External Web Portal Pentest Prevented Account Takeover Paths
The Problem
The client was onboarding larger customers and needed confidence their public portal couldn’t be compromised through common web and authentication weaknesses.
Outcome
Closed multiple realistic routes to account takeover and data leakage before enterprise onboarding
Quick Facts
Client type: Mid-sized B2B SaaS platform (customer portal)
Timeline: 5–7 days testing + retest
Testing type: Web App + API pentest (auth + roles)
Approach: Manual testing + validation of automated findings
What Wolfcore did:
- Mapped the application and API attack surface (including hidden and legacy routes)
- Tested authentication heavily: login, password reset, OTP/verification flows, session handling
- Tested authorization across roles: forced browsing, parameter tampering, IDOR patterns
- Assessed browser and transport controls: cookie flags, headers, and policy gaps
- Risk-rated findings by exploitability and business impact
Key findings (examples)
- Insecure direct object reference allowing access to another user’s invoice data via
predictable IDs - Missing rate limiting on a login-related endpoint enabling credential stuffing
attempts - Overly permissive CORS behaviour on a specific API route increasing exposure in
browser-based attack paths - Weak session invalidation after password change
Impact
- Reduced risk of account takeover and sensitive data exposure
- Gave engineering a clear, prioritised remediation plan that shipped quickly
- Improved confidence for security questionnaires and enterprise onboarding
Deliverables
- Executive report (non-technical summary + risk)
- Technical report with reproduction steps and evidence
- Prioritised remediation backlog (quick wins first)
- Retest verification after fixes
Want to know if your portal can be abused the same way?
We test the full AI feature: prompts, APIs, tools, data pathways, and the business logic around them — the same places attackers target and we test AI systems as part of the application, not as isolated models.