Authorization and Access Control
Configured Is Not Enforced
AWS shipped four condition keys for DynamoDB and did not evaluate them at runtime. Your policy sat there, looked excellent in code, and did nothing.
Read itAuthorization and Access Control
A JWT That Trusted the Client: How One Shortcut Became Full Admin Access
A penetration test where a JWT carried the user's role in its payload and the server trusted it. Changing one field - and an allowed alg:none - turned…
Read itAuthorization and Access Control
A Valid Token Is Not a Permission: The OAuth Scope Nobody Checked
The Authorization Code flow was textbook. Then the server accepted any valid access token on an admin endpoint, whatever scope it carried - and I created an administrator.
Read itAuthorization and Access Control
“It’s GraphQL, It’s Typed, It’s Safe” – One Introspection Query Later
Introspection returned the whole schema. One mutation set isAdmin=true. The UI hid the field; the API never checked it.
Read itAuthorization and Access Control
They Batched Eight API Calls Into One. I Chained Three of Them Past Authorization.
A performance optimisation - one endpoint instead of eight calls. Every command was authorised on its own. Nobody had asked what happens when they run in the same…
Read itAuthorization and Access Control
Sandwich Attacks: From Reset Password to Account Takeover
Once Upon a Password Reset… You’ve just forgotten your password for a website. No big deal, you click "Forgot Password," they send you a link, and you reset…
Read itTell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.