HackSmarter Web App Pentest — Capstone

Overview

Web application penetration test conducted against the HackSmarter e-commerce ecosystem. Assessment performed systematically across reconnaissance, authentication, session management, authorization, server-side attacks, and client-side attacks. Target evaluated from the perspective of a guest, standard user, and administrator.

All findings include evidence, severity ratings, and remediation guidance.

Target: HackSmarter Store — 10.1.68.47 (Port 80) Timeframe: March 22–29, 2026

Findings Summary

Critical Findings

SQL Injection — Product Search

Single quote entered in search bar at /store.php returned a raw database error confirming error-based SQLi. MySQL backend confirmed. Raw SQL errors exposed to users in production.

Remediation: Parameterized queries/prepared statements. Disable SQL error display in production.

SQL Injection — UNION-Based Data Extraction

SQLMap confirmed injectable via boolean-based blind, error-based, time-based blind, and UNION query (7 columns). Databases extracted: hacksmarter, information_schema, mysql, performance_schema, sys. Access to the mysql system database confirms potential for full server compromise.

Remediation: Parameterized queries. Remove raw SQL error output from production.

Full User Table Extraction via SQLi

Complete users table extracted via SQLMap. Data exposed: user IDs, emails, password hashes, admin flags, registration dates, profile picture paths.

Remediation: Parameterized queries. Principle of least privilege on DB user.

Remote Code Execution via Unrestricted File Upload

/admin/settings.php accepts file uploads for site logo. Extension filtering bypassed by appending PHP webshell code to a legitimate JPG. File uploaded to /uploads/logos/shell.jpg. Upload directory publicly accessible and browseable. Full RCE achievable by an attacker with admin access.

Remediation: Whitelist allowed file types server-side. Validate file content, not just extension. Store uploads outside webroot or configure Apache to not execute scripts in upload directories.

High Findings

Stored XSS — Multiple Injection Points

<script>alert(1)</script> confirmed in blog comments, forum comments, and feedback form. Payload persists and executes for all users who view the content. Admin panel renders feedback — high risk of admin session theft via document.cookie.

Remediation: Sanitize and encode all user input before storage and output. Implement CSP header.

Insecure Session Cookie — Missing HttpOnly and Secure Flags

PHPSESSID cookie lacks HttpOnly and Secure flags. Cookie accessible via document.cookie in JavaScript. Combined with Stored XSS, attacker can steal session tokens. Transmitted over HTTP with no encryption.

Remediation: Set HttpOnly and Secure flags on all session cookies. In PHP: session.cookie_httponly = 1 and session.cookie_secure = 1 in php.ini.

Broken Access Control — Restricted/Unreleased Products

product_id=5 (region-restricted) and product_id=6 (unreleased) successfully added to cart via parameter manipulation. Server performs no validation against region restrictions or release status at the cart endpoint.

Remediation: Enforce server-side validation on all product_id values. Check is_available_in_region and is_released flags before allowing cart addition.

Medium Findings

Blind SSRF via Avatar URL Import

Profile page "import via URL" feature accepts http://127.0.0.1. Server confirmed the request was processed — making outbound requests to attacker-controlled URLs without validation.

Remediation: Validate and whitelist allowed URL schemes and hosts. Block requests to internal/private IP ranges.

Weak Default Credentials

admin:admin123 and user:password are trivially guessable.

Remediation: Enforce strong password requirements, rotate defaults before deployment.

Weak Password Reset Code

4-digit numeric reset code used — only 10,000 combinations.

Remediation: Minimum 6 digits, short expiry, single-use invalidation.

No Multi-Factor Authentication

No MFA present at login or account settings.

Remediation: Implement TOTP or email/SMS MFA.

Session Not Invalidated on Password Change

Replayed old session after password change — 200 OK returned. Session remained valid.

Remediation: Invalidate all sessions on password change.

Session Fixation

PHPSESSID identical pre and post login. Server did not issue new session ID on authentication.

Remediation: Issue new session ID on login, invalidate pre-login session.

