Day 1 of my learning:

Today I learned about broken access control and modern Linux file systems. Below is the breakdown of my core technical learning and practical takeaways for today:

1. Web Security: Authentication, Authorization & Access Control Core Concepts: Explored how HTTP is a stateless protocol, relying on authentication, authorization, and session tokens to manage user identity and access states.

Broken Access Control: Studied the core concept of access control failures, which PortSwigger and OWASP categorize into three main types:

Vertical Access Control Failures: Accessing privileged functionality (or resources) that should be restricted to specific user roles.

Horizontal Access Control Failures: Accessing resources belonging to other users with the same privilege level (noting that Insecure Direct Object References / IDOR are a specific manifestation of horizontal access control failure).

Context-Dependent Access Control Failures: Accessing functions out of sequence or violating application workflow constraints.

Root Causes of Access Control Vulnerabilities: Identified six common developer mistakes:

1. Relying solely on removing UI buttons/elements from the front-end while assuming the back-end is safe.
2. Trusting the user's login session rather than verifying object ownership.
3. Failing to check every HTTP method.
4. Failing to check every API route.
5. Relying on previous permission states (e.g., assuming a user who completed Stage 1 remains authorized for Stage 3 without re-validation).
6. Relying on "guessable" or predictable IDs as a form of security.

ID Types: Examined predictable versus unpredictable identifiers used within applications.

Hands-On Practice: Successfully solved the "Unprotected admin functionality" lab on PortSwigger Web Security Academy, reinforcing how missing server-side authorization allows unauthenticated users to access admin paths and execute privileged actions (such as deleting a user).

2. Operating Systems: Modern Linux File Systems Studied core operating system architecture from the book Learning Modern Linux (2022) by Michael Hausenblas, specifically focusing on Chapter 5 (File Systems):

File System Hierarchy: File systems start at the root directory denoted by a slash (/), containing directories and files.

Nodes & Leaves: Directories act as nodes, while files and directories act as leaves in the system structure.

Storage Units:

HDD / SSD: The physical hardware storage devices.

Partitioning: Dividing a physical hard disk drive into separate, independent parts.

Volumes: Function similarly to partitions but offer greater flexibility, typically used for special file system formatting.

Superblock: Records critical structural information about the file system itself.

Inodes: Store the metadata associated with files in the file system.

Links: Mechanisms to access the same file using alternative names or shortcuts:

Hardware Links: Accessing the same file through a direct hardware link/alternative name.

Symbolic Links: Acting as a shortcut to point to a target file path.

VFS & Core Abstractions: Explored the Virtual File System (VFS) abstraction layer, along with temporary file systems (tmpfs), process file systems (procfs), network file systems (nfs), drivers, inodes, dentries, and mount points.