Offensive security - Testing for Broken Access Control (OWASP)

Hands-on at tryhackme room #1..

I used dirb on CLI to brute-force hidden directories on a static web app

dirb http://www.targetwebsite.com/

Findings:

• I access the site like a normal user

• Discovered/admin/endpoints not shown in UI

Lesson: Obscurity is not equal security

Always enforce rule base control when building your website

Day #3/50 journey...