Gray Box Penetration Testing for a Digital Bank Operating in 60+ Countries

Summary

A US-based international digital bank serving businesses in 60+ countries regularly relies on third-party penetration testing to keep its continuously evolving banking platform secure. For the bank's fourth annual pentest, INNERLUXES performed thorough gray-box testing of the web, iOS, and Android banking apps in just two weeks, classified the findings by severity, and delivered concrete remediation guidance for every issue.

About the Client

The Client is a US-based international digital bank that serves businesses from 60+ countries through its banking platform available on web and mobile.

A Long-Term Partnership to Uphold Strong Cyber Defense

The Client first turned to INNERLUXES for security testing, which helped the bank significantly improve its cybersecurity posture and achieve SOC 2 compliance certification. Satisfied with the results, the Client regularly engages INNERLUXES for penetration testing to check for emerging vulnerabilities in its evolving banking platform.

Gray Box Pentesting of Web and Mobile Banking Apps

During the fourth annual penetration test, INNERLUXES's experts examined the Client's web, iOS, and Android applications using the gray-box approach. Starting with a vulnerability assessment, the testers scanned the target apps and manually verified the findings to ensure accurate results. After eliminating false positives, the team attempted to exploit the security weaknesses that had been found. The testing activities were based on the PTES, the OWASP Web Security Testing Guide, the OWASP Mobile Security Testing Guide, and the NIST 800-115 methodology, and included:

• Checking software versions and application configurations.
• Performing input data manipulations, such as injections, overflows, and protocol violations.
• Examining authentication and authorization mechanisms.

INNERLUXES's penetration testers assessed and classified the identified issues according to the OWASP Top 10, OWASP Top 10 Mobile, OWASP API Top 10, and NIST CVSS frameworks. The pentest revealed two medium-severity, six low-severity, and three informational-severity security issues — a total of 11 security issues, mainly cryptographic failures and security misconfigurations. INNERLUXES suggested remediation measures for each issue, such as:

• Validating and sanitizing user input to prevent unvalidated redirects and forwards. Without proper validation, attackers could manipulate input data to redirect users to malicious websites (e.g., phishing sites that mimic the original website).
• Using a more secure block cipher mode for data encryption — such as Galois/Counter Mode (GCM) — to replace Cipher Block Chaining (CBC) with PKCS7 padding, preventing adversaries from decrypting data in padding oracle attacks.
• Implementing a hard session timeout after up to 15 minutes of inactivity, reducing the chance of an attacker reusing a session on a public computer if the user forgets to log out.
• Hiding the preview of the app's interface when switching between apps on mobile, to avoid exposing sensitive information such as account balance and transaction history when the banking app runs in the background.

Rapid Detection and Remediation of Security Issues

• In just two weeks, INNERLUXES performed thorough gray-box pentesting of the web, iOS, and Android apps for a digital bank operating in 60+ countries.
• The Client received a comprehensive report detailing the pentesting results and corrective actions for each vulnerability, helping it further enhance the security of its banking platform.

Technologies and Tools

Burp Suite, SSLScan, Acunetix, Apktool, jadx, MobSF, Radare2, PHP, Bash, Python, PowerShell.