New answers tagged code-review
In real attack scenario the finding magic parameter is almost bleak, as randomness in magic parameter is enough high to protect it from probable brute force attack. However when it comes to source code review it is clearly mention that if magic parameter matches the random hash, the user will land in admin dashboard.
Wish I'd seen this sooner, but I'm just reading that OWASP Testing Guide myself. For me, the code snippet has the following obvious flaws: Stored password is clear-text. Stored password is compared against clear-text password provided by user Password is stored in source code and could be committed to version control That's like storing your user ...
Top 50 recent answers are included