The Clock Doesn't Lie: Timing Attacks in Authentication Flows
A timing side-channel in JSONAuth allows unauthenticated attackers to enumerate valid usernames based on response time differences.
TAG ARCHIVE
#auth
2 posts across research, tutorials, and notes.
Testing Password Reset Flows for Token Reuse and Host Poisoning
Step-by-step methodology for validating reset flow token handling, expiry controls, and host header trust boundaries.