Pentest Application Security

Grey-Box API Pentest Catches a Critical Data-Exposure Bug the Client Fixed Mid-Engagement

Found a critical CORS misconfiguration that let arbitrary origins pull sensitive user data from the API — the client shipped a fix before the engagement even closed — then kept digging and surfaced a long-lived auth token and a residual trust-boundary gap the quick fix had missed.

Client: Fintech / Payments Platform — API and Web Ecosystem

Industry: Fintech · Payments
Engagement: Grey-box penetration test · Production API, web console, and identity subdomains

Total findings

Same engagement

Critical finding fixed

Weeks later

Token still valid at re-test

Challenge

The client runs a multi-subdomain API and application ecosystem — core API, real-time services, an app-building console, identity/auth, and a third-party-hosted transaction widget. They needed a realistic, production-environment assessment of how much damage an attacker with partial insider knowledge could do, without disrupting live users or real transactions.

Approach

A grey-box assessment combining reconnaissance, automated scanning, and manual exploitation across every production subdomain in scope. The team worked with partial internal context from the client's engineering side to focus effort efficiently, while still testing from an external-attacker vantage point. Findings were validated through direct exploitation, not just scanner output.

Key Activities

▸ Enumerated the full subdomain and API surface across the production environment
▸ Manually exploited a CORS misconfiguration to confirm real cross-origin access to sensitive user data, not just a theoretical policy gap
▸ Re-tested the same endpoint after the client shipped a same-week fix, and found the fix was incomplete
▸ Reviewed authentication token lifecycle on a financial-document endpoint and confirmed a token issued at the start of testing was still valid weeks later
▸ Assessed cross-subdomain trust relationships for ways a lower-value subdomain could be used to reach higher-value endpoints
▸ Delivered findings with severity re-graded for what remained exploitable after the client's live remediation

Results

✓ Found a critical CORS misconfiguration on the core API that let arbitrary web origins retrieve sensitive user data

✓ Confirmed the client's same-engagement fix closed the arbitrary-origin case but still trusted unencrypted sources and one subdomain capable of crafting its own requests to the API

✓ Identified an authentication token on a financial-document endpoint with no expiration — still valid when re-tested weeks after issuance

✓ Found consistent missing browser-hardening headers and a cache-deception issue across the console and identity subdomains

✓ Delivered 5 findings spanning critical (since remediated) down to low severity, each re-verified after the client patched live

Business Impact

★ Gave the client a real, exploited proof of a critical data-exposure path in time to fix it before the engagement even closed — not after a report landed on a shelf

★ Caught that the quick fix was incomplete, preventing a false sense of closure on a critical-severity issue

★ Surfaced a token-lifecycle gap that no amount of endpoint hardening alone would have caught, since the flaw was in how long trust was extended, not in the endpoint itself

Technologies & Service Areas

API Security Web Application Testing Authentication & Session Testing Grey-Box Penetration Testing

Related Services

Penetration Testing → Cloud Security Audit →

Client names and identifying details are withheld. This case study is a sanitized account shared with the client's consent.