The newest Authorization / Broken Access Control resources are on the Authorization / Broken Access Control page. For a reading order instead of a date order, see the Authorization / Broken Access Control learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2023-05-21 2023 | Authentication authorization and security in SharePoint intermediate 4 min read AuthN | Reference on SharePoint authentication and authorization, detailing its role-based security model and support for Windows authentication (including NTLM and Kerberos) and ASP.NET forms-based authentication. It highlights claims-based identity as a core feature, enabling cross-platform authentication and integration with external identity systems, and explains how membership and role providers are utilized to manage user identities and group memberships. |
| 2023-05-09 2023 | Seven Common Ways To Bypass Login Page intermediate AuthN | Seven Common Ways To Bypass Login Page https://ift.tt/8PI0ers |
| 2023-04-13 2023 | OWASP Proactive Controls 2023/2024 v1 beginner API Sec AuthN | OWASP Proactive Controls 2023/2024 v1 https://ift.tt/xVAnFY5 → docs.google.com |
| 2023-03-29 2023 | skills/secure-code-game beginner 1 min read Bug Bounty | Library for learning secure coding through an interactive in-editor game. Season 4 focuses on securing Agentic AI, teaching how to protect Agentic Workflows and Multi-Agent Communications through five progressive levels. Players can start quickly from their browser, with no AI or coding experience required. The game runs instantly in GitHub Codespaces, with over 10,000 players participating from industry and academia. |
| 2022-04-14 2022 | Favorite tweet by @Jhaddix intermediate Bug Bounty | Favorite tweet: 🧵Another hacker story thread!🧵 === Penetrating a Porn Site === How I hacked access to the most sensitive areas of a porn site using only low severity vulnerabilities. Here's how I did... |
| 2021-11-10 2021 | How to Control Access to Your Amazon Elasticsearch Service Domain intermediate 12 min read | Reference for controlling access to Amazon OpenSearch Service (formerly Amazon Elasticsearch Service) domains. It details how to leverage AWS Identity and Access Management (IAM) through resource-based policies and identity-based policies. The entry also covers authentication strategies, including IP-based restrictions and Signature Version 4 signing, with examples for both Python and Java. → aws.amazon.com |
| 2021-10-29 2021 | Improvements to Burp Suite authenticated scanning intermediate 4 min read Burp | Library improvements in Burp Suite 2021.9.1 enhance authenticated scanning by better handling iframes, animated elements, JavaScript-driven redirections, nested SVGs within buttons, and multi-select elements, leveraging the Burp Suite Navigation Recorder for complex login sequences. → portswigger.net |
| 2021-09-14 2021 | IAM Vulnerable intermediate 7 min read | Tool for creating a vulnerable-by-design AWS IAM privilege escalation playground. Using Terraform and your AWS credentials, it deploys over 250 IAM resources to facilitate learning and exploitation of 31 unique privilege escalation paths, referencing techniques pioneered by Spencer Gietzen and applicable to tools like Cloudsplaining and Pacu. |
| 2021-09-07 2021 | Automating Authorization Testing: AuthMatrix Part 1 intermediate 2 min read Bug Bounty | Library for automating authorization testing. This resource, AuthMatrix Part 1, introduces a technique for comprehensively testing application authorization by creating custom matrices to cover all possible user role and permission combinations, effectively identifying and mitigating authorization bypass vulnerabilities. → whiteoaksecurity.com |
| 2021-07-28 2021 | Chaining password reset link poisoning IDOR and information leakage to achieve account takeover at api.redacted.com advanced Bug Bounty IDOR | This report details a method to achieve account takeover at api.redacted.com by chaining three vulnerabilities. The attacker first exploits password reset link poisoning, then an Insecure Direct Object Reference (IDOR) flaw, and finally leverages information leakage. These combined vulnerabilities allow for unauthorized access to user accounts. |
| 2021-07-19 2021 | AWS IAM Role Chaining intermediate | AWS IAM Role Chaining allows one IAM role to assume another IAM role. This enhances security by enabling temporary, limited-privilege credentials to be granted for specific tasks. Instead of managing separate policies for every user and service, roles can be chained together, where Role A assumes Role B. This promotes the principle of least privilege, reducing the potential attack surface. The primary benefit is improved security and streamlined credential management within AWS environments. |
| 2021-06-30 2021 | Forbidden You dont have permission to access / on this server Error beginner 4 min read | Reference on resolving the Apache "Forbidden – You don’t have permission to access / on this server" error. This guide addresses common causes such as incorrect file/directory permissions, misconfigurations in Apache's main configuration files, and improperly formatted .htaccess files. Solutions include recursively adjusting file permissions with `chmod 755` for directories and `chmod 644` for files, modifying ownership with `chown`, and ensuring `AllowOverride All` is set in Apache's `<Directory>` directives. |