VULNIFY

Comprehensive Pentest Report

Target: https://shop.example.com

Hostname: shop.example.com

Suite: comprehensive_core · Tier: comprehensive

Generated: 2026-08-17T00:00:00.000Z

Automated testing with evidence · AI status: sample

Hands-off Vulnify worker. No human tester. Exact-hostname scope lock.

Auth: none · Included retests: 2.

This automated evidence pack can support your auditor's review. It is not a PCI DSS, SOC 2, or ISO 27001 certification, and it is not a certified or human-signed penetration test.

Executive summary

Automated penetration test identified 7 finding(s) on shop.example.com

Vulnify ran the comprehensive_core suite against https://shop.example.com. Findings by severity: Critical 0, High 4, Medium 3, Low 0, Info 0. Check matrix: 4 passed, 6 failed, 6 not applicable.

0Critical

4High

3Medium

0Low

0Info

Leadership this week: Fund XSS encoding and JWT cookie storage this week on shop.example.com, then disable GraphQL introspection on api.shop.example.com.

This is an automated, evidence-backed Vulnify assessment. It is not a PCI DSS, SOC 2, ISO 27001, or certified penetration test, and it is not a human consultant letter or attestation.

Do this week

The five highest-severity fixes, in plain English, with the URL to change first.

HIGH Reflected XSS on search
URL: /search?q=

HTML-encode the recorded parameter on output for the context (HTML body, attribute, or JS).
HIGH Missing anti-CSRF tokens (4 paths)
URL: /account/email

Require a per-session anti-CSRF token on every state-changing form and JSON POST.
HIGH Path traversal on file download
URL: /file?path=

Resolve the file against an allowlisted directory and reject .. segments after normalization.
HIGH JWT in first-party HTML
URL: /

Apply this fix on host shop.example.com.
MEDIUM Missing security headers (3)
URL: /

Add Content-Security-Policy with a default-src of self and explicit script/style sources. Avoid unsafe-inline once scripts are nonced.

What we did not test

4 extra hosts found, 3 verified and tested, 1 left unverified or skipped.
This is an automated, evidence-backed Vulnify assessment. It is not a PCI DSS, SOC 2, ISO 27001, or certified penetration test, and it is not a human consultant letter or attestation.
Comprehensive Pentest: a second auth profile was not supplied, so multi-role and BOLA-across-roles did not run.
No OpenAPI spec was uploaded, so API and BOLA checks used crawl and hint discovery only.
SQL injection probes ran and did not confirm a finding. Unconfirmed SQL injection is not reported as a vulnerability.
Stored XSS was not confirmed. No persistent sink was in scope or the check was not applicable.
DOM XSS was not confirmed. No client-side sink was in scope or the check was not applicable.
Authenticated crawl did not run, so in-app pages behind login were not mapped.
BOLA / object-level API access was not tested. That check needs object IDs and a login session.
Privilege escalation was not tested. That check needs a working authenticated role.
No repository zip was uploaded, so secret scanning did not run.

Attack surface appendix

3 extra hosts found, 2 verified and tested, 1 left unverified or skipped.

Hostname	Status	Role	Notes
`shop.example.com`	tested	primary	primary
`api.shop.example.com`	tested	extra	inventory
`admin.shop.example.com`	tested	extra	inventory
`staging.shop.example.com`	out_of_scope	extra	Not selected

Per-host finding rollup

Host	Critical	High	Medium	Low	Info	Total
`shop.example.com`	0	4	2	0	0	6
`api.shop.example.com`	0	0	1	0	0	1

Last pentest comparison

Compared with prior job sample-pentest-report: 2 new, 4 still open, 0 resolved.

Authorization matrix

A second auth profile was not supplied, so role B columns are Not tested.

URL / object	Unauth	Role A	Role B	Outcome
`https://api.shop.example.com/orders/1001`	401	200	not_tested	role_a_ok

Scope and methodology

Target hostname shop.example.com was tested under exact-hostname scope lock. Suite comprehensive_core executed 16 catalog checks. Engines and Vulnify modules invoked: must_checks. This run was unauthenticated. Authenticated authz and business-logic checks are not applicable until a healthy auth profile is supplied. Checks marked not_applicable were skipped because preconditions were missing (for example auth, object IDs, or optional binaries). Findings are never invented to fill those gaps. This Comprehensive Pentest includes two targeted retest cycles. Extra sibling hosts are tested only after they are verified (cap 5).

