Securing a Legacy Multi-Role Client Portal Through Comprehensive VAPT | Nextwebi

Client Overview

Consero Global is a finance technology and services company that provides Finance as a Service (FaaS), Flex Finance and advisory solutions for middle-market and growth-stage businesses. Its offering combines finance professionals, technology and streamlined processes to improve financial visibility and operational scalability. For this project, Nextwebi focused on strengthening the security posture of Consero Global's client-facing portal through Vulnerability Assessment and Penetration Testing (VAPT) and comprehensive web application security testing.

Case Study

Vulnerability Assessment and Penetration Testing for Consero Global's Client Login Portal

A Black Box and Grey Box penetration testing engagement designed for a cloud-hosted legacy web application with multiple user roles and exposed application interfaces.

Engagement TimelineFour Weeks

MethodologyTwo Phases

User Roles TestedFive Roles

Risk ScoringCVSS v3.1

The Challenge

Consero Global's client login portal operates as a cloud-hosted legacy web application with multiple user roles and exposed application interfaces. The portal supports Super Admin, Admin, Manager, Client User and Internal User roles, creating a complex security environment where authentication, authorization, session management and data isolation must work consistently across different privilege levels.

The legacy nature of the platform introduced an additional layer of security complexity. Modern frameworks often provide security controls by default, while older applications may retain legacy components, outdated libraries, weak session mechanisms or application-level controls that require deeper manual validation.

Nextwebi was engaged to conduct a comprehensive Vulnerability Assessment and Penetration Testing engagement that could evaluate the application from both an external attacker's perspective and an authenticated insider perspective. The assessment was designed to examine the complete exposed attack surface while maintaining operational continuity.

Security Objectives

The engagement was structured around several key objectives:

Identify vulnerabilities that could be exploited by an unauthenticated external attacker.
Assess authentication mechanisms and session management controls.
Validate role-based access control across all defined user roles.
Identify horizontal and vertical privilege escalation opportunities.
Test APIs and authenticated endpoints for authorization weaknesses.
Examine legacy-specific vulnerabilities and outdated technology components.
Evaluate business logic and workflow controls.
Assess input validation against injection-based attacks.
Identify information disclosure and security misconfiguration issues.
Provide prioritized remediation guidance based on technical severity and business impact.

The assessment specifically focused on login functionality, exposed application interfaces, session management, user-role boundaries and API attack surfaces.

Nextwebi's VAPT Approach

Nextwebi designed a two-phase web application penetration testing methodology to provide progressive security coverage.

Phase 1

Black Box Penetration Testing

The first phase simulated a real-world external threat actor with no prior knowledge of the application's architecture or credentials.

The assessment covered:

Reconnaissance and Attack Surface Discovery

Nextwebi planned passive reconnaissance through:

WHOIS and DNS analysis
Subdomain enumeration
OSINT collection
HTTP header analysis
Server and technology fingerprinting
SSL/TLS certificate inspection
Historical endpoint discovery

Active reconnaissance then extended the attack surface mapping through web crawling, directory enumeration, hidden endpoint discovery, parameter identification and error-response analysis.

Unauthenticated Security Testing

The external attack simulation included automated vulnerability scanning followed by manual verification. Testing covered authentication bypass attempts, SQL injection, cross-site scripting, input fuzzing and discovery of exposed administration panels, configuration files and backup resources.

This combination of automated scanning and manual penetration testing was designed to reduce false positives while validating the practical exploitability of security weaknesses.

Phase 2

Grey Box Application Security Testing

The second phase introduced authenticated testing using client-provided credentials for the defined user roles.

Nextwebi planned independent testing across:

Super Admin → Admin → Manager → Client Users → Internal Users

This allowed the security team to validate authorization boundaries from multiple privilege levels instead of testing only the standard user journey.

Role-Based Access Control Testing

The assessment included an access-control matrix to verify that every role could access only its permitted functions.

Testing covered:

Horizontal privilege escalation
Vertical privilege escalation
Forced browsing
Function-level authorization bypass
API authorization failures
Mass assignment
Unauthorized access to administrative functions
Cross-user data exposure
IDOR across different user boundaries

The approach was particularly important for the portal because the application serves both client-facing and internal users.

Comprehensive Web Application Penetration Testing

The security testing strategy covered modern web application vulnerabilities alongside weaknesses commonly associated with legacy platforms.

Authentication and Session Security

Nextwebi's web application security testing covered authentication mechanisms such as:

Brute-force and credential-stuffing resistance
Weak and default credential testing
Username enumeration
Authentication bypass
Password-reset token security
Account lockout controls
MFA bypass testing where applicable
CAPTCHA circumvention
Persistent login and remember-me functionality

Session management testing included token randomness, session fixation, session hijacking, concurrent sessions, logout invalidation, idle-session timeout and secure cookie configuration.

