Hasan Ekin
Hasan Ekin is a Penetration Tester at Tripadvisor, specializing in offensive security and vulnerability research. He performs penetration tests on web applications, APIs, Active Directory environments, and AWS infrastructures.
Session
Authorization bugs such as IDOR, BOLA, and BFLA remain prevalent in modern web applications despite advancements in detection tools and developer education. A key issue lies in the lack of visibility into how authorization logic is implemented and enforced across large codebases. AuthMap is an open-source static analysis and visualization tool designed to map out the authorization flow of web applications. Unlike traditional IAM auditing tools that rely on runtime policies or databases, AuthMap operates directly on the application’s source code, helping both security engineers and developers understand and fix authorization flaws early in the development lifecycle.