Web Application Security Assessment

02 — Process

Methodology

Reconnaissance

Manual browsing plus automated crawling (Spider, AJAX Spider) to map routes, forms, and parameters across the application.

Automated scanning

OWASP ZAP Active Scan against every discovered endpoint to surface candidate vulnerabilities.

Manual verification

Every scanner alert was reproduced by hand — breaking inputs, replaying payloads, inspecting raw responses — to rule out false positives.

Risk rating

Confirmed findings rated High, Medium, Low, or Informational based on impact and ease of exploitation.

Reporting

Findings documented with evidence, CWE references, and concrete remediation steps for each issue.

03 — Evidence

Findings

F-004SQL Injection — Product Search EndpointHigh▶

LocationGET /rest/products/search?q= · CWE-89

What happenedUser input was concatenated directly into a backend SQL query. A breaking payload returned a raw SQLite syntax error, and a comment-based variant returned the entire product table — including soft-deleted items never shown in normal search results.

RecommendationUse parameterized queries or an ORM's query builder instead of string concatenation. Re-test to confirm filters can't be bypassed.

F-006DOM-Based Cross-Site Scripting — SearchHigh▶

LocationClient-side search rendering (q parameter) · CWE-79

What happenedSearch input was inserted into the DOM unsanitized. An iframe payload using a javascript: URL executed in-browser, confirmed by the script firing and by the application's own challenge tracker.

RecommendationSanitize all input before DOM insertion; avoid bypassing framework sanitization (e.g. unsafe innerHTML bindings). Add a Content-Security-Policy as defense in depth.

F-001Missing Anti-Clickjacking HeaderMedium▶

LocationApplication-wide responses · CWE-1021

What happenedNo X-Frame-Options or CSP frame-ancestors header — the app could be embedded in a hidden iframe to trick users into unintended clicks.

RecommendationAdd X-Frame-Options: SAMEORIGIN or an equivalent CSP directive to all responses.

F-002Session/Transport Identifier Exposed in URLMedium▶

LocationSocket.IO polling transport endpoint · CWE-598

What happenedA session-like sid value travels in the URL query string, exposing it to browser history, server logs, and Referer headers.

RecommendationAvoid passing session/auth identifiers via URL parameters; confirm this value isn't also used for authenticated session tracking.

F-003Missing X-Content-Type-Options HeaderLow▶

LocationApplication-wide responses · CWE-693

What happenedResponses omit the header that prevents browsers from MIME-sniffing content types.

RecommendationAdd X-Content-Type-Options: nosniff to all responses.

F-005Verbose Error Message — Information DisclosureLow▶

LocationGET /rest/products/search?q= · CWE-209

What happenedA malformed query returned the raw backend error, including the database engine name and a fragment of the failing query.

RecommendationDisable verbose error output in production; log full detail server-side only and return a generic message to clients.

F-007CSRF Assessment — Not Exploitable (Token-Based Auth)Info▶

LocationAuthentication flow · CWE-352

What happenedAuth uses a JWT stored in Local Storage rather than a session cookie. Classic CSRF relies on browsers auto-attaching cookies to forged requests — that mechanism doesn't exist here.

RecommendationNo action needed under the current architecture. Add anti-CSRF tokens only if the app later moves to cookie-based sessions.

Web Application Security Assessment

Assessment summary