Further reading
These links provide further reading on password brute forcing and fuzzing:
- https://portswigger.net/web-security/authentication/password-based
- https://github.com/0xZDH/burp-password-spray
- https://github.com/OJ/gobuster
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/09-Testing_for_Weak_Password_Change_or_Reset_Functionalities
These links provide further reading on token attacks and manipulation:
- https://www.elastic.co/blog/how-attackers-abuse-access-token-manipulation
- https://portswigger.net/web-security/jwt
- https://portswigger.net/web-security/jwt/algorithm-confusion
- https://danaepp.com/how-to-use-azure-to-crack-api-auth-tokens
- https://attack.mitre.org/techniques/T1134/
- https://www.howmanydayssinceajwtalgnonevuln.com/
These links provide further reading on API keys and tokens:
