A · Common flawsBeginner35 min read
2. Auth & session basics
Security Testing Basics · 20 pages source format
Broken auth and session mishandling are still everyday bugs. Test logout, expiry, and privilege.
What you'll learn
- Session fixation smells
- Logout reality
- Role checks
Horizontal privilege
Can user A see user B’s resource by changing an ID?
Do this now
Attempt one IDOR-style check on a safe staging app.
Pro tip. Never test production with destructive payloads.
Clear?