I did a lot of the Pentesterlab Pro exercises: https://www.pentesterlab.com/exercises https://www.pentesterlab.com/exercises And was astounded by how many of

I did a lot of the Pentesterlab Pro exercises: https://www.pentesterlab.com/exercises https://www.pentesterlab.com/exercises And was astounded by how many of them came in the class of "OAuth Exploits". And far from a list of specific CVEs in some random app, you seemed to be able to go from one common implementation bug to the next. You walk away wondering how anyone ever gets it right.