Beyond the
interface_
Pentesting. Web vulnerabilities.
The logic you cannot see
in the browser.
from fundamentals to manual testing
GET /api/orders/B-104403 ForbiddenIDOR: another user’s object.
One familiar request.
Two accounts. One changed identifier.
Where authentication ends and authorization begins.
Technical journal/ 14
PRACTICE WITH THE WHY EXPLAINEDWeb security
Trust boundaries in web applications
IDOR: another user’s object, one familiar request
Why signing in does not grant access to every object. A controlled test with two accounts.
SQL injection: keep data from becoming code
How the flaw arises, and why an error message is not enough to prove it.
XSS: understand the context before testing
HTML, an attribute or JavaScript? The same string behaves differently depending on where it appears.
SSRF: when the server makes the request
URL imports, webhooks and link previews as trust boundaries.
File uploads: extensions prove nothing
What to check between selecting a file, storing it and serving it back.
API & tools
Requests, sessions and manual testing
Burp Repeater: one request, one hypothesis
A method for manual HTTP testing without changing a dozen parameters at once.
API pentesting goes beyond the contract
Objects, fields, roles and API versions: four dimensions that are easy to overlook.
Logging out is a server-side operation
Testing session termination, timeouts and reuse of an old token.
Methodology
From defining scope to verifying fixes
A pentest starts before the first request
Scope, test roles and stopping criteria. Plan an assessment that produces useful results.
Turn a finding into a report someone can fix
Evidence, impact and retesting: what should remain after the assessment.
Digital hygiene
Everyday habits that reduce risk
Something to investigate?
Questions, corrections and ideas for future articles.