OFFENSIVE SECURITY ASSESSMENT
VulnBank Penetration Test
WEB APPSEC API SECURITY BUSINESS LOGIC CLOUD SSRF LLM SECURITY OWASP TOP 10

A white-box, source-assisted penetration test of VulnBank — a deliberately vulnerable banking platform — walked end-to-end across authentication, authorization, money movement, file handling, cloud metadata, sessions, client-side code, virtual cards, merchant payments, and the AI support agent. None of the weaknesses stand alone: they chain. An unauthenticated attacker can move from a leaked debug endpoint to admin credentials, to forged session tokens, to arbitrary balance creation, to theft of cloud IAM credentials — without ever possessing a legitimate account.

59
Issues Found
14
Attack Surfaces
15+
Critical
3
Paths to Admin
HEADLINE OUTCOMES ↓
HEADLINE OUTCOMES
Outcome Demonstrated
Mechanism
Severity
Authentication bypass (login as admin, no password)
SQL injection in /login
Critical
Forge admin session tokens at will
Hardcoded JWT secret secret123 + none alg
Critical
Self-register as administrator
Mass assignment on /register
Critical
Steal cloud IAM role credentials
SSRF into metadata service (Capital One pattern)
Critical
Spend money you do not have / negative balance
Race condition (TOCTOU) in /transfer
Critical
Mint an eight-figure card balance for free
Mass assignment in card limit/balance update
Critical
Full account takeover of any user
3-digit reset PIN, no rate limiting
Critical
Dump the entire user table (plaintext passwords)
Error-based SQLi via bill-payment biller field
Critical
Charge any card & replay charges (double-spend)
Merchant API — raw card data + no idempotency
High
Unauthenticated database access via chat
Prompt injection → DB query in AI agent
High
SCOPE OF THE ASSESSMENT
Block 1–3
Auth, Authorization & Transaction Logic
Authentication foundations, BOLA / IDOR / mass assignment, and transaction logic including TOCTOU race conditions in money movement.
Block 4–6
SSRF, Account Takeover & Sessions
File upload and SSRF into cloud credential theft, password reset / account takeover flows, and session management weaknesses.
Block 7–10
Client-Side, Cards & Payments
XSS / CSRF, virtual-card currency and mass-assignment abuse, bill-payment SQLi, and the merchant payment API.
Block 11–14
LLM Agent, GraphQL & Business Flow
AI support agent (LLM prompt injection), GraphQL endpoint, chained loan business-flow abuse, and additional confirmations and pivots.
REPORT
VulnBank Penetration Test — Full Report (50 pages)
Executive summary, engagement methodology, scope and rules of engagement, severity ratings, the master attack chain (how each bug feeds the next), 14 finding blocks with reproduction and remediation, OWASP Web & API Top 10 coverage maps, a CWE index, and a consolidated remediation roadmap.
DOWNLOAD REPORT ↓