ArticleUser ID controlled by param with password disclosure
User ID controlled by param with password disclosure: This lab’s account page prefilled the current user’s password in a masked input. The goal was t…
Blog topic
Access control vulnerabilities
Authorization and access-control writeups covering IDOR, privilege escalation, and secure design.
- 4
- Matching posts
Article
ArticleUser ID controlled by request parameter, with unpredictable user IDs
User ID controlled by request parameter, with unpredictable user IDs: This lab contains a blind SQL injection vulnerability. The application uses a t…
ArticleUser role controlled by request parameter
User role controlled by request parameter: This lab has an admin panel at /admin, which identifies administrators using a forgeable cookie. • PortSwi…
ArticleKnowledge article about Access-control
Knowledge article about Access control: I wanted to make my knowledge more wide so I started ona new topic Access Control Access control vulnerabilit…