top of page
Search

Penetration testing
Portfolio study cases


Sensitive Information Disclosure via Public Assets
During a web application security assessment, we discovered that the /app/assets/i18n/en.json endpoint—intended for UI localization—was publicly accessible without authentication. The file contained far more than translation strings: it exposed 133+ internal database field names, entity structures, and business operation labels. A simple curl request returned 40KB of internal system metadata that directly mapped to the application's data
Luchezar Atanasov
Mar 22 min read


CORS Misconfiguration Enabling Cross-Origin Data Theft
During assessment for one of our web clients, we discovered that the server reflected any Origin header value in its CORS response, combined with Access-Control-Allow-Credentials: true. This configuration allowed any external website to make authenticated requests on behalf of logged-in users. An attacker hosting a malicious page could silently fetch sensitive data from the application using the victim's session cookies.
Luchezar Atanasov
Mar 13 min read


Case study JWT access token with excessively long expiration
Scope: We was given Swagger documentation of company new service APIs for release We found that the application’s JWT access tokens (used for API authentication in most of the APIs) had an unusually long validity period (e.g., 7–30 days) and were not tied to any server‑side revocation or rotation mechanism. Once issued, a stolen token remained valid until its natural expiration, regardless of logout, password change, or role changes. This meant an attacker who obtained a sing
erik biserovv
Mar 12 min read


Case study Broken access control
During audits, we discovered multiple issues in the /internal/profile endpoint, used by the web app to fetch customer details. The endpoint accepted a profile_id parameter and returned full profile data without verifying that the requesting user actually owned that profile. By incrementing or iterating over profile_id values, an authenticated user could enumerate other customers’ records and retrieve PII (name, email, phone, partial address) under certain conditions. Escalati
Luchezar Atanasov
Mar 12 min read
bottom of page
