Hi everyone, in this article, I’ll walk through a recent penetration test I conducted against a web application. As usual, we’ll cover:

• The application overview
• The high-level architecture
• The vulnerability
• The exploit

This assessment was conducted as a black-box test, meaning no source code access, no architectural documentation, and no internal visibility — only what an external attacker would see.

Application overview

Let’s refer to the company as A.Corp.

A.Corp maintained an internal web application used by thousands of employees worldwide. For security reasons, the application was only accessible to users connected to the corporate network.

The application supported more than ten user roles, including Basic, Regular, Manager, Senior Manager, Admin, Super Admin, and others. Each role had different levels of permissions and access to system functionality.

High Level Architecture

Employees accessed the web application through Single Sign-On (SSO). The internal SSO system was integrated with Amazon Cognito, effectively creating a tightly coupled authentication flow between the corporate…