Authentication
7 matching posts.
The Login Page Was Public. The Identity Boundary Was Somewhere Else.
A public login page is only the visible start of an identity system. External pentesting must map the issuer, callback, token policy, account binding, tenant and role conversion, and local session before testing authorization.
The Handshake Was Captured. The Network Was Not.
A Wi-Fi assessment methodology that separates radio visibility, network identity, authentication, client trust, and post-association access before calling a wireless test successful.
Android App Links: The Link Was Verified. The Action Was Not.
A field methodology for Android App Links that separates domain ownership, route validation, application state, and server-side authorization before calling a deep link secure.
They Do Not Break In. They Log In.
Part one of testing the ransomware playbook: the initial access an affiliate needs is almost always a valid credential against a reachable endpoint — and that finding is usually already in a report somewhere, marked medium.
The Signature Is Valid. The Token Still Belongs Somewhere Else.
JWT verification fails when applications treat one cryptographic success as a complete access decision. Algorithm, key, issuer, audience, and token type are separate bindings — skip one and a perfectly valid token crosses the wrong boundary.
The Flow Is Standard. The Bypass Is in the Half You Skipped.
OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.
The Path Your Proxy Blocks Is Not the Path Your App Runs
When authorisation and routing are done by different software, they parse the URL differently. The bypass is not in either component — it is in the order they run.