Cookie security was evaluated through checks for Secure and HttpOnly attributes, cookie scope and domain restrictions and possible cross-window or cross-tab session leakage.

SQL Injection and Input Validation

A major component of the application security assessment was injection testing.

The test strategy covered:

Classic SQL injection
Boolean-based SQL injection
Time-based SQL injection
Out-of-band SQL injection
Second-order SQL injection
Stored procedure injection
Error-based SQL injection
SQL injection through HTTP headers
Legacy ORM and raw-query endpoints

Cross-site scripting testing covered reflected XSS, stored XSS, DOM-based XSS and XSS delivered through HTTP headers.

Additional injection vectors included LDAP injection, command injection, XXE, SSTI, NoSQL injection, HTTP header injection and CSV/formula injection where applicable.

Legacy Application Security Testing

Legacy applications require security testing beyond the standard OWASP checklist.

Nextwebi incorporated dedicated legacy-platform testing to identify risks associated with outdated frameworks, libraries and implementation patterns.

The assessment included checks for:

Outdated frameworks and libraries
Known CVEs
Insecure deserialization
Exposed .bak, .old, .config and .log files
Directory listing
Deprecated HTTP methods
Legacy encryption algorithms
Unencrypted HTTP endpoints
Predictable session identifiers
Session tokens exposed through URLs
ViewState security where applicable
Legacy CSRF implementations
Open redirects
Weak SSL/TLS configurations

This approach ensured that the VAPT services engagement did not rely solely on modern application-security assumptions.

API Security Testing

Since APIs exposed by the application were included within the assessment scope, Nextwebi incorporated authenticated API security testing into the Grey Box phase.

The testing focused on:

API endpoint authorization
Object-level authorization
IDOR vulnerabilities
Token manipulation
Role-based API access
Parameter tampering
Authentication bypass
Excessive data exposure
Unauthorized API functionality
File upload and download controls

Special attention was given to API endpoints accessed through valid authentication tokens because API authorization weaknesses can allow attackers to bypass front-end restrictions and directly interact with protected application resources.

Business Logic and File Security Testing

Technical vulnerabilities are not the only risks within enterprise applications. Nextwebi's penetration testing services also covered application workflows and business logic.

The assessment included testing for:

Workflow bypass
Mandatory-step circumvention
Parameter tampering
Negative-value manipulation
Boundary-condition failures
Race conditions
Approval workflow weaknesses
Unvalidated redirects
Data integrity violations

File upload functionality was also assessed for malicious file uploads, MIME and extension validation bypass, path traversal, unauthorized file access, archive bombs, file overwrites and metadata exposure.

Security Misconfiguration and Information Disclosure

The assessment evaluated common configuration weaknesses that can expose sensitive technical information or increase the application's attack surface.

Testing included:

HTTP security headers
Content Security Policy
HSTS
Verbose error messages
Stack traces
Application version disclosure
Debug and development endpoints
Credentials or API keys exposed in JavaScript
robots.txt and sitemap enumeration
Exposed Swagger or API documentation

These checks complemented vulnerability exploitation by identifying security-hardening opportunities that support a stronger application security posture.

Technology and Security Testing Arsenal

Nextwebi used an industry-standard security testing toolkit designed to combine automated discovery with manual validation.

Primary Security Testing Tools

Burp Suite Professional

web proxy, request interception, vulnerability analysis, session testing and exploitation

OWASP ZAP

automated web vulnerability scanning and application crawling

Nmap / NSE

port discovery, service detection and vulnerability identification

Nikto

web server and legacy configuration analysis

SQLMap

SQL injection detection and validation

Metasploit Framework

CVE validation and proof-of-concept exploitation

testssl.sh

SSL/TLS protocol and cipher analysis

Dirsearch / ffuf

endpoint discovery and parameter fuzzing

XSStrike

advanced XSS testing

AuthMatrix / Autorize

authorization and role-boundary testing

The assessment also incorporated specialist tools such as Subfinder, Amass, Wappalyzer, theHarvester, Shodan, Censys, Waybackurls, Retire.js, ViewState Decoder, Commix, tplmap, ExifTool and OpenSSL for reconnaissance and legacy application testing.

Subfinder Amass Wappalyzer theHarvester Shodan Censys Waybackurls Retire.js ViewState Decoder Commix tplmap ExifTool OpenSSL

Risk-Based Vulnerability Assessment

Nextwebi's vulnerability assessment services use CVSS v3.1 as the core technical scoring framework while incorporating business impact, exploitability and data sensitivity.

The planned risk classification was:

The assessment considers attack vector, attack complexity, privileges required, user interaction, scope and confidentiality, integrity and availability impacts. Nextwebi also applies business context based on the sensitivity of the platform's data, its multi-role architecture and its legacy technology profile.

