Pentesting That Prevented Client Data Theft and Financial Losses

Summary

An IT company offering a telemetry analytics and observability platform for managing infrastructures, networks, and applications wanted to evaluate the cyber protection of its IT assets and client data. INNERLUXES assembled a team of three pentesters to examine the external and internal networks and the platform's web application, revealing issues that could lead to data breaches and financial losses — and confirming the fixes with a retest.

About the Customer

The Customer is an IT company offering a telemetry analytics and observability platform for managing infrastructures, networks, and applications.

The Challenge

The company was looking for an experienced vendor to evaluate the cyber protection of its IT assets and client data, and turned to INNERLUXES.

The Solution

After carefully analyzing the case, INNERLUXES assembled a team of three penetration testers to examine the external and internal networks and the web application for the telemetry and observability platform. The testing was based on PTES, the OWASP Web Security Testing Guide, and NIST 800-115 best practices, and the identified vulnerabilities were assessed and classified according to OWASP Top 10, NIST CVSS, and MITRE risk-score frameworks.

External pentesting

To verify the Customer's public-facing web application and network, INNERLUXES applied black-box and gray-box approaches. The team started with comprehensive research of the targets using open-source intelligence (OSINT) to gather the maximum publicly available information hackers could use (e.g., domain names, IP ranges, and exposed sensitive data), then identified potential threats and prioritized attack vectors and scenarios.

During the vulnerability assessment, the experts scanned the target network and application and manually validated the detected weaknesses to eliminate false positives. To exploit the verified vulnerabilities and evaluate severity, the team performed black-box pentesting, including input-data manipulation and brute-force simulation. Although the testers did not gain unauthorized access to the network, some targets had vulnerabilities a hacker could exploit to access the platform's user accounts, functionality, and services — potentially leading to theft of sensitive data (users' credentials, personal data, and financial information). In the gray-box stage, using user credentials, the team further explored the vulnerabilities by acting as a malicious actor with user access to the target web application.

The external pentesting revealed security misconfigurations, as well as brute-force, user-enumeration, and cross-site scripting (XSS) vulnerabilities. Remediation advice included:

• Configuring CORS and Set-Cookie headers to protect sensitive information and session data, limiting the reach of XSS and CSRF vectors.
• Enforcing a strong password policy, rate limiting for authentication endpoints, and an account lockout or captcha mechanism to prevent brute-force attacks.
• Ensuring responses to authentication requests (e.g., Login and Forgot Password pages) are identical for existing and non-existing users to mitigate user-enumeration attacks.
• Implementing input validation and sanitization to prevent XSS attacks.

Internal pentesting

INNERLUXES examined the Customer's private network (26 IP addresses) using the gray-box approach, revealing poor authentication and identification mechanisms, SSH misconfiguration, and a deprecated network protocol. Recommended corrective actions included:

• Implementing role-based access control and a strong password policy for internal services.
• Configuring strong SSH algorithms and removing deprecated cryptographic settings.
• Using TLS 1.2 and TLS 1.3 instead of the deprecated and vulnerable TLS 1.0 and 1.1.

The Results

• INNERLUXES delivered a security assessment report detailing the activities conducted, methodologies and tools used, vulnerabilities with their potential impact, and remediation recommendations.
• INNERLUXES revealed that the Customer's application and networks had security issues that could lead to data breaches and financial losses.
• The remediation advice helped the company fortify its security posture, which was confirmed during a retest round.

Technologies and Tools

Acunetix, Burp Suite, SSLScan, Nmap, DirB, Nessus, PHP, Bash, Python, PowerShell.