PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Golden Role How a Simple API Logic Flaw Unlocked an Entire SaaS Platform

labs.cognisys.group | blog | #pentesting | #access-control | #privilege-escalation | #api-security | #saas | #black-box | #multi-tenant
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

In a true black-box assessment, the engagement begins with minimal information: a target URL and no prior knowledge of the application’s architecture, credentials, or codebase. During a recent engagement targeting a multi-tenant SaaS platform, our initial objective was to establish initial access through standard user provisioning.
Published
Collected

Related coverage

blog · labs.cognisys.group
Breaking Tenant Boundaries, When Path Traversal Isn't About the Filesystem
Multi-tenant SaaS applications are a tricky beast. From the outside, they look like a single product, but underneath the surface, they’re hosting data and configurations for dozens, hundreds, sometimes thousands of separate organisations. Every request that hits the backend has to know which tenant it belongs to and what data it should be allowed to touch. When that boundary is enforced cleanly, the platform works as advertised. When it isn’t, the consequences can be severe. A single authenticated user in one organisation might be able to peek into the files of every other organisation on the platform.
blog · labs.cognisys.group
Keys to the Kingdom Live Stripe Credentials Exposed via Unauthenticated OAuth Endpoint
There is a particular category of finding that stops you mid-test. Not because it is technically complex, but because of what you are looking at. A single unauthenticated GET request that returns live payment credentials for a platform processing real customer transactions is one such finding.
blog · borghq.io
Manual Pentest vs AI Pentest: What Each Finds and Where Humans Win
Comparing manual pentest vs AI pentest? See what each method finds in auth, APIs, and logic, where human testers win, and how Borg verifies code changes.
blog · borghq.io
Tenant Isolation Testing: How to Prove Tenant Boundaries Hold
Learn how to run tenant isolation testing across APIs, queues, and background workers. Prove one customer cannot access another before shipping to production.
blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
blog · netspi.com
How Secure Are Your SaaS Applications? Pentesting for SaaS Providers
SaaS providers face rising API and multi-tenant threats; regular pentesting aligned to OWASP and PTES across the SDLC reduces breach risk and supports SOC 2, ISO 27001, GDPR, and HIPAA.
Back