scope

Identity and Access

The specific list of things an OAuth permission covers, such as read a calendar but not delete from it. An app asking for wider scopes than its job needs is a red flag, and a token with wide scopes is a bigger prize when stolen.

Related terms

OAuth 2.0

access token

least privilege

Appears in(116)

What Is a NetworkNetworking Foundations
The OSI ModelNetworking Foundations
Cmdlets, Parameters, and Getting HelpPowerShell
IP Addressing and SubnettingNetworking Foundations
Networking from the CLILinux for Security
IPv6 and the Modern InternetNetworking Deep Dive
Write a Recon Bash ScriptLinux for Security
Recon Methodology and Attack SurfaceRecon and Scanning
Host DiscoveryRecon and Scanning
Subdomain and Content EnumerationRecon and Scanning
Print Debugging and the DebuggerDebugging and Testing
Writing Tests With pytestDebugging and Testing
Intercepting ProxiesWeb and HTTP
The OWASP Top 10Web and HTTP
IDOR and SSRFVulnerabilities and Exploitation
Browsing PrivatelyDigital Self-Defense
Responsible Disclosure and EthicsVulnerabilities and Exploitation
Phishing and PretextingSocial Engineering
Windows Architecture and ProcessesWindows Fundamentals
PowerShell for SecurityWindows Fundamentals
Windows Event LogsWindows Fundamentals
Windows Networking and SMBWindows Fundamentals
Automating ReconPython for Security
Docker ComposeDocker and Containers
Running Vulnerable Apps in DockerDocker and Containers
Container Security BasicsDocker and Containers
Server-Side Request ForgeryWeb Application Attacks
Insecure DeserializationWeb Application Attacks
Attacking AuthenticationWeb Application Attacks
Crawling and ScanningBurp Suite
A Real Testing WorkflowBurp Suite
Finding and Running ExploitsThe Metasploit Framework
MeterpreterThe Metasploit Framework
Post-ExploitationThe Metasploit Framework
A Repeatable Privesc MethodLinux Privilege Escalation
Token ImpersonationWindows Privilege Escalation
OSINT FundamentalsOpen Source Intelligence
Profiling PeopleOpen Source Intelligence
Mapping Infrastructure and DomainsOpen Source Intelligence
Google DorkingOpen Source Intelligence
OSINT ToolingOpen Source Intelligence
Forensics Fundamentals and Chain of CustodyDigital Forensics
Disk and File System ForensicsDigital Forensics
Network ForensicsDigital Forensics
The Incident Response LifecycleIncident Response
Detection and TriageIncident Response
Containment, Eradication, RecoveryIncident Response
Log Analysis for RespondersIncident Response
What a SOC Actually DoesSOC Analyst Fundamentals
The MITRE ATT&CK FrameworkSOC Analyst Fundamentals
Escalation and HandoffSOC Analyst Fundamentals
Log Sources That MatterSIEM and Log Analysis
Writing Detection QueriesSIEM and Log Analysis
Tuning Out the NoiseSIEM and Log Analysis
The Hunting MindsetThreat Hunting
Hypothesis-Driven HuntingThreat Hunting
Indicators vs BehaviorsThreat Hunting
Network SegmentationNetwork Defense
VPNs and Zero TrustNetwork Defense
AWS IAM in DepthAWS Security
S3 SecurityAWS Security
Enumerating AWS With KeysAWS Security
Detection in AWSAWS Security
Kubernetes ArchitectureKubernetes Security
Pods, Services, and RBACKubernetes Security
Common Cluster MisconfigurationsKubernetes Security
The OWASP API Top 10API Security
Broken Object Level AuthorizationAPI Security
Testing an APIAPI Security
What GRC Actually IsGovernance, Risk, and Compliance
Security FrameworksGovernance, Risk, and Compliance
Audits and ComplianceGovernance, Risk, and Compliance
The Intelligence LifecycleCyber Threat Intelligence
Tracking Threat ActorsCyber Threat Intelligence
Testing and Tuning DetectionsDetection Engineering
The Mobile Threat ModelMobile Application Security
Common Mobile VulnerabilitiesMobile Application Security
Testing a Mobile AppMobile Application Security
Firmware BasicsIoT and OT Security
Common IoT WeaknessesIoT and OT Security
Why Crypto Implementations FailCryptographic Attacks
Encoding Is Not EncryptionCryptographic Attacks
Attacking Weak HashingCryptographic Attacks
Padding Oracle AttacksCryptographic Attacks
Why You Need a LabBuilding a Home Lab
Networking Your LabBuilding a Home Lab
Snapshots and Safe HabitsBuilding a Home Lab
Data Flow DiagramsThreat Modeling
Threat Modeling a Real AppThreat Modeling
Turning Threats Into FixesThreat Modeling
The Report Is the ProductWriting Security Reports
Structuring a ReportWriting Security Reports
The Executive SummaryWriting Security Reports
The Map of Security RolesBreaking Into Security
Prototype PollutionAdvanced Web Attacks
HTTP Request SmugglingAdvanced Web Attacks
Attacking GraphQLAdvanced Web Attacks
Building a Vuln Management ProgramVulnerability Management
Scanning and Authenticated ScansVulnerability Management
Remediation and SLAsVulnerability Management
Authentication vs AuthorizationIdentity and Access Management
MFA Done RightIdentity and Access Management
The Pillars of Zero TrustZero Trust Architecture
Identity as the PerimeterZero Trust Architecture
Phishing Defense in DepthEmail Security
Investigating a PhishEmail Security
How DNS Really WorksDNS and Network Services Security
DNS AttacksDNS and Network Services Security
The Supply Chain Attack SurfaceSoftware Supply Chain Security
Dependency RiskSoftware Supply Chain Security
Securing CI/CDSoftware Supply Chain Security
Signing and ProvenanceSoftware Supply Chain Security
Classifying DataData Protection and Privacy
Key ManagementData Protection and Privacy
Data Loss PreventionData Protection and Privacy
Privacy Laws That BiteData Protection and Privacy