₦airaland Forum

Hello everyone,

Over the past few weeks, I challenged myself to perform a complete penetration test on VulnBank, an intentionally vulnerable online banking application created for security training.
Rather than simply identifying vulnerabilities, I documented the entire assessment process, from reconnaissance and testing methodology to exploitation, business impact, and remediation.
Some of the issues uncovered during the assessment include:

- Weak JWT implementation
- Broken Object Level Authorization (BOLA)
- Broken Object Property Level Authorization (BOPLA)
- SQL Injection
- Cross-Site Scripting (XSS)
- Race Conditions
- Mass Assignment
- GraphQL security misconfigurations
- Server-Side Request Forgery (SSRF)
- Business Logic vulnerabilities
- File upload security issues
- Information disclosure
- Virtual card security flaws
- Bill payment vulnerabilities
- Session management weaknesses.

The article contains actual HTTP requests and responses, payloads where applicable, screenshots of the findings, impact analysis, and practical remediation recommendations. It is intended for cybersecurity professionals, developers, students, and anyone interested in understanding how modern web applications are assessed from an attacker's perspective.

A special thanks to Al-Amir Badmus, the creator of VulnBank, for building such a realistic learning platform for the cybersecurity community.

You can read the complete walkthrough here:
Medium:

https://medium.com/@akwaezeodera/breaking-vulnbank-a-complete-web-application-penetration-testing-walkthrough-dcc618cb25ca

I'd genuinely appreciate your feedback, questions, or suggestions. If you're also learning penetration testing or application security, let's connect and learn together.

Thank you for reading.