Automated Penetration Test Report

Executive summary

Automated penetration test identified 5 finding(s) on shop.example.com

Vulnify ran the pen_test_core suite against https://shop.example.com. Findings by severity: Critical 0, High 3, Medium 2, Low 0, Info 0. Check matrix: 2 passed, 4 failed, 5 not applicable.

This is an automated, evidence-backed Vulnify assessment. It is not a PCI DSS, SOC 2, ISO 27001, or certified penetration test, and it is not a human consultant letter or attestation.

Do this week

The five highest-severity fixes, in plain English, with the URL to change first.

1. HIGH Reflected XSS on search
   URL: /search?q=
   HTML-encode the recorded parameter on output for the context (HTML body, attribute, or JS).
2. HIGH Missing anti-CSRF tokens (3 paths)
   URL: /account/email
   Require a per-session anti-CSRF token on every state-changing form and JSON POST.
3. HIGH Path traversal on file download
   URL: /file?path=
   Resolve the file against an allowlisted directory and reject .. segments after normalization.
4. MEDIUM Missing security headers (3)
   URL: /
   Add Content-Security-Policy with a default-src of self and explicit script/style sources. Avoid unsafe-inline once scripts are nonced.
5. MEDIUM Cookie security flags incomplete
   URL: /
   Set Secure, HttpOnly, and SameSite on session cookies.

What we did not test

• Exact hostname only. Sibling hosts and extra subdomains stay out of scope until they are verified.
• This is an automated, evidence-backed Vulnify assessment. It is not a PCI DSS, SOC 2, ISO 27001, or certified penetration test, and it is not a human consultant letter or attestation.
• No login session was supplied, so account takeover, object-level authorization, privilege escalation, and logout session handling were not tested.
• SQL injection probes ran and did not confirm a finding. Unconfirmed SQL injection is not reported as a vulnerability.
• Stored XSS was not confirmed. No persistent sink was in scope or the check was not applicable.
• DOM XSS was not confirmed. No client-side sink was in scope or the check was not applicable.
• Authenticated crawl did not run, so in-app pages behind login were not mapped.
• BOLA / object-level API access was not tested. That check needs object IDs and a login session.
• Privilege escalation was not tested. That check needs a working authenticated role.

Attack surface appendix

Exact hostname only. Sibling hosts and extra subdomains stay out of scope until they are verified.

Last pentest comparison

no prior pentest

Authorization matrix

A second auth profile was not supplied, so role B columns are Not tested.

No object-level authorization probes were recorded for this engagement.

Scope and methodology

Target hostname shop.example.com was tested under exact-hostname scope lock. Suite pen_test_core executed 11 catalog checks. Engines and Vulnify modules invoked: must_checks. This run was unauthenticated. Authenticated authz and business-logic checks are not applicable until a healthy auth profile is supplied. Checks marked not_applicable were skipped because preconditions were missing (for example auth, object IDs, or optional binaries). Findings are never invented to fill those gaps. One targeted retest is included with this Penetration Test.

Limitations

• Exact hostname only. Sibling hosts and extra subdomains stay out of scope until they are verified.
• This is an automated, evidence-backed Vulnify assessment. It is not a PCI DSS, SOC 2, ISO 27001, or certified penetration test, and it is not a human consultant letter or attestation.
• No login session was supplied, so account takeover, object-level authorization, privilege escalation, and logout session handling were not tested.
• SQL injection probes ran and did not confirm a finding. Unconfirmed SQL injection is not reported as a vulnerability.
• Stored XSS was not confirmed. No persistent sink was in scope or the check was not applicable.
• DOM XSS was not confirmed. No client-side sink was in scope or the check was not applicable.
• Authenticated crawl did not run, so in-app pages behind login were not mapped.
• BOLA / object-level API access was not tested. That check needs object IDs and a login session.
• Privilege escalation was not tested. That check needs a working authenticated role.

Auditor-ready evidence pack

This automated evidence pack can support your auditor's review. It is not a PCI DSS, SOC 2, or ISO 27001 certification, and it is not a certified or human-signed penetration test.

Scope letter

• Requester: Authorized buyer
• Verified hostnames: shop.example.com
• Suite: pen_test_core · Auth: none
• Retest entitlement: 1 · Used:

Methodology map

Findings (5)

Fix-first plan

Prioritize CISA KEV and high-EPSS findings first, then Critical/High severity. Retest after each remediation batch.

1. HIGH Reflected XSS on search — Start at /search?q=
2. HIGH Missing anti-CSRF tokens (3 paths) — Start at /account/email
3. HIGH Path traversal on file download — Start at /file?path=
4. MEDIUM Missing security headers (3) — Start at /
5. MEDIUM Cookie security flags incomplete — Start at /

Likely attack paths

Identified 2 combined path(s) from related findings. Validate and remediate path members together.

1. Session theft path — Weak session cookies combined with missing transport hardening and script injection risk can enable session hijacking.
   Related findings: sample-cookies sample-headers sample-xss
2. Injection impact path — Confirmed injection near sensitive or administrative surfaces increases the chance of data theft or privilege abuse.
   Related findings: sample-xss sample-lfi sample-csrf

Check matrix appendix

Not applicable (5): web.xss.stored web.xss.dom discover.crawl_auth api.bola_object_id logic.priv_escalation