TrojanStrike

Classified After-Action Report

acme-store.com

VERDICT: BREACHED

TIER: STRIKE QUEUED: 2026-08-14 09:30:00 UTC STARTED: 2026-08-14 09:31:12 UTC FINISHED: 2026-08-14 09:47:03 UTC DURATION: 15m 51s

Executive Summary

The target exhibits one or more critical/high-severity weaknesses that an attacker could exploit to compromise confidentiality, integrity, or availability. Immediate remediation is required.

Severity	Count
CRITICAL	1
HIGH	1
MEDIUM	1
LOW	2
INFO	1
TOTAL	6

Since Last Scan

since last scan: 1 new, 5 persisting, 1 fixed

NEW: Cross-user order receipt access

FIXED: Directory listing exposed at /backups/

Coverage

GRADE: GOOD REQUESTS: 2874/3000 CHECKS: 14 ran · 1 nothing to test · 0 skipped

Check	Outcome	Detail	Requests
crawl	RAN	41 pages, 12 forms, 9 API endpoints mapped	320
tls	RAN	TLS 1.3, valid certificate	2
cookies	RAN	3 cookie(s) across 42 URL(s) — 0 finding(s)	64
headers	RAN	2 finding(s)	3
js-cve	RAN	0 finding(s) — 14 script(s) assessed	210
exposed-files	RAN	baseline 404/18 chars, 39 probes → 0 finding(s)	96
tech-cve	RAN	1 finding(s)	41
dir-probe	RAN	baseline 404/18 chars, 46 paths → 0 finding(s)	128
error-leak	RAN	probed 11 URL(s) → 0 finding(s)	248
reflected-xss	RAN	1 finding(s)	96
dom-xss	RAN	0 finding(s) — 5 page(s) browser-probed	384
sqli	RAN	1 finding(s)	412
idor	RAN	1 finding(s)	118
api-fuzz	RAN	0 finding(s) — 9 endpoint(s) fuzzed	752
cmdi	NOTHING_TO_TEST	0 injection points inside scope	0

Remediation Priority

Severity	Finding	Urgency
HIGH	Cross-user order receipt access	Fix within 24–48 hours
CRITICAL	SQL injection in product search	Fix immediately — active exploitation likely
MEDIUM	Reflected XSS in search results page	Fix before next release
LOW	Missing Cross-Origin-Resource-Policy header on static assets	Address in next sprint
INFO	Technology detected: Next.js 15.1.2	Informational
LOW	X-Powered-By header discloses framework	Address in next sprint

Attack Narrative

Time	Phase	Event
2026-08-14 09:31:12 UTC	SYSTEM	strike accepted — budget 3000 requests at 5 rps, kill switch armed
2026-08-14 09:33:40 UTC	RECON	crawl complete: 41 pages, 12 forms, 9 API endpoints mapped
2026-08-14 09:34:02 UTC	RECON	tech-cve: GET https://acme-store.com/ → 200 — Next.js 15.1.2 fingerprinted
2026-08-14 09:38:15 UTC	PROBE	sqli: error differential on /search?q= — 1 injectable candidate
2026-08-14 09:41:27 UTC	BREACH	sqli: UNION context confirmed, 7 columns — banner extracted read-only
2026-08-14 09:44:51 UTC	BREACH	idor: /api/orders/1042 returned a foreign owner reference — BOLA confirmed
2026-08-14 09:47:03 UTC	VERDICT	BREACHED — 6 finding(s): 1 CRITICAL, 1 HIGH, 1 MEDIUM, 2 LOW, 1 INFO
2026-08-14 09:47:03 UTC	VERDICT	coverage GOOD — 14 ran, 1 nothing-to-test, 0 skipped; 2874/3000 requests
2026-08-14 09:47:03 UTC	VERDICT	since last scan: 1 new, 5 persisting, 1 fixed

Findings

CRITICAL

Fix immediately — active exploitation likely

SQL injection in product search

Identity

#:1

Category:sqli

CWE:CWE-89

CVSS:9.1

Confidence:98%

Status:OPEN

Diff:PERSISTING

Location

URL: https://acme-store.com/search

Field: q

Snippet

GET /search?q=gift' UNION SELECT NULL,version()-- -

Proof

UNION context confirmed (7 columns); database banner extracted read-only: PostgreSQL 15.4 on x86_64-pc-linux-gnu.

Reproduce

curl -H 'Accept: text/html' 'https://acme-store.com/search?q=gift%27%20UNION%20SELECT%20NULL%2Cversion%28%29--%20-'

Description

The search endpoint concatenates the q parameter directly into a SQL query, allowing an attacker to read arbitrary tables — including customer credentials and order history.

Remediation Summary

Use parameterized queries for all database access.

Detailed Fix

Replace string concatenation with bound parameters at every call site. The query builder should never see raw user input — validate and type-check q before it reaches the data layer.

