Web App Assessment & Risk Validation
GitHubConducted structured security assessments to identify data exposure, authorization flaws, and access control weaknesses.
Overview
A structured black-box and gray-box penetration test against a complex web application, identifying critical business logic flaws that automated scanners miss, specifically focusing on the OWASP Top 10.
The Problem
Exposed API endpoints allowed Insecure Object Reference (IDOR) and weak session management, risking unauthorized multi-tenant data access.
System Architecture
Testing toolkit included Burp Suite Professional, OWASP ZAP, Postman, and custom Python scripts for exploiting race conditions.
Engineering Trade-offs
Prioritized manual business logic testing over running heavy automated vulnerability scans to reduce noise and provide higher-value, actionable findings.
Lessons Learned & Future
Production Learnings
Modern web frameworks (like React/Next.js) have largely mitigated traditional XSS and CSRF, shifting the primary attack surface almost entirely to API authorization flaws (IDOR/BOLA).
Future Improvements
Automating the detection of IDOR vulnerabilities by writing custom Burp Suite extensions (BChecks).
Database Layer
N/A
API Design
Analyzed the target's RESTful API design to map predictable resource identifiers which were subsequently exploited via IDOR.
Security Decisions
1. Identified that client-side role checks were being used instead of server-side validation. 2. Provided exact code snippets for implementing proper object-level authorization (BOLA/IDOR protection).
Scale & Metrics
N/A