AcmeFlow Web Application Penetration Testing — Controlled Security Lab

Author: Sayed Khashana
Role: Web & API Penetration Tester | Application Security
Certifications: eCPPTv3 · eWPTv2 · eJPTv2 · CEH
Repository: https://github.com/Khashana22/pentest
Connect: LinkedIn • Upwork • GitHub • syedkhashana22@gmail.com

---

Important

Controlled Security Lab / Portfolio Notice:
AcmeFlow is a fictional multi-tenant SaaS project and document management platform created strictly for controlled security research, methodology benchmarking, and portfolio demonstration. This does not represent a real client engagement. All company names, user personas, credentials, tokens, payloads, and evidence are entirely synthetic. All testing was performed non-destructively in an isolated local laboratory.

---

Table of Contents

• Project Overview
• Security Assessment Objectives
• Assessment Scope
• Testing Methodology
• Findings Summary (Single Source of Truth)
• Key Security Themes
• Multi-Stage Attack Chain
• Interactive Case Study Features
• Project Structure
• Running Locally
• Production Build
• Deployment (Vercel / Netlify)
• Case Study & Live Links
• Author & Professional Positioning

---

Project Overview

This repository houses the complete, interactive Web Application Penetration Testing Case Study for AcmeFlow, documenting a full-lifecycle manual security assessment.

The project demonstrates how a professional penetration tester approaches modern SaaS architectures: moving from passive reconnaissance and attack surface mapping to authenticated authorization testing, vulnerability validation, manual exploitation with Burp Suite, impact analysis, and engineering-focused remediation roadmaps.

The entire assessment is packaged as a frontend-only, high-fidelity security deliverable built with Next.js, React, TypeScript, and Tailwind CSS. All findings, metrics, and evidence are dynamically driven by a centralized schema (data/findings.json), ensuring complete data consistency across the interactive case study and the 21-section printable report.

---

Security Assessment Objectives

1. Evaluate Multi-Tenant Isolation: Verify that object boundaries strictly prevent cross-tenant information access and data exfiltration.
2. Audit Role-Based Access Control (RBAC): Assess privilege separation across User, Manager, and Admin personas to identify vertical privilege escalation flaws.
3. Analyze Business Logic & State Machines: Test subscription plan enforcement and quota mechanisms against client-side parameter tampering.
4. Identify Client-Side Sinks: Audit collaborative markdown parsers and rich text components for stored script execution vectors.
5. Inspect Infrastructure & Environment Security: Detect unauthenticated diagnostic endpoints, debug routes, and verbose error disclosure.
6. Deliver Actionable Engineering Guidance: Provide concrete code-level fix recommendations and retest procedures for development teams.

---

Assessment Scope

In-Scope Target Systems

• AcmeFlow Web Portal UI: All authenticated and unauthenticated frontend interfaces.
• AcmeFlow Core REST APIs: Endpoints across authentication, user management, project workspaces, document storage, and tenant administration.
• Multi-Tenancy & Authorization Model: Object-level and function-level access control boundaries.
• Business Logic & Quota Enforcement: Tiered subscription workflows (Free vs. Enterprise) and seat entitlements.
• Data Ingestion & Markdown Rendering: Rich text input fields, project descriptions, and document metadata handlers.

Out-of-Scope Elements

• Underlying third-party cloud hosting infrastructure and physical data centers.
• Production third-party payment gateway systems (e.g., Stripe API servers).
• Volumetric Denial of Service (DoS / DDoS) attacks.
• Social engineering, credential phishing, or human-factor testing.

---

Testing Methodology

The assessment adhered strictly to industry-recognized security testing standards, combining the OWASP Web Security Testing Guide (WSTG v4.2) and the Penetration Testing Execution Standard (PTES) with 100% manual validation using Burp Suite Professional.

Reconnaissance & Passive OSINT
       ↓
Application Mapping & Endpoint Discovery
       ↓
Attack Surface Decomposition (Public, Authenticated, Admin)
       ↓
Authentication & Session Management Testing
       ↓
Authorization & Access Control Testing (RBAC Matrix)
       ↓
Input Validation & Output Encoding (XSS Auditing)
       ↓
Business Logic & Workflow Integrity Verification
       ↓
Error Handling & Configuration Hardening
       ↓
Manual Vulnerability Validation (Burp Suite Repeater)
       ↓
Qualitative Risk Assessment (CVSS v3.1 Scoring)
       ↓
Formal Reporting (21-Section PDF-Styled Deliverable)
       ↓
Remediation Roadmap & Developer Retesting

---

Findings Summary (Single Source of Truth)

All 5 documented vulnerabilities were manually validated. The metrics, CVSS scores, and CWE classifications below are sourced directly from data/findings.json:

