Web Application and API Penetration Testing for a Computer Vision Company

Summary

A computer vision company serving real estate businesses wanted to check its web applications and APIs for security issues its own team might have missed and to demonstrate their high security level to existing and potential clients. INNERLUXES performed black-box penetration testing of 10 web applications and 7 APIs per the OWASP Web Security Testing Guide and NIST SP 800-115, found no critical flaws, flagged a few low-severity issues with corrective measures, and confirmed an enhanced security level on retest — providing an attestation letter and security badges.

About the Client

The Client offers computer vision solutions to real estate businesses, with an international presence across Europe and the US.

The Challenge

The Client's team of IT professionals is dedicated to creating user-friendly solutions with outstanding functionality and robust security. The Client wanted to check its applications and APIs for security issues its team might have missed, and to prove their high security level to existing and potential clients. It was therefore looking for a penetration testing vendor experienced in web security testing.

The Solution

With a security testing process based on the OWASP Web Security Testing Guide and NIST SP 800-115, INNERLUXES was chosen to perform the pentesting project.

To see whether a potential intruder could find and exploit any vulnerabilities in the Client's 10 web applications and 7 APIs, INNERLUXES's pentesters applied the black-box approach. Having no initial knowledge of the testing targets, they started with comprehensive vulnerability scanning. After analyzing the findings, they applied several attack scenarios to exhaust every opportunity to break the security of the web applications and APIs.

As a result, INNERLUXES's team was glad to report that the targeted web apps and APIs did not contain any critical security flaws. The testers revealed several low-severity vulnerabilities, such as:

• An unrestricted number of failed login attempts. This allowed potential attackers to brute-force user credentials for as long as needed to find a working combination.
• No limits on accessing the API gateway. This could facilitate brute-force attacks, increase the costs of a pay-as-you-go public cloud subscription, and slow down or even break the API gateway.
• Missing security headers needed to enhance the web apps' protection against clickjacking, cross-site scripting, and other common attacks.

INNERLUXES's security experts recommended fixing the detected issues without delay and offered corrective measures for each:

• Adding CAPTCHA or locking out the account with an email notification to its owner after several failed login attempts.
• Restricting the number of requests per client per time period (e.g., applying X-Rate-Limit headers) and using an Application Security Proxy / WAF (e.g., AWS WAF).
• Adding the X-Content-Type-Options, X-Frame-Options, and HTTP Strict-Transport-Security headers.

After the Client's team fixed the detected vulnerabilities, INNERLUXES's security experts ran another testing round and confirmed the enhanced security level of the targets.

The Results

• The Client's team was able to fix the minor security issues in its web applications and APIs.
• The Client received an attestation letter and security badges for the tested applications to communicate the results and their high-security status to its clients.

Technologies and Tools

Metasploit, Postman, Wireshark, Nessus, Burp Suite, Acunetix, Nmap.