Skip to content

Latest commit

 

History

History
69 lines (52 loc) · 3.9 KB

README.md

File metadata and controls

69 lines (52 loc) · 3.9 KB

Internshala Ethical Hacking Final Project Report

Introduction

This report presents the findings and analysis of the Vulnerability Assessment and Penetration Testing (VAPT) performed on the E-commerce platform Lifestyle Store as part of the Ethical Hacking training conducted by Internshala Trainings. The objective of this assessment was to identify and exploit potential vulnerabilities in the application to assess its security posture and recommend mitigation measures.

Scope

  • Identifying vulnerabilities in the Lifestyle Store web application.
  • Exploiting discovered vulnerabilities to assess their impact.
  • Providing recommendations for improving the security posture of the application.

Methodology

The VAPT process followed industry-standard methodologies and involved the following steps:

  1. Reconnaissance: Gathering information about the target system, such as IP addresses, domain names, and technology stack.
  2. Scanning: Using automated tools like Nmap and Nessus to discover open ports, services, and potential vulnerabilities.
  3. Enumeration: Gathering more detailed information about the target system, such as user accounts, shares, and services.
  4. Vulnerability Analysis: Identifying and assessing vulnerabilities in the target system, including common web application vulnerabilities such as SQL injection, cross-site scripting (XSS), and insecure authentication mechanisms.
  5. Exploitation: Attempting to exploit identified vulnerabilities to gain unauthorized access or perform malicious actions.
  6. Reporting: Documenting findings, including identified vulnerabilities, their severity, and recommendations for remediation.

Findings

The assessment revealed several vulnerabilities in the Lifestyle Store application, including:

  • Bruteforce exploitation
  • Client-side filter bypass
  • Command execution
  • Component with known vulnerability
  • CSRF (Cross-Site Request Forgery)
  • Customer account access
  • Default files
  • Directory listing
  • File inclusion
  • Forced browsing
  • IDOR (Insecure Direct Object Reference)
  • Insecure file uploads
  • Open Redirection
  • PII (Personally Identifiable Information) Leakage
  • SQL injections
  • Weak passwords
  • XSS (Cross-Site Scripting)

Recommendations

To improve the security posture of the Lifestyle Store application, the following recommendations are proposed:

  1. Input Validation: Implement thorough input validation mechanisms to prevent SQL injection and XSS attacks.
  2. Authentication Enhancements: Enforce strong password policies, implement multi-factor authentication, and use secure session management practices.
  3. Authorization Controls: Implement proper authorization checks to prevent unauthorized access to sensitive resources.
  4. Regular Security Assessments: Conduct regular security assessments, including VAPT, to identify and remediate vulnerabilities proactively.
  5. Employee Training: Provide security awareness training to developers and employees to educate them about common security threats and best practices.

Conclusion

The VAPT performed on the Lifestyle Store application revealed critical vulnerabilities that could compromise the confidentiality, integrity, and availability of the platform. By addressing these vulnerabilities and implementing the recommended security measures, the application can enhance its resilience against cyber threats and safeguard user data.

For further inquiries or to discuss the findings in detail, please contact me via LinkedIn: Arjun Shetty.