Web Application Security Custom Lab Hard
VulnBank
A comprehensive security assessment of an intentionally vulnerable banking web application. Conducted full reconnaissance, vulnerability identification, exploitation, and documented findings with remediation guidance.
Date
2025
Tools
Burp SuiteNmapNiktoGobusterSQLMapBrowser DevTools
Skills
Web App PentestingSQL InjectionAuthentication BypassSession ManagementInput ValidationReport Writing
Objective
Assess the security posture of VulnBank, an intentionally vulnerable banking web application, identifying critical vulnerabilities and documenting findings with actionable remediation guidance.
Environment
- VulnBank web application (Docker container)
- Kali Linux attack machine
- Local isolated network
Methodology
- Reconnaissance — Service discovery and technology fingerprinting
- Mapping — Application structure and endpoint enumeration
- Vulnerability Discovery — Manual and automated testing
- Exploitation — Controlled exploitation of identified vulnerabilities
- Documentation — Comprehensive report with CVSS scoring
Key Findings
- SQL Injection in login and search functionality
- Broken Authentication allowing account takeover
- Insecure Direct Object References (IDOR)
- Sensitive data exposure in API responses
- Missing security headers and CSRF protection
Skills Demonstrated
This project demonstrates practical web application penetration testing skills including manual vulnerability discovery, exploitation techniques, and professional documentation of security findings.