Avertium expert-led web app penetration testing chained username and Social Security number exposure, an OTP bypass, and excessive account privileges into a realistic path to financial fraud.

STORY AT A GLANCE

  • Industry: Banking and Financial Services

  • Engagement: Web application penetration test of a third-party vendor

  • Introduction: A financial organization engaged Avertium to assess its external attack surface. By comparing the behavior of three VPN portals and validating subtle authentication differences, Avertium uncovered critical vulnerabilieis that could have enabled unauthorized access.

  • Challenge: Determine whether the application exposed exploitable weaknesses beyond the authenticated workflows provided for testing

  • Discovery: Valid usernames and Social Security numbers could be brute-forced and matched to reveal a user ID 

  • Attack Path: The exposed user ID enabled the tester to bypass the one-time password mechanism, obtain a session token, and access the application as another user

  • Business Impact: The compromised account could manage other users’ accounts, including initiating transfers or withdrawals 

  • Differentiator: The finding required human-led, context-aware testing and the chaining of multiple weaknesses that automated scanning would be unlikely to reproduce 

The Challenge

A bank engaged Avertium to assess the security of a third-party vendor’s web application. The web app pen testing needed to determine not only whether the supplied user workflows were secure, but also whether an attacker without credentials could discover a path into customer accounts.

Although the penetration tester was given credentials to evaluate authenticated functionality, Avertium expanded the assessment to include an unauthenticated perspective. That broader view proved essential: The most consequential risk was not a single obvious flaw, but a sequence of weaknesses that could be combined into an account-takeover path.

 

The Solution

Avertium’s security analyst tested how the application responded to unauthenticated requests and discovered that valid usernames could be brute forced. The analyst then identified a second exposure: valid Social Security numbers could also be brute forced. By correlating the two results, the analyst successfully matched a Social Security number to a username and caused the application to return a valid user ID.

 

CHAINING THE ATTACK PATH

  1. Enumerate valid usernames: The application revealed whether tested usernames were valid.
  2. Identify valid Social Security numbers: A second brute-force condition exposed valid SSNs.
  3. Correlate identity data: Matching a valid SSN to a username returned the associated user ID.
  4. Bypass one-time password protection: A misconfiguration allowed the tester to use the valid user ID to bypass the OTP mechanism and obtain a session token.
  5. Access the application as the user: The session token granted access to the compromised account.
  6. Reach other customer accounts: The compromised account’s management capabilities allowed actions affecting other users, including transferring or withdrawing money.

 

WHY THE FINDING MATTERED

  • Sensitive identity data became part of the attack chain. Individually, username and SSN enumeration were serious exposures; together, they enabled the discovery of a valid user ID.
  • OTP did not stop unauthorized access. The application’s configuration allowed the tester to bypass the intended verification step and obtain a valid session.
  • The resulting access extended beyond one account. Account-management functionality created the potential for activity affecting additional users and financial transactions.
  • The risk was difficult to detect with automation alone. Reproducing the attack required persistence, contextual understanding, and the ability to connect multiple behaviors across the application 

 

CUSTOMER VALUE AND THE AVERTIUM DIFFERENCE

Avertium's web application penetration test gave the bank a clear picture of how separate application weaknesses could combine into a high-impact account-takeover scenario. The assessment moved beyond listing isolated vulnerabilities to demonstrate the full path an attacker could follow—from unauthenticated discovery to access that could affect other users and financial transactions.

The customer valued the depth of the findings, particularly because a previous assessment by another reputable firm had not identified the same issues. The engagement demonstrated why expert-led penetration testing is critical for applications that handle sensitive identity and financial data: automated scanners can surface individual technical signals, but experienced testers interpret those signals, challenge expected workflows, and connect weaknesses into realistic business risk.

Looking to uncover the attack paths automated testing may miss?   Contact Avertium to discuss an expert-led web application penetration test.
penetration testing penetration test Fintech third-party security Web Application Penetration Test Blog