PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

When attackers log in as you: Understanding broken authentication and session management risks

bugcrowd.com | blog | #ai-security | #access-control | #web-security | #authentication | #mfa | #session-management
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Broken authentication lets attackers log in as legitimate users without stealing passwords—via bypassable MFA, predictable reset tokens, or session flaws—often silently, despite firewalls and EDR.
Published
Collected

Related coverage

blog · vercel.com
The three types of AI bot traffic and how to handle them
Bots account for over 20% of all web traffic. A quarter of that is AI crawlers alone. But not all bots are bad. Some are key to how your site gets discovered. Learn how AI bots shape visibility and what happens if you block them.
blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · netspi.com
Multi-Factor Authentication: The Bare Minimum of IAM
Sectigo CTO Jason Soroko joins the Agent of Influence podcast to explain why MFA is the bare minimum of IAM, covering symmetric vs. asymmetric secrets and digital certificate best practices.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
research · vercel.com
Security boundaries in agentic architectures
A framework for drawing security boundaries in agentic architectures. Most agents run with zero isolation between the agent and the code it generates. Learn where to draw the boundaries, from secret injection to full application sandboxing.
blog · bughunters.google.com
Breaking into Google's GFile for $100k
This post details an attack on Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage.
Back