Web Application Penetration Testing Report — Sample

A web application penetration test is an authorized, hands-on security assessment in which testers actively attempt to identify and validate exploitable weaknesses in a web application's authentication, authorization, business logic, API, and infrastructure-adjacent surfaces — going beyond automated vulnerability scanning to manually confirm which weaknesses are real, how they can be chained together, and what they mean for the business. The result is a report that gives engineering and security leadership a prioritized, evidence-based roadmap for remediation.

This sample report shows how TMG Security structures that deliverable. It is built around the NorthStar Commerce Portal, a fictional web application operated by NorthStar Digital Commerce, Inc., a fictional e-commerce, SaaS, and digital-payments organization headquartered in Austin, Texas, and covers a simulated one-month assessment window of 01–31 August 2026.

The fictional NorthStar Commerce Portal is a multi-tenant e-commerce and subscription-billing platform serving approximately 1.8 million fictional registered users across roughly 650 fictional employees' worth of operations. It supports account registration and login with MFA, password reset and account recovery, user and organization profile management, role management, invoicing and subscription management, file uploads for support and billing attachments, support ticketing, in-app notifications, API integrations, and outbound webhooks — accessed through six fictional user roles: Unauthenticated Visitor, Standard User, Billing User, Organization Manager, Support Agent, and Administrator.

The fictional technology stack pairs a React/TypeScript front end with a Node.js/Express API, a PostgreSQL database, and a JWT access-token plus rotating refresh-token authentication architecture, deployed on an AWS-style fictional cloud environment behind a fictional cloud-based CDN/WAF, with fictional object storage and a Git-based CI/CD pipeline.

Testing was strictly non-destructive and used only dedicated fictional test accounts (Appendix D of the full report) — no real user accounts or customer data were used at any point. No persistence mechanisms or backdoors were established, automated testing respected reasonable rate limits, and no real customer data was accessed, used, or referenced during the engagement.

TMG Security's testing approach is conceptually informed by industry-recognized frameworks, including the OWASP Web Security Testing Guide, the OWASP Top 10, and the OWASP API Security Top 10. TMG Security is not affiliated with or certified by OWASP, and no copyrighted material from these references is reproduced in this report — they are cited only as conceptual grounding for TMG's own methodology.

Testing followed a 20-stage illustrative lifecycle: reconnaissance and attack-surface mapping, application enumeration, authentication and authorization testing, session-management review, input validation and injection testing, business-logic analysis, file-handling review, API testing, configuration and client/server-side testing, abuse-case testing, manual vulnerability validation, illustrative risk scoring, structured reporting, remediation guidance, and retest recommendations. Every candidate finding was manually validated by a TMG Security fictional tester before inclusion — no automated-scanner output was included without manual confirmation.

TMG Security mapped the fictional application's attack surface across six functional groups — authentication & recovery, organization & members, billing & subscriptions, files & support, API & webhooks, and admin & docs — before beginning role-based testing. The full register documents all 34 fictional endpoints identified, each tested for authentication requirement, role, and result.

TMG Security tested login, MFA, session issuance and revocation, password reset, and account-recovery workflows. Core authentication behavior was found sound: login rejects invalid credentials generically, account lockout and throttling were adequate, password complexity is enforced server-side, and MFA — including recovery-code handling and remembered-device duration — was adequate for privileged roles. Two areas required attention: refresh-token rotation and cookie attributes were implemented soundly, but access tokens remained valid for their full lifetime after logout rather than being actively revoked, and the account-recovery workflow's email-change confirmation step was not bound to its originating request, allowing an authenticated low-privilege session to complete an email change intended for a different pending request.

Authorization testing was the most significant category in this fictional assessment, covering horizontal and vertical privilege escalation and server-side enforcement of role boundaries across all six fictional roles. Testing produced the assessment's most significant result: a Critical cross-tenant object-level authorization gap in the organization-profile endpoint, and a High-severity self-role-elevation path from Standard User to Organization Manager. A related file-download authorization bypass and an excessive API data-exposure finding follow the same underlying pattern — authorization enforced at the "is authenticated" level rather than the "is this specific action authorized for this specific requester" level.

TMG Security submitted safe, illustrative payloads representative of SQL/NoSQL injection, command injection, template injection, path traversal, and cross-site scripting across the fictional application. Parameterized data access was consistently applied — no injection-class weakness was identified beyond one High-severity stored XSS finding in the support-ticket comment workflow, where output encoding was applied inconsistently between the customer-facing and internal Support Agent rendering paths.

Business-logic testing examined multi-step workflows — subscription changes, discount redemption, invoice state transitions, and account-ownership changes — for state-manipulation weaknesses. This category produced the assessment's second Critical finding: a subscription plan-tier escalation that bypasses the expected server-side payment-authorization step, because the plan-change handler trusted a client-supplied "payment authorized" flag instead of deriving that state from the payments subsystem. A related Medium-severity replay condition was also confirmed in the discount-redemption workflow, where a narrow validation window allowed a single-use code to be redeemed twice.

Because the fictional NorthStar Commerce Portal is API-driven, TMG Security applied dedicated API-security testing conceptually informed by the OWASP API Security Top 10 — object- and function-level authorization, excessive data exposure, mass assignment, and rate limiting — without reproducing copyrighted category text. Testing confirmed excessive data exposure on the organization-members endpoint and mass assignment in the organization-profile update endpoint, alongside object- and function-level authorization gaps already detailed above.

