Internal Web Application · Web & Network Penetration Test
Penetration Testing Report for Haft Sang
A comprehensive security assessment of the internal web application of Haft Saze Gharb, focused on OWASP Top 10 risks, exposed services, authentication, and access control.
01
Introduction
This report details the penetration testing project conducted on the internal web application of Haft Saze Gharb. The objective was to identify security vulnerabilities and provide recommendations to improve the application's security posture. Testing focused on vulnerabilities outlined in the OWASP Top 10.
02
Project Description
Application and scope
Project management and internal communications
The engagement covered the application's web components and supporting network exposure, with emphasis on SQL injection, authentication flaws, and access-control weaknesses.
Tools and techniques
- Burp SuiteAnalyzed web traffic, sessions, authentication flows, and application vulnerabilities.
- SQLMapPerformed automated SQL injection testing and vulnerability confirmation.
- NmapScanned the network and identified exposed services and configurations.
- MetasploitValidated exploitability and remote code execution.
- Manual TestingReviewed authentication, session management, and access controls.
03
Security Findings
Eight vulnerabilities were identified: three critical, four medium-severity, and one informational finding.
SQL Injection
A flaw in the search form allowed the execution of arbitrary SQL commands, potentially exposing sensitive data.
- Impact
- Unauthorized database access, data theft, or complete server compromise.
- Detection method
- SQLMap was used to inject malicious payloads into the search form and confirm the vulnerability.
Remote Code Execution
A vulnerability in file-upload processing allowed malicious code to be executed on the server.
- Impact
- Full server compromise, malware installation, or persistent unauthorized access.
- Detection method
- Metasploit was used to validate exploitation through the vulnerable file-upload functionality.
Authentication Bypass
A session-management flaw allowed unauthorized access to user accounts through manipulated session tokens.
- Impact
- Exposure of sensitive employee accounts and confidential application data.
- Detection method
- Burp Suite was used to intercept and manipulate session tokens during authentication testing.
Broken Access Control
Users could access restricted resources, including project documents, by modifying URL parameters.
- Impact
- Exposure of sensitive information and the potential for unauthorized data manipulation.
- Detection method
- Restricted resources were reached by manually altering URL parameters.
Security Misconfiguration
Default server configurations exposed sensitive technical information through verbose error messages.
- Impact
- Information leakage that could help an attacker plan additional attacks.
- Detection method
- Nmap scanning and manual configuration review identified exposed services and insecure defaults.
Sensitive Data Exposure
Sensitive information, including user credentials, was stored in plain text in the database.
- Impact
- Credential theft and account compromise if an attacker gained database access.
- Detection method
- The issue was discovered through manual database inspection.
Missing Function-Level Access Control
Administrative functions were accessible to non-administrative users through direct URL navigation.
- Impact
- Unauthorized execution of privileged operations and changes to sensitive application data.
- Detection method
- Administrative URLs were tested without the required role or authorization.
Components with Known Vulnerabilities
The application used an outdated version of jQuery with publicly known vulnerabilities.
- Impact
- Potential exploitation of known weaknesses in outdated third-party libraries.
- Detection method
- Library versions were identified and checked against public CVE databases.
04
Remediation Recommendations
Action planEliminate SQL Injection
- Use parameterized queries or prepared statements for all database interactions.
- Validate and sanitize every user-controlled value before processing.
- Deploy a Web Application Firewall (WAF) to block SQL injection attempts.
Prevent Remote Code Execution
- Restrict file-upload extensions, MIME types, size, and storage locations.
- Validate uploaded files and prevent them from being executed by the server.
Harden Authentication
- Implement multi-factor authentication (MFA) for all user accounts.
- Generate secure session tokens and enforce server-side token validation.
Enforce Access Control
- Apply server-side authorization checks to every protected resource.
- Use role-based access control (RBAC) to restrict access by user role.
Remove Security Misconfigurations
- Remove insecure default configurations and disable verbose production errors.
- Regularly audit server and application configurations for security compliance.
Protect Sensitive Data
- Encrypt sensitive data at rest and in transit with strong, current protocols.
- Adopt secure credential-storage practices and never store passwords in plain text.
Protect Administrative Functions
- Add explicit authorization checks to every administrative function.
- Restrict sensitive endpoints according to verified user permissions.
Update Vulnerable Components
- Upgrade libraries and frameworks to their latest supported secure versions.
- Continuously monitor dependencies with tools such as Dependabot.
Conclusion
Strengthening the Haft Sang platform
The assessment identified three critical, four medium, and one informational vulnerability. Applying the recommended controls secured the application against the identified threats and reduced its exposed attack surface.
Regular security testing and the integration of DevSecOps principles are recommended to maintain a strong security posture.