/web-attacks/broken-access-control/index.html Hugo en Sun, 19 Jul 2026 14:14:10 +0100 /web-attacks/broken-access-control/bac/index.html Sun, 19 Jul 2026 14:14:10 +0100 /web-attacks/broken-access-control/bac/index.html Intro In my last blog post, I walked through a blind out-of-band SQL Injection vulnerability I discovered during a web application pentest and the complexities / difficulties I faced during that engagement. This blog post will be a little different. Instead of an engagement story, we’re going to look at Broken Access Control, the category that sits at #1 on the OWASP Top 10 and one of the most commonly found issues in web apps.