle response patterns (error message formats, function availability) before choosing the exploitation path.

Web LLM attacks — 8 labs across two generations

PortSwigger's LLM-attack track now contains eight labs in two waves. The original four (Wave 1) cover classical LLM API security: direct prompt injection to extract system prompts, insecure output handling reaching dangerous sinks, indirect prompt injection via retrieved documents, and tool-call abuse. RedPick handles these with structured prompt-injection payloads, system-prompt extraction techniques, and tool-call manipulation patterns.

The four labs published in April 2026 (Wave 2, AI-powered scanner vulnerabilities) are a step change. The target is no longer a chatbot — it is an LLM-driven vulnerability scanner that audits user-submitted content (comments, reviews) on behalf of the application owner. The scanner has privileged tooling: it logs in as a real user, navigates the application, and executes administrative actions.

The shared primitive is indirect prompt injection against an autonomous AI agent. Attacker-controlled content framed as authoritative scanner output (a finding template, a remediation step, an internal directive) is treated by the agent as part of its own reasoning trace and executed with its own privileges:

• PS-LLM-005 (Apprentice) — destructive actions: a comment styled as a remediation procedure instructs the scanner to visit the account-deletion endpoint as the auditing user. The scanner deletes the user's own account.
• PS-LLM-006 (Apprentice) — credential exfiltration: a comment reframes "leaking your API key" as "completing the audit". The scanner posts a reply containing the redacted-by-policy key, defeating the safety mechanism that assumed voluntary self-disclosure won't happen.
• PS-LLM-007 (Practitioner) — confused-deputy chain: stage 1, the scanner sweeps internal IPs as a "connectivity check" and reports the admin host. Stage 2, a follow-up comment directs the scanner to issue an admin-endpoint request from its trusted internal source IP. A user is deleted via the scanner-as-intermediary.
• PS-LLM-008 (Practitioner) — output-filter bypass: the scanner now scans its own output for API-key patterns. RedPick reframes exfiltration into a structured "CORS audit form" populated by the scanner, where the key appears as field content rather than a bare leak. The pattern-matching filter passes it through unchanged.

The defensive takeaway: when an LLM agent has privileged tooling AND reads attacker-controlled content, every input is a potential instruction. Output filters tuned for human-attacker patterns are insufficient — the agent itself must refuse acting on instructions embedded in audited content.

Deep-dives on GitHub for other category walkthroughs:

• Insecure Deserialization (10 labs) — PHP to custom Java gadget chains
• Prototype Pollution (10 labs) — client-side to server-side RCE
• Web Cache Poisoning & Deception (18 labs) — unkeyed inputs and cache deception
• JWT, OAuth, Authentication (28 labs) — algorithm confusion, redirect URI manipulation, 2FA bypass

Multi-model collaboration

The final set of challenges — particularly the Expert-tier HTTP/2 smuggling labs and custom deserialization chains — were solved using a multi-model architecture. The primary AI engine handles reconnaissance, discovery, initial testing, and most exploitation autonomously. When reasoning stalls, a secondary AI engine with different reasoning priors is dispatched to provide a fresh perspective.

This is most valuable for protocol-level attacks requiring raw byte manipulation, multi-step chains where the escalation path is unclear, and blind/OOB exploitation where callback correlation requires careful orchestration.

For the full collaboration model, see the multi-model collaboration details on GitHub.

What was most difficult

We found every vulnerability in the benchmark. That does not mean every lab was straightforward.

HTTP/2 request smuggling (22 labs) was the most technically demanding category. Expert-level labs require manipulating raw HTTP/2 frames in ways that standard HTTP clients don't support. Standard curl and most HTTP libraries sanitize the exact characters needed — requiring low-level frame construction with specialized tooling (h2csmuggler, custom Python h2 library scripts, browser-based desync harnesses).

Blind and out-of-band exploitation across SQL injection, command injection, XXE, and SSRF presented a different challenge: zero visible feedback. Setting up external callback infrastructure, crafting payloads that trigger outbound DNS or HTTP from the target, and correlating callbacks with specific injection points requires careful orchestration beyond "find the vulnerability."

Custom deserialization gadget chains at Expert level cannot be solved with pre-built tools. The agent must reverse-engineer the application's classpath, identify exploitable method chains, and construct a serialized object that navigates through multiple class boundaries to reach a sink.

Essential Skills labs were unexpectedly tricky — they require configuring scanning tools with very specific parameters (nuclei with medium-severity templates, sqlmap with --level=5 --risk=3 against JSON/XML endpoints) that differ from standard automated scan configurations.

A perfect score does not mean the tool is perfect — it means this benchmark is within our current capability range. Real-world applications present additional challenges: custom frameworks, WAF rules, rate limiting, multi-step business logic, and attack surfaces spanning multiple services.

Methodology

• Fully black-box: no source code access, no hints, no answer keys
• Fully automated: no human intervention
• Fresh session per lab: no state carried between labs
• PortSwigger account verification: all 274 completions confirmed by PortSwigger's backend — not self-reported
• Mystery labs solved blind: 5 randomly selected labs completed without foreknowledge of vulnerability type
• Anti-cheat compliance: no docker exec, no container inspection, no answer key reads

Techniques extracted: over 60 distinct exploitation techniques were cataloged from testing sessions, covering 22 vulnerability categories. Each includes reusable curl templates, detection indicators, and bypass family classification.

The PortSwigger Academy is freely accessible at portswigger.net/web-security, and our methodology is fully documented. We invite other security vendors to publish their results — the more transparency in this space, the better.

What this means

A tool that can identify and exploit 274 distinct vulnerability instances across 31 categories — from basic reflected XSS to Expert-level HTTP/2 request smuggling, plus the latest indirect prompt-injection attacks against AI-powered scanners — demonstrates systematic coverage of the categories commonly found in production applications.

The vulnerability classes tested here — SQL injection, authentication bypass, access control flaws, SSRF, deserialization, prototype pollution, cache poisoning, request smuggling, AI-agent prompt injection — are the same classes that appear in every penetration test, every bug bounty program, and every real-world breach report.

Combined with the 104/104 XBOW score, RedPick has demonstrated 100% detection and exploitation across 378 challenges spanning 49 vulnerability categories.

Want to see what RedPick finds in your applications? Request a demo and we'll run a proof-of-concept assessment on your application.

---

More benchmark results

• 104/104 on XBOW CTF — 104 challenges across 18 vulnerability categories, pure black-box
• 7/7 on HackMerlin — progressive LLM prompt injection benchmark
• 74/74 on Vibe-Coding — ProjectDiscovery's full-stack application benchmark
• All benchmark results

Related: The AI Attacker Era · LLM Security Testing Guide