Posts about Access control

Grey-box pentesting: which access to provide, and why

Grey-box pentesting: test accounts, API documentation, a domain user account. Which access to give the pentester, what it lets them test, and where it stops.