Password Change Without Current Password Verification

Password changed without providing current password. Session hijacker can permanently lock out the legitimate user.

Remediation: Require current password verification before change.

Email Change Without Current Password Verification

Email changed without providing current password. Session hijacker can redirect account recovery to attacker-controlled address.

Remediation: Require current password verification before change.

PHP Error Display Enabled in Production

Full server path /var/www/html/hacksmarter.hsm/ leaked via PHP warning in production.

Remediation: Set display_errors = Off in php.ini for production. Log errors server-side only.

CSRF — Broken Token Implementation

POST /update_profile.php contains a csrf_token parameter. Token changed to abc123 — server returned 200 OK. Token present but not validated server-side.

Remediation: Validate CSRF token server-side on every state-changing request. Reject requests with missing or invalid tokens with 403.

Clickjacking — Missing X-Frame-Options and CSP Headers

No X-Frame-Options or Content-Security-Policy: frame-ancestors directive present. Site can be embedded in an attacker-controlled iframe.

Remediation: Add X-Frame-Options: DENY or Content-Security-Policy: frame-ancestors 'none'.

Directory Listing Enabled on Upload Directories

/uploads/, /uploads/avatars/, /uploads/logos/ all return Apache directory listings. Exposes all uploaded files to unauthenticated users.

Remediation: Add Options -Indexes to Apache config or .htaccess.

Low Findings

Web Server Version Disclosure

Server: Apache/2.4.56 and X-Powered-By: PHP/8.0.30 exposed via response headers and 404 error page.

Remediation: ServerTokens Prod, expose_php = Off, custom 404 page.

Sensitive Directory Exposure

/api/, /config/, /uploads/, /test/ accessible with directory listing or sensitive content exposed.

Remediation: Disable directory listing. Restrict access to sensitive paths via Apache config.

CI/CD Build Log Exposed

/test/build_log.txt publicly accessible. Leaks deployment path, CI/CD platform (GitHub Actions), and reference to dev.hacksmarter.hsm.

Remediation: Remove build artifacts from webroot. Restrict /test/ directory.

Dev Subdomain Referenced in Build Log

dev.hacksmarter.hsm referenced in build log. Host unreachable but existence disclosed.

Remediation: Scrub internal references from publicly accessible files.

Username Enumeration — Login Page

Valid user returns "Incorrect password." — invalid user returns "User not found."

Remediation: Generic message for all failures: "Invalid username or password."

Username Enumeration — Registration Page

Registering an existing username returns "That username is already taken."

Remediation: Generic failure message that does not confirm username existence.

Weak Password Policy

Single character password accepted via intercepted request. No server-side validation.

Remediation: Server-side minimum 8 characters per NIST guidelines.

No Rate Limiting — Registration

194 automated requests completed with no throttling, blocking, or CAPTCHA.

Remediation: Rate limiting, account lockouts, or CAPTCHA after repeated requests.

HTML Injection

<h1>TEST</h1> submitted via forum reply renders as formatted HTML.

Remediation: Encode all user-supplied output using htmlspecialchars() or equivalent. Implement CSP.

Session Not Invalidated on Email Change

Replayed old session after email change — 200 OK returned.

Remediation: Invalidate all sessions on email change.

Debug Information Exposure in API Response

POST /api/forum/post.php returns "debug_info": "Posted as User ID: 1". Internal user ID exposed in production API response.

Remediation: Disable debug output in production.

Server Path Disclosure

Full path /var/www/html/hacksmarter.hsm/ leaked via PHP warning.

Remediation: Disable error display in production.

Strengths Noted

• Password Reset No Enumeration — Generic message and identical response times for valid and invalid emails.
• Session Invalidated on Logout — Old session correctly destroyed server-side after logout.
• Admin Panel Access Control — /admin/settings.php correctly restricted to admin role only.
• Passwords Stored as Bcrypt — $2y$10$ bcrypt hashing confirmed. Passwords not stored in cleartext.
• CORS Not Misconfigured — No Access-Control-Allow-Origin returned for untrusted origins.
• Open Redirect Protection — next parameter restricted to relative paths only.