Limitations

4 extra hosts found, 3 verified and tested, 1 left unverified or skipped.
This is an automated, evidence-backed Vulnify assessment. It is not a PCI DSS, SOC 2, ISO 27001, or certified penetration test, and it is not a human consultant letter or attestation.
Comprehensive Pentest: a second auth profile was not supplied, so multi-role and BOLA-across-roles did not run.
No OpenAPI spec was uploaded, so API and BOLA checks used crawl and hint discovery only.
SQL injection probes ran and did not confirm a finding. Unconfirmed SQL injection is not reported as a vulnerability.
Stored XSS was not confirmed. No persistent sink was in scope or the check was not applicable.
DOM XSS was not confirmed. No client-side sink was in scope or the check was not applicable.
Authenticated crawl did not run, so in-app pages behind login were not mapped.
BOLA / object-level API access was not tested. That check needs object IDs and a login session.
Privilege escalation was not tested. That check needs a working authenticated role.
No repository zip was uploaded, so secret scanning did not run.

Auditor-ready evidence pack

This automated evidence pack can support your auditor's review. It is not a PCI DSS, SOC 2, or ISO 27001 certification, and it is not a certified or human-signed penetration test.

Scope letter

Requester: Authorized buyer
Verified hostnames: shop.example.com, api.shop.example.com, admin.shop.example.com
Suite: comprehensive_core · Auth: cookie
Retest entitlement: 2 · Used:

Methodology map

Check	OWASP	PTES	NIST
`baseline.tls_transport`	WSTG-CRYP-01	PTES Vulnerability Analysis	NIST SP 800-115 3.2 Review Techniques
`baseline.security_headers`	WSTG-CONF-12	PTES Vulnerability Analysis	NIST SP 800-115 3.2 Review Techniques
`web.xss.reflected`	WSTG-INPV-01	PTES Exploitation	NIST SP 800-115 3.4 Target Vulnerability Validation
`web.xss.stored`	WSTG-INPV-02	PTES Exploitation	NIST SP 800-115 3.4 Target Vulnerability Validation
`web.xss.dom`	WSTG-CLNT-01	PTES Exploitation	NIST SP 800-115 3.4 Target Vulnerability Validation
`web.csrf.state_changing`	WSTG-SESS-05	PTES Vulnerability Analysis	NIST SP 800-115 3.4 Target Vulnerability Validation
`web.lfi_path_traversal`	WSTG-ATHZ-01	PTES Exploitation	NIST SP 800-115 3.4 Target Vulnerability Validation
`web.sqli.reflect_or_blind`	WSTG-INPV-05	PTES Exploitation	NIST SP 800-115 3.4 Target Vulnerability Validation
`discover.crawl_auth`	WSTG-INFO-06	PTES Intelligence Gathering	NIST SP 800-115 3.3 Target Identification and Analysis
`api.bola_object_id`	WSTG-ATHZ-04	PTES Exploitation	NIST SP 800-115 3.4 Target Vulnerability Validation
`logic.priv_escalation`	WSTG-ATHZ-03	PTES Exploitation	NIST SP 800-115 3.4 Target Vulnerability Validation
`recon.subdomain_inventory`	WSTG-INFO-01	PTES Intelligence Gathering	NIST SP 800-115 3.3 Target Identification and Analysis
`api.graphql.introspection`	WSTG-INFO-10	PTES Intelligence Gathering	NIST SP 800-115 3.3 Target Identification and Analysis
`session.jwt_exposure`	WSTG-SESS-02	PTES Vulnerability Analysis	NIST SP 800-115 3.2 Review Techniques
`session.jwt_alg_none`	WSTG-CRYP-04	PTES Exploitation	NIST SP 800-115 3.4 Target Vulnerability Validation
`repo.secrets.gitleaks`	WSTG-CONF-05	PTES Intelligence Gathering	NIST SP 800-115 3.2 Review Techniques

Findings (7)

HIGH confirmed

Reflected XSS on search

Check web.xss.reflected · Host shop.example.com · Path /search?q= · Engines must_checks

Parameter q

How to reproduce

Send GET to /search?q=, observe HTTP 200, using parameter q.