The webhook-validation feature — the application's only server-side URL-fetching functionality — was assessed for server-side request forgery (SSRF) exposure using only safe, attacker-controlled test endpoints; no internal network range or cloud metadata endpoint was targeted. A High-severity SSRF-class weakness was confirmed: the fictional server issued an outbound request to an attacker-controlled test endpoint with no observed destination restriction. Webhook signature validation was present but did not incorporate a timestamp or nonce, allowing a captured payload to pass validation again on replay. Defense-in-depth gaps were also identified in CORS configuration (an overly broad origin allow-list), missing Content-Security-Policy and inconsistent frame protection, and several lower-severity configuration and header-hardening items detailed in the full finding register.

File-upload testing found that server-side content-type validation was insufficient — a fictional test file with a mismatched extension and declared MIME type was accepted — while filename sanitization and storage-location controls were adequate. Download authorization, covered under Access Control above, showed the same missing-ownership-check pattern found in the Critical cross-tenant finding: a file belonging to one fictional tenant was downloadable using a session authenticated to another. Client-side review of the front-end bundle found no DOM-based XSS or exposed production source maps, though residual debug logging was present on a subset of pages. Error-handling review found several endpoints returned verbose exception detail, including internal file paths, on malformed input, rather than a generic client-facing error envelope.

This fictional assessment identified 32 illustrative findings across the NorthStar Commerce Portal, drawn from 87 fictional test cases executed against 34 fictional endpoints (Appendices A–C of the full report). Every finding, severity rating, and evidence reference below is fictional and specific to this web application penetration test — none are drawn from any other TMG sample report.

The full sample PDF plots all 32 fictional findings on a likelihood-versus-impact risk heatmap: the two Critical and six High findings cluster in the "Likely/Almost Certain × Major/Severe" quadrant, the nine Medium findings sit in the mid-range "Possible × Major" band, and the Low findings cluster toward "Rare/Unlikely × Minor" — a distribution that supports prioritizing the authorization and business-logic findings first.

Individual findings are often most meaningful in combination. The report's fictional composite attack-chain scenario illustrates how, starting from a low-privilege authenticated Standard User session, the cross-tenant authorization weakness (TMG-WAPT-001) permits access to another organization's profile object; the excessive API data-exposure finding (TMG-WAPT-007) means that object — and equivalent objects reachable the same way — returns more internal detail than intended; and the business-logic replay weakness in the discount-redemption workflow (TMG-WAPT-017) shows that workflow-state enforcement has gaps elsewhere in the platform. Combined, an attacker following this fictional path could reach cross-tenant data exposure together with a business-logic abuse pattern — a composite illustrative impact more significant than any single finding in isolation. This is a fictional composite scenario and must not be construed as an exploit chain against any real system.

The table below maps each Critical and High fictional finding to the illustrative business dimensions it most directly affects, supporting prioritization conversations beyond pure technical severity.

The fictional sample remediation roadmap sequences all 32 findings across three phases, prioritizing the Critical and High authorization findings first. All dates and timelines shown are illustrative.

The full sample PDF tracks fictional management response, ownership, and validation approach for every finding in a single management action plan, ensuring each of the 32 findings appears exactly once with an owner, priority, target date, status, and validation method. TMG Security recommends a structured retest following remediation: a full retest of both Critical findings and all six High findings, including regression testing across related endpoints; a targeted retest of each Medium finding against its specific affected endpoint or workflow; and a confirmation-only review of Low and Informational items, batched into the next general assessment cycle. This retest methodology is illustrative — this report does not claim that any finding has been remediated or retested.

This fictional assessment is not intended to be entirely negative. TMG Security identified a number of controls operating effectively across the NorthStar Commerce Portal, including functional MFA with single-use recovery codes for privileged roles, appropriate refresh-token rotation and access-token lifetimes, modern password hashing, centralized security logging and monitoring, a baseline cloud-based WAF, effective login-endpoint rate limiting, disallowed deprecated TLS protocols and weak cipher suites, and a documented fictional periodic access-review process for administrator-level accounts.

The following limitations apply to this fictional sample assessment: NorthStar Digital Commerce, Inc. and NorthStar Commerce Portal are fictional and no real organization or application was assessed; no real credentials, cloud credentials, or production systems were used or accessed; no real customer data was accessed at any point; no destructive testing, denial-of-service testing, social engineering, or physical security testing was performed; no real cloud-provider environment or third-party systems were tested; and all evidence, screenshots, and request/response examples referenced in the full report are synthetic.

Looking to validate your own web application's authentication, authorization, and business-logic security? TMG Security's Web Application Security Testing team can scope a real web application penetration test built with the same structure, methodology, and reporting depth shown in this sample — attack-surface mapping, authenticated role-based testing, manual vulnerability validation, a full finding register, and a remediation roadmap your engineering team can execute against. TMG's offensive security practice also covers API Security Testing and the broader Offensive Security & Penetration Testing program this assessment type sits within. For a conceptual reference on common testing categories, see TMG's OWASP Top 10:2025 quick reference for penetration testers.