----------------------------------------------------------------------------------- | |---------------------------------------------------------------------------------- 1) admin dashboard authentication bypass Description : An Attackers are able to completely compromise the web application built upon the user login and management php script as they can gain access to the admin panel and manage other users as an admin without authentication! Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/LoginDashboard/admin/index.php Step 2: Access http://localhost/LoginDashboard/admin/dashboard.php Risk : Unauthenticated attackers are able to gain full access to the administrator panel and thus have total control over the application and users , including add admin user .. etc |---------------------------------------------------------------------------------- 2) account takeover - cross side request forgery Description : attacker can craft a malicious page and send it to any user who is already authenticated to change the password > exploitation <