Before

const rows = await db.query(`SELECT * FROM products WHERE name ILIKE '%${q}%'`);

After

const rows = await db.query('SELECT * FROM products WHERE name ILIKE $1', [`%${q}%`]);

References

https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
https://cwe.mitre.org/data/definitions/89.html

Compliance Tags

Tags: OWASP ASVS V5, PCI-DSS 6.5.1

HIGH

Fix within 24–48 hours

Cross-user order receipt access

Identity

#:2

Category:idor

CWE:CWE-639

CVSS:8.2

Confidence:97%

Status:OPEN

Diff:NEW

Location

URL: https://acme-store.com/api/orders/1042

Proof

GET /api/orders/1042 → 200 — authenticated as user A (id 317), response contains user B's order record (owner id 219): customer name, delivery address, and itemized receipt.

Reproduce

curl -H 'Accept: application/json' 'https://acme-store.com/api/orders/1042'

Description

Order receipts are fetched by sequential id with no ownership check. Any authenticated user can read any other customer's order record by incrementing the id.

Remediation Summary

Enforce object-level authorization on every record fetch (CWE-639).

Detailed Fix

Scope every object lookup to the authenticated principal: fetch the order WHERE id = $1 AND user_id = $2, and return 404 (not 403) when no row matches, so ids cannot be enumerated. Apply the same pattern to every id-addressable resource.

References

https://owasp.org/www-project-api-security/ — API1:2023 Broken Object Level Authorization
https://cwe.mitre.org/data/definitions/639.html

Compliance Tags

Tags: OWASP API Top 10, PCI-DSS 7.1

MEDIUM

Fix before next release

Reflected XSS in search results page

Identity

#:3

Category:reflected-xss

CWE:CWE-79

CVSS:6.1

Confidence:90%

Status:OPEN

Diff:PERSISTING

Location

URL: https://acme-store.com/search

Field: q

Proof

Markup canary ts9f3k2 reflected unescaped into the results page HTML — string-delimiter breakout confirmed content-type-aware.

Reproduce

curl -H 'Accept: text/html' 'https://acme-store.com/search?q=ts9f3k2%22%3E%3Csvg%20id%3Dts9f3k2%3E'

Description

The q parameter is reflected into the results HTML without encoding. A crafted link executes script in the victim's session.

Remediation Summary

Encode every reflected value for its output context.

Detailed Fix

HTML-encode q at the template boundary. Never interpolate request parameters into markup without context-aware encoding; add a Content-Security-Policy as defense in depth.

References

https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Compliance Tags

Tags: OWASP ASVS V5

LOW

Address in next sprint

Missing Cross-Origin-Resource-Policy header on static assets

Identity

#:4

Category:headers

CWE:CWE-942

Status:OPEN

Diff:PERSISTING

Location

URL: https://acme-store.com/assets/logo.png

Evidence

GET /assets/logo.png → 200 without CORP

Description

Static images are served without Cross-Origin-Resource-Policy, leaving them loadable cross-origin (Cross-Site Imaging).

Remediation Summary

Serve Cross-Origin-Resource-Policy: same-origin on static assets.

Detailed Fix

Next.js: set security headers centrally in next.config via the headers() function (or in middleware for dynamic cases) so every route — including API routes and RSC payloads — is covered.

After

// next.config.ts
const securityHeaders = [
  { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },
  { key: "Content-Security-Policy", value: "default-src 'self'; object-src 'none'; frame-ancestors 'none'" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
];

export default {
  async headers() {
    return [{ source: "/:path*", headers: securityHeaders }];
  },
};

LOW

Address in next sprint

X-Powered-By header discloses framework

Identity

#:5

Category:headers

CWE:CWE-200

Status:OPEN

Diff:PERSISTING

Location

URL: https://acme-store.com/

Evidence

X-Powered-By: Next.js

Description

The X-Powered-By response header reveals the application framework, narrowing an attacker's reconnaissance.

Remediation Summary

Remove the X-Powered-By header from all responses.

Detailed Fix

Next.js: set security headers centrally in next.config via the headers() function (or in middleware for dynamic cases) so every route — including API routes and RSC payloads — is covered.

After

// next.config.ts
const securityHeaders = [
  { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },
  { key: "Content-Security-Policy", value: "default-src 'self'; object-src 'none'; frame-ancestors 'none'" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
];

export default {
  async headers() {
    return [{ source: "/:path*", headers: securityHeaders }];
  },
};

INFO

Informational

Technology detected: Next.js 15.1.2

Identity

#:6

Category:tech-cve

Status:OPEN

Diff:PERSISTING

Location

URL: https://acme-store.com/

Evidence

self.__next_f RSC payloads, /_next/static/ asset URLs

Description

The runtime fingerprints as Next.js 15.1.2 (App Router markers). No known CVEs in the curated database apply to this version.

Remediation Summary

Keep the framework updated as patches ship.