Our penetration testing team was tasked with conducting an external penetration test for a confidential FinTech company. The assignment was a black box test with a predefined scope and no additional information provided. Since the product had not been released yet, our team was given access to two user accounts of any type, excluding admin accounts.
Our team successfully compromised various accounts and injected malicious payment records into different user accounts. When a user downloaded their payment records, a reverse shell was triggered, compromising the user's machine.
Foothold Security's experts identified a chain of vulnerabilities, including:
Authentication Bypass: We bypassed the authentication mechanisms to gain unauthorized access.
Insecure Direct Object Reference (IDOR): This allowed us to access and manipulate the payment history of other users.
Cross-Site Scripting (XSS): By injecting malicious code into the payment records, we ensured that the code executed on the user's machine when the records were viewed.
By exploiting these vulnerabilities, we accessed the payment history of another organization and injected code that compromised the machine of anyone reviewing the payment history.
This case study underscores the importance of external black box penetration testing. Our comprehensive report included actionable recommendations for mitigating all identified vulnerabilities. After a subsequent retest, none of the vulnerabilities were reproducible, significantly enhancing the application's security.
If you are interested in web penetration testing, please refer to our Penetration testing services.