Penetration Testing


Feature :
Blank
Summary
Step
Feature
Endpoint
Expected
Status
Method
Request
1
Information Disclosure
In the request below the attacker just changes the username to another user's username, and the response will display some information from the username user
GET /v1/users/nickname/[User-Nickname]
Data Leak Prevention
PASSED
IDOR
Open
2
Attacker change another user's Goals status to 'Completed'
Create a new Goal on account A, and on account B click 'Support me' and proceed to payment
Go back to account A and click 'Complete goal' intercept the request with Burp
Goal Donation
PUT /v1/wallets/goal-donation/[ID-goals]'.
Validation
PASSED
IDOR
Open
3
Attacker update another user’s Goals
Update Existing goal on Attacker’s account
Intercept the request then change id to Victim Goal donation id
Goal Donation
PUT /v1/wallets/goal-donation/[ID-goals]'.
Validation Handle
PASSED
IDOR
Open
4
Attacker delete another user’s Goals
Delete Existing goal on Attacker’s account
Intercept the request then change id to Victim Goal donation id
Goal Donation
PUT /v1/wallets/goal-donation/[ID-goals]'.
Validation Handle
PASSED
IDOR
Open
5
Attacker create new Goal Donation for another user
Attacker create new goal donation, intercept request before click button create
Goal Donation
POST /v1/wallets/me/goal-donation
Authentication Handle
PASSED
IDOR
Open
6
Users can rate products more than once
Buy another user's product and go to the page https://ganknow.com/manage/my-orders
Click the Leave a Review button and intercept the request with Burpsuite
Right click and Send to repeater
Shop Listing
POST /v1/catalogs/services/[order-id]/reviews
make sure order id is exist and order the same service and come from same users
double checking on one order id only can submit by one review
PASSED
IDOR
Open
7
Users can change the URL of the Attachments URL
Create a new listing on https://ganknow.com/plecle/shop fill in the title, description, etc. [or edit an existing one]
In the 'Listing type' select Digital Goods and Upload Attachments then Publish
Return to the newly created listing and click Edit Listing
Intercept requests with Burp
Shop Listing
PUT /v1/catalogs/services/[services-id]
Validate download link with only allowed scheme http or https
PASSED
IDOR
Open
8
Attacker change another user’s Listing price to $0
Attacker
Shop Listing
Open
9
Attacker create new membership on another user’s account
Open
10
Attacker Delete victim membership
Membership
DELETE /v1/users/membership-settings-v2
Authentication Handle
Membership id leak
PASSED
IDOR
Open
11
Attacker withdraw more than existing balance
Withdrawal
POST /v1/wallets/withdrawal-requests
PASSED
IDOR
Open
12
Attacker withdraw less than minimum withdraw
Withdrawal
POST /v1/wallets/withdrawal-requests
PASSED
IDOR
Open
13
Attacker change victim withdraw account
Open
14
Attacker change earnings balance
Open
15
Attacker change donation ammount from transaction history
Withdrawal
PATCH /v1/wallets/(Tranasaction ID)/transactions
Open
There are no rows in this table


Want to print your doc?
This is not the way.
Try clicking the ⋯ next to your doc name or using a keyboard shortcut (
CtrlP
) instead.