Your Attacker Doesn’t Follow Your User Flow. Neither Should Your Penetration Tester.
“But we already implemented that.” This is something we occasionally hear after reporting a vulnerability. The development team checks the application and confirms: The button is hidden. The option is disabled. The user cannot perform that action through the GUI. So why is there a vulnerabilty? Yes — the control may already exist in the…