SQL injection lab walkthrough: from detection to extraction
A hands-on walkthrough of finding and exploiting a classic SQL injection in a deliberately vulnerable lab, then confirming and reporting it responsibly.
CyberSecFix
Tutorials
Step-by-step, hands-on security tutorials.
Testing for BOLA with Burp Suite: a repeatable workflow
A step-by-step workflow for finding object-level authorization flaws in APIs using an intercepting proxy and two authenticated sessions.
API reconnaissance basics: building a map before you test
Effective API testing starts with reconnaissance. How to enumerate endpoints, understand auth, and model the API before probing for flaws.
A methodology for IDOR testing in web applications
A structured approach to hunting IDOR in traditional web apps: identifying references, classifying them, and proving cross-user access.