Finding ID	Vulnerability Title	Severity	CVSS v3.1	CWE	OWASP Top 10
SK-WEB-001	Broken Access Control via Insecure Direct Object Reference (IDOR)	High	7.5	CWE-639	A01:2021 - Broken Access Control
SK-WEB-002	Stored Cross-Site Scripting (XSS) in Collaborative Project Description	Medium	6.5	CWE-79	A03:2021 - Injection
SK-WEB-003	Security Misconfiguration — Unauthenticated Diagnostic Route & Error Stack Leak	Medium	5.3	CWE-209	A05:2021 - Security Misconfiguration
SK-WEB-004	Business Logic Vulnerability — Subscription Plan & Quota Enforcement Bypass	Medium	6.5	CWE-840	A04:2021 - Insecure Design
SK-WEB-005	Improper Authorization — Vertical Privilege Escalation via Role Injection	High	8.1	CWE-285	A01:2021 - Broken Access Control

Severity Distribution

• Critical (CVSS 9.0–10.0): 0 Findings
• High (CVSS 7.0–8.9): 2 Findings
• Medium (CVSS 4.0–6.9): 3 Findings
• Low / Informational: 0 Findings

---

Key Security Themes

1. Broken Access Control & Cross-Tenant Isolation (SK-WEB-001)

The application verified authentication via Bearer tokens but failed to validate tenant ownership at the data-access layer. Manipulating the integer identifier in GET /api/documents/{id}/download allowed standard User A to download confidential financial audit PDFs belonging to User B in an unrelated workspace.

2. Client-Side State Trust & Business Logic Abuse (SK-WEB-004)

The user interface visually disabled Enterprise tier toggles for Free accounts, but the server-side update handler accepted arbitrary plan and maxSeats parameters from client JSON payloads. This permitted workspace owners to unilaterally unlock Enterprise SaaS capabilities without payment validation.

3. Vertical Privilege Escalation via Unchecked Object Binding (SK-WEB-005)

Self-service profile updates (PUT /api/users/{id}/profile) lacked an explicit field whitelist (Mass Assignment). Injecting "role": "admin" into the payload elevated standard employee accounts to full system administrators, granting total access to organization-wide user directories and compliance logs.

4. Input Sanitization Failure (SK-WEB-002)

Collaborative project summaries accepted markdown and rendered the resulting HTML using an unescaped sink (dangerouslySetInnerHTML) without passing output through DOMPurify. Embedding <img src=x onerror=...> triggered persistent JavaScript execution upon page load.

5. Environment Hardening & Information Disclosure (SK-WEB-003)

An unauthenticated staging diagnostic endpoint (/api/admin/debug/environment) leaked internal container IDs, Node.js versions, and the internal database connection host (db.internal.acmeflow.local), accelerating adversary attack planning.

---

Multi-Stage Attack Chain

The assessment demonstrated how individual vulnerabilities can be chained by an adversary to escalate from public network access to complete platform compromise:

[Phase 1: Reconnaissance]
  Unauthenticated GET /api/admin/debug/environment (SK-WEB-003)
  ↳ Leaks internal database hostname, server paths, and active features.
        ↓
[Phase 2: Initial Access]
  Authenticate as low-privilege employee (elena.dev@acmeflow.local).
  ↳ Valid JWT session token obtained.
        ↓
[Phase 3: Cross-Tenant Data Theft]
  Intercept GET /api/documents/1042/download → Change to ID 1038 (SK-WEB-001)
  ↳ Exfiltrates confidential Q3 financial audit PDF belonging to User B.
        ↓
[Phase 4: Privilege Escalation]
  PUT /api/users/usr-104/profile with injected {"role": "admin"} (SK-WEB-005)
  ↳ User entity updated to Administrator status server-side.
        ↓
[Phase 5: Full Tenant Sovereignty]
  Access /api/admin/users, billing vaults, audit trails, and purge controls.
  ↳ Total breakdown of confidentiality, integrity, and availability.

---

Interactive Case Study Features

The web presentation includes dedicated security components:

• Executive Summary & Posture Statement: Business-level briefing and risk translation for non-technical stakeholders.
• Interactive Attack Surface Map: Visual decomposition of Public, Authenticated, and Administrative surfaces.
• Authorization & RBAC Matrix: Comprehensive table comparing expected policies against empirical observations across User, Manager, and Admin roles.
• 5×5 Likelihood × Impact Heat Map: Interactive matrix plotting findings based on CVSS v3.1 metrics.
• Burp-Style HTTP Inspector: Side-by-side comparison of baseline requests vs. tampered exploit requests and vulnerable server responses.
• Evidence Gallery: Structured evidence transcripts with capture instructions, expected responses, and business impact translation.
• Actionable Remediation Roadmap: Prioritized engineering tiers (Priority 1 immediate, Priority 2 short-term, Priority 3 hardening, Continuous SDLC) with concrete TypeScript/Node.js code snippets.
• Full 21-Section Penetration Testing Report: Formal consulting-grade report with print CSS (@media print) for 1-click PDF export.

