Web Hacking → Auth & Sessions
The login form is just one door, and it is rarely the weakest. This is the full field guide to getting in without the password: SQ…
JWT validation has been a steady source of CVEs since 2015, because the header itself decides how the token gets verified — change…
Why MD5/SHA-256 are catastrophic for passwords, how bcrypt and Argon2id actually work internally, what makes a hash GPU-resistant …
Every authentication scheme the modern web speaks — HTTP Basic, Digest, form-based, OAuth 2.0, OpenID Connect, SAML 2.0. The wire …
How web sessions actually work. Server-side sessions vs token-based, every cookie attribute, the full lifecycle, session fixation,…
Complete guide to OAuth 2.0 account takeover, SAML signature wrapping, JWT alg:none/RS256-HS256 confusion, kid injection, JWK head…