Labs 2
The second set, with the obvious routes closed.
Labs 1 5
Five rounds, each one a different reason the login gives way.
Labs 2 1
Also here 1
Nothing matches thatClear the filter to see everything again.
Getting past the login without the password. Sometimes it is injection, sometimes the check simply runs in the wrong order.
Authentication is who you are; authorisation is what you are allowed to touch. Broken access control is the app checking the first and forgetting the second, so an object id, a role field or a hidden admin route is all that stands between you and someone else's data.
Five rounds, each one a different reason the login gives way.
The second set, with the obvious routes closed.