---

Project Structure

portfilo/
├── data/
│   └── findings.json                 # Single Source of Truth (all 5 findings schema)
├── src/
│   ├── app/
│   │   ├── case-studies/
│   │   │   └── acmeflow/
│   │   │       ├── page.tsx          # Main interactive case study page
│   │   │       ├── report/
│   │   │       │   └── page.tsx      # Formal 21-section printable report
│   │   │       └── findings/
│   │   │           └── [id]/
│   │   │               └── page.tsx  # Dynamic permalink pages for SK-WEB-001 to 005
│   │   ├── layout.tsx                # Root Next.js layout (dark theme, fonts)
│   │   └── globals.css               # Design system & print stylesheet
│   ├── components/
│   │   └── case-study/
│   │       ├── HeroSection.tsx
│   │       ├── ProjectMetrics.tsx
│   │       ├── ExecutiveSummary.tsx
│   │       ├── ScopeSection.tsx
│   │       ├── AssessmentOverview.tsx
│   │       ├── MethodologyTimeline.tsx
│   │       ├── AttackSurfaceMap.tsx
│   │       ├── AuthorizationMatrix.tsx
│   │       ├── RiskDashboard.tsx
│   │       ├── RiskMatrix.tsx
│   │       ├── FindingsExplorer.tsx
│   │       ├── FindingDetailView.tsx
│   │       ├── EvidenceGallery.tsx
│   │       ├── AttackChainSection.tsx
│   │       ├── RemediationRoadmap.tsx
│   │       ├── ReportPreviewSection.tsx
│   │       ├── CaseStudyHeader.tsx
│   │       └── CaseStudyFooter.tsx
│   ├── data/
│   │   ├── findings.json             # Symlink/copy for internal Next.js imports
│   │   └── projects.ts               # Flagship project metadata integration
│   ├── lib/
│   │   └── findings.ts               # Metric calculators, scope datasets, & matrix data
│   └── types/
│       └── findings.ts               # TypeScript interfaces for findings schema
├── public/                           # Static assets, icons, and diagrams
├── package.json                      # Project dependencies & scripts
├── tsconfig.json                     # TypeScript configuration
└── README.md                         # This documentation

---

Running Locally

Prerequisites

• Node.js (v18.17+ or v20+ recommended)
• npm (v9+ or v10+)

1. Clone the Repository

git clone https://github.com/Khashana22/pentest.git
cd pentest

2. Install Dependencies

npm install

3. Start Development Server

npm run dev

4. Open in Browser

• Case Study Home: http://localhost:3000/case-studies/acmeflow
• Full Formal Report: http://localhost:3000/case-studies/acmeflow/report
• Finding Detail Pages:
  • http://localhost:3000/case-studies/acmeflow/findings/SK-WEB-001
  • http://localhost:3000/case-studies/acmeflow/findings/SK-WEB-002
  • http://localhost:3000/case-studies/acmeflow/findings/SK-WEB-003
  • http://localhost:3000/case-studies/acmeflow/findings/SK-WEB-004
  • http://localhost:3000/case-studies/acmeflow/findings/SK-WEB-005

---

Production Build

To verify static generation and compile the production build:

npm run build

To run the compiled production build locally:

npm start

---

Deployment (Vercel / Netlify)

This project is a 100% static Next.js App Router application requiring zero backend servers, databases, or environment variables.

Deploying to Vercel

1. Push this repository to GitHub: https://github.com/Khashana22/pentest
2. Log into Vercel and click "Add New Project".
3. Import the Khashana22/pentest repository.
4. Select Framework Preset: Next.js.
5. Keep default build command (npm run build) and output directory (.next).
6. Click Deploy. Vercel will automatically build and serve the application globally.

---

Case Study & Live Links

• GitHub Repository: https://github.com/Khashana22/pentest
• Local Interactive Case Study: Run locally using npm run dev and navigate to http://localhost:3000/case-studies/acmeflow
• Local Formal Security Report: http://localhost:3000/case-studies/acmeflow/report

---

Author & Professional Positioning

Sayed Khashana
Web Application Penetration Tester & API Security Specialist

Focused on identifying exploitable vulnerabilities, validating real-world impact, and delivering engineering-grade remediation guidance.

• LinkedIn: https://www.linkedin.com/in/sayed-khashana-801bb8238
• Upwork: https://www.upwork.com/freelancers/~017ec48f2803b9c6fa?mp_source=share
• GitHub: https://github.com/Khashana22
• Email: syedkhashana22@gmail.com

Find it. Prove it. Fix it.