Penetration Testing of a Web App and Public IPs for an AI AdTech Company

Summary

An artificial intelligence company that uses machine learning and computer vision to improve advertising targeting and engagement planned its first independent penetration testing of its web application and public IPs as part of a comprehensive security strategy. INNERLUXES performed black-box pentesting, uncovered several critical issues, and — after the Customer applied the fixes — confirmed a high security level with a retest.

About the Customer

The Customer is an artificial intelligence company that uses the power of machine learning and computer vision to improve targeting and engagement for advertising campaigns. The Customer's products and services have helped businesses internationally increase their sales and revenue.

The Challenge

Understanding that unfailing performance and user-data safety are crucial for the success of its solutions, the Customer is building a comprehensive security strategy. Among the first steps to address potential risks, the company planned independent penetration testing of its web application and public IPs. As the Customer's internal IT team had many questions about pentesting and security best practices, they were looking for cybersecurity experts who could give clear, insightful answers. Another crucial factor was the vendor's practical experience with AI and ML technology.

The Solution

INNERLUXES's experts provided recommendations and explanations to help the Customer's team understand the penetration testing process and make informed decisions. In particular, the team suggested the black-box approach, which would help quickly identify high-risk areas needing immediate attention.

To simulate a real-world external attack, INNERLUXES's security engineers used open-source tools and intrusion techniques employed by hackers. First, they searched for potential entry points that could be exploited to compromise the web application and public-facing infrastructure. They used mapping tools to identify open ports and the services running on them, collecting information about versions and configurations. Then they scanned the targets for known vulnerabilities, such as missing patches or insecure settings. Using techniques including web crawling, spidering, and fingerprinting, the testers explored the structure and content of the web application and its underlying technology stack, and attempted to exploit vulnerabilities to assess the potential damage a skilled attacker could inflict. In addition to automated scans, the team conducted manual tests to uncover more complex security issues.

The testing revealed several critical security issues that could enable unauthorized access to the Customer's IT assets, including:

• Missing access control. Analyzing the web server directory listing, the testers found sensitive information such as user IDs, names, job titles, emails, and office locations — and it was possible to change this user info without authorization. Cybercriminals could exploit this for identity theft, account takeover, and spear-phishing.
• Insecure cryptography. A remote host used weak 64-bit block ciphers, so an intruder could decrypt sensitive information (e.g., secure HTTPS cookies) and use it to hijack authenticated sessions.
• Unencrypted transmission of user credentials. An attacker could steal the credentials by intercepting network traffic.
• Brute-force vulnerability. An unlimited number of unsuccessful login attempts could let an intruder take over user accounts — knowing a user's login, hackers could brute-force the password.

Following the pentest, INNERLUXES prepared an executive summary with project highlights and a detailed report on the findings and required corrective measures, recommending:

• Disabling the directory listing and configuring the web server to restrict access to sensitive information.
• Configuring the web server to disable weak ciphers.
• Ensuring the web server transmits user credentials only via an encrypted connection (HTTPS).
• Restricting the number of failed authentication attempts.

After the Customer's team fixed the security issues in the web application and IT infrastructure, INNERLUXES performed another testing round and confirmed that the targeted IT assets now had a high level of security.

The Results

• The Customer gained practical evidence of how well its web application and public IT infrastructure could withstand external attacks.
• A detailed report on the detected cybersecurity issues allowed the Customer's team to eliminate the weaknesses before they could result in data breaches, business disruptions, or reputational losses.

Technologies and Tools

Metasploit, Wireshark, Nessus, Burp Suite, Acunetix, Nmap, Zenmap, Hydra.