Business impact

Reflected XSS steals sessions, injects UI, and is a common phishing primitive on the same origin.

Remediation

Owner application · Effort medium

HTML-encode the recorded parameter on output for the context (HTML body, attribute, or JS).
Add or tighten Content-Security-Policy so inline script cannot run.
Prefer framework auto-escaping and avoid inserting unsanitized HTML.
If the stack was not identified, apply the generic application-layer steps and say so in the ticket.

Verify before retest

Replay the recorded payload and confirm it is encoded, not executed.
Confirm CSP is present on that response.

After the change is live, use the included targeted retest from the workspace. Do not mark the finding closed until the retest records a before/after result.

Evidence

Observed GET · /search?q= · HTTP 200

Path hits /search?q= /search?q=

Browser proof no browser proof

HIGH confirmed

Missing anti-CSRF tokens (4 paths)

Check web.csrf.state_changing · Host shop.example.com · Path /account/email · Engines must_checks

How to reproduce

Send POST to /account/email, observe HTTP 200.

Business impact

Without anti-CSRF controls, a foreign site can change email, password, or money-moving actions as the victim.

Remediation

Owner application · Effort medium

Require a per-session anti-CSRF token on every state-changing form and JSON POST.
Verify Origin or Referer as a second check.
Set SameSite=Strict or Lax on session cookies.
If the stack was not identified, apply the generic application-layer steps and say so in the ticket.

Verify before retest

POST the recorded action without a token and confirm rejection.
Confirm SameSite on the session cookie.

After the change is live, use the included targeted retest from the workspace. Do not mark the finding closed until the retest records a before/after result.

Evidence

Observed POST · /account/email · HTTP 200

Path hits /account/email /password/reset /account/email /account/email

Browser proof no browser proof

HIGH confirmed

Path traversal on file download

Check web.lfi_path_traversal · Host shop.example.com · Path /file?path= · Engines must_checks

Parameter path

How to reproduce

Send GET to /file?path=, observe HTTP 200, using parameter path.

Business impact

Path traversal reads secrets, source, and sometimes credentials off disk.

Remediation

Owner application · Effort medium

Resolve the file against an allowlisted directory and reject .. segments after normalization.
Do not concatenate user paths onto filesystem roots.
Serve downloads by opaque IDs, not filenames.
If the stack was not identified, apply the generic application-layer steps and say so in the ticket.

Verify before retest

Replay the recorded path parameter and confirm the marker file is not returned.

After the change is live, use the included targeted retest from the workspace. Do not mark the finding closed until the retest records a before/after result.

Evidence

Observed GET · /file?path= · HTTP 200

Path hits /file?path= /file?path=

Browser proof no browser proof

HIGH confirmed

JWT in first-party HTML

Check session.jwt_exposure · Host shop.example.com · Path / · Engines must_checks

How to reproduce

Send GET to /, observe HTTP 200.

Business impact

JWTs in HTML or localStorage are stolen by XSS and used as bearer sessions.

Remediation

Owner application · Effort medium

Apply this fix on host shop.example.com.
Prefer HttpOnly cookies over localStorage for session JWTs.
Shorten TTL and rotate refresh tokens.
Do not embed JWTs in first-party HTML.
If the stack was not identified, apply the generic application-layer steps and say so in the ticket.

Verify before retest

Confirm the recorded page no longer contains a live JWT.

After the change is live, use the included targeted retest from the workspace. Do not mark the finding closed until the retest records a before/after result.

Evidence

Observed GET · / · HTTP 200

Path hits /

eyJhbGciOi...[REDACTED]

Browser proof no browser proof

MEDIUM confirmed

Missing security headers (3)

Check baseline.security_headers · Host shop.example.com · Path / · Engines http_probe

How to reproduce

Open / and confirm the recorded evidence still appears.

Business impact

Missing security headers make XSS, clickjacking, and MIME confusion easier. Auditors look for these on every HTTPS response.

Remediation

Owner platform · Effort small

Add Content-Security-Policy with a default-src of self and explicit script/style sources. Avoid unsafe-inline once scripts are nonced.
Add Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and a frame-ancestors policy (or X-Frame-Options).
Apply headers on every HTML and API error page, not only the homepage.
If the stack was not identified, apply the generic application-layer steps and say so in the ticket.

