Access control and authentication

What this path is#

Foundations ended with your first access-control bug: you changed one number in a URL and read an order that was not yours. This path is that idea, taken all the way. Access control and authentication are where most real bug-bounty findings and most exam points live, because they are about a simple question that software gets wrong constantly: is this person actually allowed to do this?

You will learn to hold two accounts and test one against the other, to find objects the server hands over without checking who is asking, to reach admin functions the interface merely hid, to break weak logins and password resets, to abuse sessions, and to forge identity tokens. Every technique lesson ends in a real Academy lab so you practise on something that behaves like a live application.

Who it is for#

• Anyone who finished Foundations and wants the bug class that pays the most.
• Someone preparing for an entry-level web-application penetration testing exam. This path covers the access-control, authentication, session-management and token skills those exams assess, built on the public OWASP Web Security Testing Guide. It is not affiliated with, or endorsed by, any exam vendor and uses none of their material.

The plan#

1. Two questions: authentication and authorization. The distinction the whole path turns on.
2. The two-account method. The test harness you will use for the rest of your career.
3. IDOR and object-level access. Objects the server hands over without checking ownership.
4. Function-level access and method swaps. Reaching actions the UI only hid.
5. Weak authentication. Default credentials, weak passwords, and brute force.
6. Breaking password reset. The recovery flow is often the softest way in.
7. Sessions: cookies, fixation, and logout. The value that keeps you logged in, and its failures.
8. JWT and forging identity tokens. When the token itself is the vulnerability.

Before you start#

Finish Foundations first, especially the last two lessons: identity is a value you send, and a finding only counts when it reaches another user's data or a privileged action, never your own. You need a browser, curl, and ideally an intercepting proxy. The recon path helps but is not required. Everything here is practised on your own accounts against this Academy's labs, where you are always in scope.