Coursera Spring Sale
40% Off Coursera Plus Annual!
Grab it
Explore a detailed conference talk from Ekoparty Security Conference that demonstrates two successful high-severity Account Takeover (ATO) attacks achieved through vulnerability chaining. Learn about the first case involving SSO misconfiguration exploitation combined with an out-of-scope XSS vulnerability and Facebook API functionality to execute a user-interaction ATO in a web services company. Discover the second case that leverages password change function misconfiguration and UUID normalization after password recovery to achieve an ATO in a chat integration company. Follow along step-by-step through each bug discovery process, examining the collected clues and understanding how combining multiple vulnerabilities created greater impact than individual exploits. Gain insights from real triager interactions and bug report experiences shared by security researcher Benjamín "bronxi" Muñoz at Ekoparty 2024.
