We performed penetration testing of a corporate website, covering input validation, access control and security configuration.
Project overview
Objective
Identify security risks and areas for improvement in a corporate website
Scope
Input validation · Access control · Security configuration
Deliverables
A report documenting reproduction steps, impact on the service and remediation recommendations for each vulnerability
Checking where security settings take effect.
We tested HTTP-to-HTTPS redirects and HSTS headers separately. We compared responses from multiple pages and static files, and documented recommendations on consistent configuration coverage and relevant precautions.
The report provided reproduction evidence, including input validation and access control checks. Below are the HSTS analysis that can be shared publicly and anonymised report excerpts.
Client and product identifiers have been removed. Technical examples have been reconstructed for explanation and reflect observations made during a past assessment. They do not indicate the client's current security status or whether remediation has been completed.
Assessment details
Select an item to review the assessment process and technical evidence.
HTTPS and HSTS configuration＋
04WEB CONFIGURATION / HTTPS · HSTSAnonymised reconstructed case
HTTPS redirects were in place, but HSTS was missing.
HTTP requests were redirected to HTTPS, but the HSTS header instructing browsers to use HTTPS was not configured.
Risk and impact
Where an attacker can interfere with network traffic, the initial HTTP connection may be tampered with. We classified this as a configuration measure to complement the existing HTTPS redirect.
Assessment method
We examined responses from multiple web pages and static files to compare HSTS header coverage. We distinguished the configuration of external services from the website's own protection settings.
Remediation guidance
We recommended applying HSTS consistently at the web server or proxy. Before extending it to subdomains, we advised checking that all affected services support HTTPS.
RETEST CRITERIA
Retest criteria
Check that the configuration applies to pages and static files. Also verify the existing HTTP-to-HTTPS redirect behaviour.
Assessment report
How we document assessment findings.
An anonymised Korean-language excerpt following the format of an actual assessment report. It includes an executive summary, vulnerability analysis and remediation recommendations.
