Target: Vulnerable Application
Engagement Type: Internal Web Application Penetration Test
Status: Findings Identified & Documented
A full-scope penetration test was conducted against the Vulnerable Application to identify security weaknesses in authentication, session management, authorization, and business logic. Below are the key findings with supporting evidence.
The application exposes sensitive card data via an IDOR vulnerability in the card listing endpoint. An authenticated user can enumerate other users' card details by manipulating identifiable parameters.
Description: Baseline view of the card list endpoint showing accessible card records. Parameter manipulation confirmed unauthorized access to other users' data.
The application fails to properly invalidate authentication tokens upon user logout, allowing an attacker with a captured session token to continue accessing resources post-logout.
Description: The user is authenticated and actively viewing protected resources prior to initiating logout.
Description: The logout action triggers a redirect, but session tokens remain active on the backend.
Description: Post-logout request using the same authentication token returns valid data, confirming the token was not invalidated server-side.
Parallel requests sent to the account management endpoint reveal a race condition that can lead to inconsistent state or unauthorized operations.
Description: Account state captured before issuing concurrent (race) requests. The race window allows unexpected behavior when parallel requests are processed without proper locking.
| Finding | Type | Severity |
|---|---|---|
| F23 — IDOR in Card List | Authorization | 🔴 High |
| F24 — Token Not Invalidated on Logout | Session Management | 🔴 High |
| 27 — Race Condition in Account Ops | Business Logic | 🟡 Medium |
| Tool | Purpose |
|---|---|
| Burp Suite Professional | Proxy, Repeater, Intruder |
| Postman / cURL | Manual request crafting |
| Browser DevTools | Token & storage inspection |
| Custom Python Scripts | Parallel race-condition testing |
- F23: Implement server-side ownership checks on all card list endpoints. Use indirect object references where possible.
- F24: Invalidate all active sessions server-side on logout. Clear token stores and blacklist JWTs.
- 27: Introduce database-level row locking and idempotency checks to prevent race conditions.
Made by ALLEN