Verify before retest

Fetch the recorded URL and confirm each missing header from the finding evidence is now present.
Confirm error pages (404/500) also send the same headers.

After the change is live, use the included targeted retest from the workspace. Do not mark the finding closed until the retest records a before/after result.

Evidence

Missing headers content-security-policy strict-transport-security x-content-type-options

Path hits / /

Browser proof no browser proof

MEDIUM confirmed

Cookie security flags incomplete

Check session.cookie_flags_fixation · Host shop.example.com · Path / · Engines must_checks

How to reproduce

Open / and confirm the recorded evidence still appears.

Business impact

Missing cookie flags or session fixation lets an attacker keep a stolen or planted session.

Remediation

Owner application · Effort medium

Set Secure, HttpOnly, and SameSite on session cookies.
Rotate the session ID at login.
Bind the session to a User-Agent or IP only if that matches your product threat model.
If the stack was not identified, apply the generic application-layer steps and say so in the ticket.

Verify before retest

After the change is live, use the included targeted retest from the workspace. Do not mark the finding closed until the retest records a before/after result.

Evidence

Path hits / /

Browser proof no browser proof

MEDIUM confirmed

GraphQL introspection enabled on api.shop.example.com

Check api.graphql.introspection · Host api.shop.example.com · Path /graphql · Engines must_checks

How to reproduce

Send POST to /graphql, observe HTTP 200.

Business impact

Public introspection hands attackers the full schema, including internal mutations.

Remediation

Owner application · Effort small

Apply this fix on host api.shop.example.com.
Disable introspection in production.
Put GraphQL behind authentication if it is not a public catalog.
If the stack was not identified, apply the generic application-layer steps and say so in the ticket.

Verify before retest

POST an introspection query anonymously and confirm it is rejected.

After the change is live, use the included targeted retest from the workspace. Do not mark the finding closed until the retest records a before/after result.

Evidence

Observed POST · /graphql · HTTP 200

Path hits /graphql (200)

Browser proof no browser proof

Fix-first plan

Prioritize CISA KEV and high-EPSS findings first, then Critical/High severity. Retest after each remediation batch.

HIGH Reflected XSS on search — Start at /search?q=
HIGH Missing anti-CSRF tokens (4 paths) — Start at /account/email
HIGH Path traversal on file download — Start at /file?path=
HIGH JWT in first-party HTML — Start at /
MEDIUM Missing security headers (3) — Start at /
MEDIUM Cookie security flags incomplete — Start at /
MEDIUM GraphQL introspection enabled on api.shop.example.com — Start at /graphql

Likely attack paths

Identified 2 combined path(s) from related findings. Validate and remediate path members together.

Session theft path — Weak session cookies combined with missing transport hardening and script injection risk can enable session hijacking.
Related findings: sample-cookies sample-headers sample-xss
Injection impact path — Confirmed injection near sensitive or administrative surfaces increases the chance of data theft or privilege abuse.
Related findings: sample-xss sample-lfi sample-csrf sample-graphql

Check matrix appendix

Check	Status	Summary
`baseline.tls_transport`	passed	TLS 1.2+ served on the sample host
`baseline.security_headers`	failed	CSP, HSTS, and X-Content-Type-Options missing
`web.xss.reflected`	failed	Reflected XSS confirmed on /search
`web.xss.stored`	not_applicable	No persistent sink in sample scope
`web.xss.dom`	not_applicable	No DOM sink in sample scope
`web.csrf.state_changing`	failed	State-changing forms lacked CSRF tokens
`web.lfi_path_traversal`	failed	Path parameter read a local file
`web.sqli.reflect_or_blind`	passed	SQL injection was not confirmed
`discover.crawl_auth`	not_applicable	Sample report is unauthenticated
`api.bola_object_id`	not_applicable	No authenticated object IDs in sample
`logic.priv_escalation`	not_applicable	No login role in sample
`recon.subdomain_inventory`	passed	3 extra hosts found; 2 verified and tested
`api.graphql.introspection`	failed	Introspection open on /graphql
`session.jwt_exposure`	failed	Replayable JWT in page
`session.jwt_alg_none`	passed	alg=none rejected
`repo.secrets.gitleaks`	not_applicable	No repository zip uploaded

Not applicable (6): web.xss.stored web.xss.dom discover.crawl_auth api.bola_object_id logic.priv_escalation repo.secrets.gitleaks