Résumé
All projects

Internal Web Application · Penetration Test

Penetration Testing Report for Pardis

A focused assessment of the internal web application of Steel Structure Pardis, designed to identify security vulnerabilities and provide practical recommendations based on the OWASP Top 10.

OWASP Top 102 critical findingsRemediation completed

01

Introduction

This report details the penetration testing project conducted on the internal web application of Steel Structure Pardis. The objective was to identify security vulnerabilities and provide recommendations to enhance the application's security. Testing focused on vulnerabilities outlined in the OWASP Top 10.

02

Project Description

Application and scope

Internal employee application

Testing covered the application's web components, with emphasis on SQL injection, authentication flaws, and related OWASP Top 10 risks.

Tools and techniques

  • Burp SuiteAnalyzed web traffic, authentication flows, and application vulnerabilities.
  • NmapScanned the network and identified exposed services.
  • SQLMapPerformed automated SQL injection testing and data-extraction validation.
  • Manual TestingReviewed authentication controls and session management.

03

Critical Findings

Critical · 2

Two critical vulnerabilities were identified during the penetration test.

01Critical

Account Takeover

A flaw in the authentication mechanism allowed unauthorized access to user accounts.

Impact
Potential data theft, unauthorized changes, or privilege escalation.
Detection method
The login process was manipulated with Burp Suite to gain unauthorized access to user accounts.
02Critical

SQL Injection

A vulnerability in the search functionality allowed the execution of arbitrary SQL commands.

Impact
Potential extraction of sensitive data, database modification, or server compromise.
Detection method
SQLMap extracted sample data from the database, confirming the vulnerability.

04

Remediation Recommendations

Action plan
01

Prevent Account Takeover

  • Implement multi-factor authentication (MFA) for all user accounts.
  • Strengthen password policies and encourage the use of password managers.
  • Review and harden authentication mechanisms to prevent unauthorized access.
02

Eliminate SQL Injection

  • Use parameterized queries or prepared statements for all database interactions.
  • Implement input validation and sanitization for every user-controlled value.
  • Deploy a Web Application Firewall (WAF) to block SQL injection attempts.

Conclusion

Securing the Pardis application

The penetration test identified two critical vulnerabilities: Account Takeover and SQL Injection. Implementing the recommended controls secured the internal web application against the identified threats.

Regular security testing and the integration of DevSecOps principles into software development are recommended to ensure ongoing security.

Prepared bySam Kheiri