What are the most common vulnerabilities found during a professional web app penetration test?

All answers to this question.

Beyond the usual SQLi and XSS, pentesters frequently find "Insecure Direct Object References" (IDOR). This happens when a user can access another user's data by simply changing an ID in the URL. Another common one is "Security Misconfiguration," especially with cloud buckets or API headers that leak too much info. Also, watch out for "Broken Business Logic"—flaws where the bot can bypass a payment step or get a discount twice because the state isn't managed correctly on the server. These don't show up on automated scanners easily but are a goldmine for manual testers.

   Answered 2024-10-16 by Rebecca Foster

Those IDOR flaws are definitely a headache, but are you also looking at your third-party API integrations? How many of those external services have excessive permissions, and could a compromise of one of your partners lead to a direct breach of your own portal's user database?

   Answered 2024-10-18 by Jeffrey Lawson

• Jeffrey, we actually just audited our API keys and found several that were "over-privileged." We’ve since implemented a strict scoping policy for all third-party integrations to ensure they can only access the specific data points required for their function and nothing more.

     Commented 2024-10-20 by Alice Monroe

Check your "Subdomain Takeover" risks. Often, companies leave DNS records pointing to old cloud services that have been decommissioned, allowing a pentester to claim that domain and host a phishing site.

   Answered 2024-10-22 by Brandon Clark

• That’s a great catch, Brandon. We found two "ghost" subdomains last week. It’s a simple fix, but one that is so easy to overlook when your infrastructure is constantly changing and growing.

     Commented 2024-10-24 by Rebecca Foster