This post is part 1 of a series. We spent a chunk of May and June 2023 working through the PortSwigger Web Security Academy labs, mostly the SQL injection track, and taking notes on our wiki as we went. This post is the setup - what the Academy is, why we picked it, and how it fits together. The posts that follow will cover the specific techniques.

What the Academy Is

PortSwigger makes Burp Suite, which is the standard tool for web application security testing. They also run a free online academy at portswigger.net/web-security, which consists of written lessons …