Interactive sample report

The report your engineers and auditors will both use.

A complete, interactive example of a CYBEROCO web application and API penetration test report. The client is fictional; the scoring, weakness classes and compliance mappings are real.

Request the full report
CYBEROCOConfidential — public sample

Penetration Test Report

Acme Pay (fictional client)

Web application & API

Report ID
CYB-2026-0412
Version
1.1
Issued
16 June 2026
Retested
21 July 2026

Acme Pay and all hosts shown are fictional (reserved .example domains). Evidence is redacted and attack payloads are withheld. CVSS scores are computed from each vector using the FIRST CVSS v3.1 formula.

01

Executive summary

Acme Pay's platform had one critical and two high-risk weaknesses that, combined, allowed an unauthenticated attacker to reach every customer's billing data.

Overall risk · At testHigh
Overall risk · After retestLow

Findings by severity

  • 1Critical
  • 2High
  • 3Medium
  • 2Low
  • 1Info
  • 9findings
  • The most serious issue was an internal user-management API exposed to the internet without authentication (F-01).
  • Access-control and input-handling flaws in the customer API (F-02, F-03) allowed one customer to read other customers' data.
  • Authentication hardening, outdated components and configuration issues made up the remaining findings.
  • At retest, all critical and high findings were fixed. Overall risk fell from High to Low.

Top priorities

  1. F-01CriticalInternal user-management API reachable without authentication
  2. F-02HighSQL injection in the transaction export sort parameter
  3. F-03HighCross-tenant access to invoices by changing the invoice ID
02

Scope & methodology

In-scope assets

AssetTypeAccess provided
app.acme-pay.exampleCustomer web application2 accounts per role (customer, customer admin)
api.acme-pay.exampleREST API v2OpenAPI specification, API tokens
admin.acme-pay.exampleStaff support dashboard1 support-agent account
legacy-api.acme-pay.examplePartner API (legacy)Network access only

Engagement details

Approach
Grey box, authenticated
Testing window
1–12 June 2026 (10 working days)
Team
2 senior consultants
Retest
21 July 2026

Standards followed

  • OWASP Web Security Testing Guide (WSTG) v4.2
  • OWASP API Security Top 10 (2023)
  • OWASP ASVS 4.0.3, Level 2
  • PTES and NIST SP 800-115
  • CVSS v3.1 for severity scoring

Methodology

  1. 01Reconnaissance

    Map hosts, routes, roles and data flows from the OpenAPI spec and live traffic.

  2. 02Automated discovery

    Targeted scanning to widen coverage; every result is manually validated.

  3. 03Manual testing

    Authentication, authorisation, business logic, injection and session handling by hand.

  4. 04Exploitation & chaining

    Safely prove impact and combine weaknesses into realistic attack paths.

  5. 05Reporting & retest

    Evidence-backed findings, a debrief call, then a retest of every fix.

03

Findings

Severity
Retest status
Showing 9 of 9

This public preview shows full details for 4 of 9 findings. The complete report includes every finding in full.

  1. Description

    The /internal/api/ routes, intended only for the support dashboard, are published on the public API gateway and do not require a token. Any internet user can list, create and modify user accounts, including administrator roles.

    Evidence (redacted)

    GET /internal/api/users?page=1 HTTP/1.1
Host: api.acme-pay.example
(no Authorization header)

HTTP/1.1 200 OK
{"total": 4812, "users": [{"id": "usr_•••", "email": "j•••@•••.example", "role": "admin"}, …]}

    Impact

    Full compromise of the platform's user base: an attacker can create an administrator account, take over customer accounts and access every tenant's data.

    Remediation

    1. Remove /internal/api/ routes from the public gateway; expose them only on the private network or behind the VPN.
    2. Require authentication and an administrator role on every internal route, enforced centrally in middleware.
    3. Add an automated test that fails the build if any route is reachable without a token.
    Retest: Fixed. Internal routes now return 404 from the public gateway and 401 without a valid administrator token on the private network.
    Affected asset
    api.acme-pay.example
    CVSS v3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    • Attack VectorNetwork
    • Attack ComplexityLow
    • Privileges RequiredNone
    • User InteractionNone
    • ScopeUnchanged
    • ConfidentialityHigh
    • IntegrityHigh
    • AvailabilityNone
    Weakness
    CWE-306 Missing Authentication for Critical Function
    OWASP
    API2:2023 Broken Authentication
    Compliance
    PCI 7.2.1PCI 8.3.1ISO A.5.15ISO A.8.5SOC 2 CC6.1
04

Attack chain

Individually, some findings look minor. Combined, they gave an unauthenticated attacker a path to every customer's billing data.

  1. F-09InfoStack traces leak internal paths

    Error responses reveal the internal user-management service and its routes.

    Open
  2. F-01CriticalUnauthenticated internal API

    The internal API is reachable from the internet; the attacker creates an administrator account.

    Fixed
  3. F-03HighCross-tenant invoice access

    With any account, sequential invoice IDs expose every tenant's invoices.

    Fixed
  4. ImpactBulk exposure of billing data

    Customer names, contact details and invoice amounts across all tenants.

Broken at retest by fixing F-01 and F-03.

05

Remediation roadmap

Fixes are ordered by risk and effort, so the team closes the most dangerous paths first.

Immediate

0–7 days

Short term

within 30 days

Planned

within 90 days

06

Compliance mapping

Every finding is mapped to the controls your auditors will ask about.

FindingPCI DSS v4.0ISO/IEC 27001:2022SOC 2 (TSC)OWASP
F-01 Critical7.2.1, 8.3.1A.5.15, A.8.5CC6.1API2:2023
F-03 High6.2.4, 7.2.2A.8.3CC6.1API1:2023
F-05 Medium8.3.4A.8.5CC6.1A07:2021
F-07 Low2.2.6A.8.9CC6.6A05:2021
+ 5 more findings mapped in the full report Request the full report
07

Retest results

We retest every finding once fixes are deployed, at no extra cost, and update the report.

  • 6Fixed
  • 1Partially fixed
  • 1Risk accepted
  • 1Open
F-01Internal user-management API reachable without authenticationFixedFixed. Internal routes now return 404 from the public gateway and 401 without a valid administrator token on the private network.
F-03Cross-tenant access to invoices by changing the invoice IDFixedFixed. Requests for another tenant's invoice now return 404; the object-ownership check is covered by automated tests.
F-05No rate limiting on login and one-time-password verificationPartially fixedPartially fixed. Login is now rate limited; one-time-password verification still accepts unlimited attempts.
F-07Session cookie missing Secure and SameSite attributesFixedFixed. The cookie now carries Secure, HttpOnly and SameSite=Lax.
+ 5 more findings mapped in the full report Request the full report
08

CVSS calculator

Every score in this report comes from a CVSS v3.1 vector. Change the metrics to see how severity is calculated.

Attack Vector (AV)
Attack Complexity (AC)
Privileges Required (PR)
User Interaction (UI)
Scope (S)
Confidentiality (C)
Integrity (I)
Availability (A)

Base score

9.1

Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Want a report like this for your systems?

Every CYBEROCO engagement ends with a report in this format, a debrief call and a free retest.

Scope a penetration testRequest the full report