Risk Level	CVSS v3.1
Critical	9.0 – 10.0
High	7.0 – 8.9
Medium	4.0 – 6.9
Low	2.0 – 3.9
Informational	0.0 – 1.9

Technical Reporting and Remediation

A key objective of the engagement was to turn vulnerability discovery into actionable security improvements.

Nextwebi planned two primary deliverables.

Management Summary Report

Designed for management and risk stakeholders, the report provides:

Overall security posture
Risk scorecard
Vulnerability distribution
Business impact of major findings
Prioritized remediation roadmap
Compliance relevance
Assessment methodology
Security maturity perspective

Technical VAPT Report

Designed for development and security teams, the technical report provides:

Detailed vulnerability descriptions
Root-cause analysis
Proof-of-concept reproduction steps
Screenshots and request/response evidence
CVSS v3.1 scoring
CWE and CVE references
Affected endpoints and parameters
Affected user roles
Risk distribution
Technical remediation guidance
Retesting guidance

This reporting structure allows decision-makers to understand business risk while giving technical teams the information required to remediate individual vulnerabilities.

Rapid Critical Vulnerability Escalation

Nextwebi incorporated a defined escalation mechanism for urgent findings.

Any Critical or High severity vulnerability identified during the assessment was planned to be communicated to the client within 24 hours of discovery.

The alert would include the vulnerability description, affected component, CVSS rating, business impact, proof-of-concept evidence, immediate remediation guidance and escalation information.

This approach helps security teams respond to severe application vulnerabilities before the final assessment report is delivered.

Project Execution Timeline

The VAPT engagement was structured across four weeks.

Week 1
Project kickoff, rules of engagement, scope confirmation and passive reconnaissance.
Week 1–2
Black Box penetration testing with active reconnaissance, attack-surface mapping, vulnerability assessment and manual testing.
Week 2
Initial findings compilation, false-positive validation and risk classification followed by Black Box report delivery.
Week 2
Grey Box kickoff with validation of credentials across the defined user roles.
Week 3
Authenticated testing covering access control, session management, business logic, API security and legacy-specific vulnerabilities.
Week 3–4
Findings analysis, cross-role impact assessment and technical report preparation.
Week 4
Combined final management and technical report delivery.
Post-assessment
Optional retesting of remediated Critical and High vulnerabilities along with a technical debrief for development and security teams.

Expected Security Outcomes

The engagement was designed to give Consero Global a structured understanding of its client portal's security exposure from both external and authenticated perspectives.

The planned outcomes included:

Greater visibility into the external attack surface
Stronger authentication and session security
Improved role-based access control validation
Identification of horizontal and vertical privilege escalation risks
Improved API authorization security
Detection of SQL injection and XSS attack vectors
Identification of legacy application weaknesses
Improved SSL/TLS and security-header configuration
Better visibility into business logic vulnerabilities
Prioritized remediation based on CVSS and business impact
Actionable guidance for development and security teams
A foundation for recurring vulnerability assessments and penetration testing

The engagement was also designed to support a more proactive application security lifecycle by combining vulnerability discovery with remediation guidance and optional retesting.

Why Nextwebi for VAPT and Penetration Testing?

Nextwebi combines ethical hacking expertise with structured application security testing to assess modern and legacy environments from realistic attacker perspectives.

The methodology aligns with recognized security practices including OWASP Testing Guide v4.2, PTES, NIST SP 800-115, CVSS v3.1, CWE/CVE and SANS Top 25.

For complex enterprise applications, Nextwebi's approach goes beyond automated vulnerability scanning. Manual exploitation, role-based authorization testing, business logic analysis, API security testing and legacy-specific assessment are combined to identify weaknesses that automated tools alone may miss.

The result is a security assessment that connects technical vulnerabilities with their potential business impact and provides development teams with clear remediation direction.

OWASP Testing Guide v4.2 PTES NIST SP 800-115 CVSS v3.1 CWE/CVE SANS Top 25

Project Summary

Consero Global's client portal required a security assessment capable of addressing both modern web application threats and the additional risks associated with a legacy multi-role platform. Nextwebi designed a comprehensive VAPT engagement that combined Black Box and Grey Box penetration testing with manual security validation, role-based authorization testing, API security assessment, business logic analysis and legacy application testing.

The engagement was structured around recognized security methodologies and industry-standard testing tools while maintaining a clear focus on actionable remediation. Through this approach, Nextwebi positioned the assessment as more than a vulnerability scan by creating a structured path from attack-surface discovery and exploit validation to risk prioritization, technical remediation and optional retesting.

Ready to discuss your project with us?

Let's talk about how we can craft a user experience that not only
looks great but drives real growth for your product.!

Let's Start

Measurable Growth Delivered

Industry-Specific Strategies

Data-Driven Decision Making

Long-Term Client Partnerships