Omniwa Digital develops digital products and web applications for its clients. For one of its new applications, Gract was asked to perform an independent penetration test covering both the web application and its associated WebSocket environment. The assessment was conducted from a black-box perspective, without access to source code, internal documentation, or credentials.
The Challenge
A new application can function exactly as intended while still containing weaknesses that only become visible when someone deliberately tries to break its assumptions. The central question was therefore not simply whether the application worked, but how it behaved from the perspective of an external attacker. Could application logic be abused? Were security controls implemented in a way that remained effective under repeated or manipulated requests? And could publicly available information reveal more about the underlying infrastructure than intended?
The Approach
We performed a black-box penetration test using PTES and OWASP guidance, combining reconnaissance, threat modelling, vulnerability analysis, and controlled exploitation. In addition to testing the application itself, we used OSINT to examine what could be learned about the environment from publicly available sources. This allowed us to assess both technical vulnerabilities and the effectiveness of the security controls surrounding the application.
The Result
The assessment identified five findings: one Medium, two Low, and two Informational. No High or Critical vulnerabilities were found. The most significant issue involved session-based rate limiting on discount-code attempts, which could be bypassed by creating a new session and continuing the process. Additional findings included support for outdated TLS versions, missing HTTP security headers, inactive DNSSEC, and infrastructure information that could be partially reconstructed through OSINT. Omniwa Digital received concrete remediation recommendations, with a re-audit advised after implementation.