A_box4·3d agoBroken Access Control via Direct URL Navigation: Bypassing Premium Feature Restrictionsيَرْفَعِ ٱللَّهُ ٱلَّذِينَ ءَامَنُوا۟ مِنكُمْ وَٱلَّذِينَ أُوتُوا۟ ٱلْعِلْمَ دَرَجَـٰتٍ ۚ وَٱللَّهُ بِمَا تَعْمَلُونَ خَبِيرٌ
Yudha Pratama·Oct 27Web Security Day 4 (Part 2): PortSwigger Writeup — User ID Controlled by Request Parameter with…Hello everyone! To wrap up the Access Control chapter of my web security documentation, I am tackling one final PortSwigger lab: User ID…
Samadhan shimple·Oct 26One Email Parameter Was All It Took: How Broken Access Control Let Me Create a Folder in Another…A practical bug bounty story about testing authorization, manipulating request parameters, and finding a potential IDOR vulnerability.
Zygmunt kołodziejczyk·Oct 20In Search of Low LatencyFrom 2.2 seconds to 66 ms at the door — with TLS, a dead fiber line and wild boars along the way
InOSINT TeambyZahid Hussain Shah·Oct 20Broken Access Control: I Deleted a User Without Logging In (OWASP Top 10 #1)Part 1 of my OWASP Top 10 series — explained for beginners, with a live hands-on lab.
Sheikh Mujtaba (Mujtaba Javed)·Oct 13Broken Access Control in a Cloud API: How One Missing Check Leaked a Secret (CTF Walkthrough)A beginner-friendly look at IDOR — how an API that trusts the wrong thing hands you data you were never meant to see, and how to stop it.A response icon1A response icon1
kjulius·Oct 7Critical BAC: IDOR + Weak Appointment Code Enables Unauthorized Appointment Cancellation…While testing a public-facing pre-complaint system, I discovered a critical Broken Access Control (BAC) issue involving appointment…
Shruti Vijay Shinde·Oct 7Broken Access Control OWASP Top 10 (2025): A Practical Checklist (Part 2)Hey everyone! 👋
Nourammar·Oct 5One GraphQL Mutation Let Me Change Another User’s Alert SettingsA Broken Access Control vulnerability where changing a single userId allowed an authenticated user to modify another user’s notification…A response icon1A response icon1
