Internal Web Application · Penetration Test
Penetration Testing Report for Tire
A focused security assessment of the internal web application of Urmia Tire Rahgosa, designed to protect the confidentiality, integrity, and availability of the application and its data.
01
Introduction
This report details the penetration testing project conducted on the internal web application of Urmia Tire Rahgosa, a company specializing in tire manufacturing and distribution. The objective was to identify vulnerabilities that could be exploited by malicious actors and compromise the confidentiality, integrity, or availability of the application and its data.
02
Project Description
Application and scope
Internal employee platform
The application supports employee management and internal communications. Testing focused on web components and OWASP Top 10 risks, including SQL injection, cross-site scripting, and access-control issues.
Tools and techniques
- Burp SuiteAnalyzed web traffic and identified application vulnerabilities.
- SQLMapPerformed automated SQL injection testing and response validation.
- Manual TestingReviewed access controls, URL authorization, and session management.
03
Security Findings
One critical and two medium-severity vulnerabilities were identified during the penetration test.
Blind SQL Injection
A vulnerability in the search functionality allowed attackers to infer sensitive database information without direct output by using time-based or boolean-based techniques.
- Impact
- Potential unauthorized access to sensitive customer or financial data, as well as database manipulation.
- Detection method
- Identified with Burp Suite payload injection and confirmed through SQLMap time-based responses.
Stored Cross-Site Scripting
A flaw in the comment section allowed malicious scripts to be stored on the server and executed when other users viewed the comments.
- Impact
- Potential session hijacking, website defacement, or redirection to malicious sites.
- Detection method
- Confirmed by injecting script tags into the comment field and observing execution on page load.
Broken Access Control
Users could access administrative functions, including user management, by manipulating URL parameters.
- Impact
- Unauthorized access to sensitive data or operations, potentially leading to data breaches or unauthorized modifications.
- Detection method
- Identified through manual testing by altering URL parameters to access restricted resources.
04
Remediation Recommendations
Action planPrevent Blind SQL Injection
- Use parameterized queries or prepared statements for all database interactions.
- Validate and sanitize all user inputs to prevent malicious SQL code injection.
- Deploy a Web Application Firewall (WAF) to block SQL injection attempts.
Mitigate Stored XSS
- Implement a Content Security Policy (CSP) to define allowed content sources.
- Sanitize all user inputs to remove or escape potentially malicious scripts.
- Encode all outputs correctly to prevent script execution.
Enforce Access Control
- Implement server-side access-control checks for every protected resource.
- Use role-based access control (RBAC) to manage user permissions.
- Regularly audit access controls to identify and fix bypasses.
Conclusion
Securing the internal web application
The penetration test identified one critical and two medium vulnerabilities in the internal web application of Urmia Tire Rahgosa. Implementing the recommended remediation steps secured the application against the identified threats.
Regular security assessments and the integration of DevSecOps principles are recommended to maintain a secure posture.