Pentesting that never resets
Neo signs in to the running app as every role, proves each finding with a working exploit, retests every fix after it ships, and carries what it learned into the next run.
Tests as every role. Signed-out, member and admin, through the real sign-in, on every authenticated route.
RunsPentest checkout.acme.com
Crawling
Session
Targetcheckout.acme.com
AccountQRqa-reviewer@acme.com
Sign-inOkta SSO with TOTP
Rolesmemberadminsigned-out
Coverage
- GET/login
- POST/api/auth/session
- GET/account/orders
- GET/api/orders/{id}/invoice
- POST/api/cart/apply-coupon
- POST/api/orders/{id}/refundadmin
- GET/admin/couponsadmin
- POST/api/auth/reset
- GET/api/me/export
checkout.acme.com/account/orders
GET /api/orders/1041/invoice as member
Signed in as qa-reviewer
Role member, switching to admin next
Chains findings into one proven exploit. A leaked reset token becomes account takeover, with evidence for each hop.
IssuesAccount takeover via password reset
CriticalValidated
Attack chain
Reset link accepts any redirect_uriGET /auth/reset?redirect_uri=…
Admin's token leaks in RefererReferer: …/reset?token=rt_5c1…e9a
Leaked token completes the resetPOST /api/auth/reset
Account takeoveradmin@acme.com, role admin
checkout.acme.comhop 3 of 4Open
1POST /api/auth/reset HTTP/2
2{ "token": "rt_5c1…e9a", "password": "…" } // admin's token from hop 2
3HTTP/2 200 OK
4set-cookie: session=eyJhbGci…; Secure; HttpOnly
5{ "user": "admin@acme.com", "role": "admin" }
- HOP 1
- HOP 2
- HOP 4
Reproduction
- 1.
- 2.
- 3.
Finds flaws in your business logic. Coupons that stack, invoices other tenants can read, proven request by request.
IssuesRace condition in coupon redemption
Subscribed···
ISSUE-2041
Race condition in coupon redemption
SeverityHigh
AssigneePRPriya Raman
StatusValidated
Targetcheckout.acme.com/api/cart/apply-coupon
RegressionYes
First seen36 minutes ago
Last seenJust now
Evidence3 exchanges
ActivityEvidenceRetests
checkout.acme.comapply-coupon, 3 parallel requests, one cartOpen
1POST /api/cart/apply-coupon HTTP/2
2host: checkout.acme.com
3cookie: session=eyJhbGci…
4
5{ "code": "WELCOME20", "cart_token": "ct_9f2…41a" } // sent ×3, same instant
6
7HTTP/2 200 OK
8{ "applied": ["WELCOME20", "WELCOME20", "WELCOME20"],
9 "total": 0.00, "was": 128.00 }
Verifier: reproduced 5 of 5.
Retests every fix after it ships. The original exploit replays against the patch, then variants try to get past it.
IssuesRace condition in coupon redemption
Retesting
ActivityEvidenceRetests
Fix PR acme/checkout#482 merged, retested 14 min later
- OriginalThe finding’s exploit, replayed as-is3 parallel requestsBlocked
- VariantCode case-flippedwelcome20 and Welcome20Blocked
- VariantSplit across two cartssame sessionBlocked
- VariantReplay after partial refundredeem, refund, redeemBlocked
- Sibling/api/cart/apply-gift-cardsame patternRetesting
Fix holds for ISSUE-2041.
Response before and after
1HTTP/2 200 OK
2{ "applied": ["WELCOME20", "WELCOME20", "WELCOME20"],
3 "total": 0.00 }
2{ "applied": ["WELCOME20"],
3 "rejected": [{ "reason": "already_redeemed" }, …] }
Remembers last quarter. Architecture, roles, business logic and every prior finding carry into the next run.
Projectscheckout.acme.comRuns
TimelineFindingsReport
Q4 ’25
Routes known42
New findings11
Fixed and retested0
Regressed—
Q1 ’26
Routes known61
New findings6
Fixed and retested9
Regressed1
Q2 ’26
Routes known74
New findings4
Fixed and retested6
Regressed—
Q3 ’26Today
Routes known89
New findings2
Fixed and retested3
Regressed—
routes knownopen issues
Q4 ’25Q1 ’26Q2 ’26Q3 ’26
Proven before you see it. A verifier reproduces each claim, runs fit your cadence, and CVEs are covered in hours.
Trusted by security teams