Authorization: Where Permissions Fail

You are permitted to enter... but are you permitted to touch? Master the detection of IDOR (Insecure Direct Object References), Mass Assignment of Admin privileges, and finding "Hidden" endpoints that lack access control.