Educational / lab material. This post uses a simulated application, fictional data, and no real target.
Questions before a payload
In a login flow, I start with four questions: which states exist, which states are trusted, what changes between steps, and what the server checks at each transition.
Instead of presenting a concrete payload, build a table with state, input, server decision, and expected invariant. This helps separate interface problems from server-side logic problems.
Signals to record
- does the cookie or session change after each step;
- does access depend on data sent by the client;
- is the behavior consistent when the same flow is reopened in a clean lab.
Conclusion
A good writeup explains why a hypothesis is right or wrong, rather than only showing a request that “looks unusual.”