Web Hacking → Auth & Sessions
Injection was the easy half — the sink is a function you can grep. The dangerous findings have no sink: broken access control, IDO…
The login form is just one door, and it is rarely the weakest. This is the full field guide to getting in without the password: SQ…
Once you are logged in, the session cookie IS your password. This is the full field guide to stealing it: hijacking, sidejacking, …
They sound almost the same. They even share a nickname — “auth.” And that’s half the reason people keep mixing them up. But they’r…
A JSON Web Token is your “I’m logged in” badge for stateless APIs. The catch: the part that says who you are is just Base64 — read…
JWT validation has been a steady source of CVEs since 2015, because the header itself decides how the token gets verified — change…
Almost every real OAuth/OIDC bug lives in the gaps the spec leaves to implementers. The Authorization Code flow first, then redire…
Why MD5/SHA-256 are catastrophic for passwords, how bcrypt and Argon2id actually work internally, what makes a hash GPU-resistant …
Every authentication scheme the modern web speaks — HTTP Basic, Digest, form-based, OAuth 2.0, OpenID Connect, SAML 2.0. The wire …
How web sessions actually work. Server-side sessions vs token-based, every cookie attribute, the full lifecycle, session fixation,…