An end-to-end application-security project covering the whole testing pyramid: a black-box penetration test of a vulnerable web application, static analysis (SAST) of source code, dynamic analysis (DAST) of a running application, content discovery, and a STRIDE threat model.
Academic project, TEK-UP University (March-April 2025), based on NIST SP 800-115 and the OWASP Web Security Testing Guide v4. Targets are public, deliberately vulnerable training applications (
testphp.vulnweb.com, OWASP Broken Web Apps). With Zied Mellouli and Aziz Nefzi, supervised by Mr. Oussama Riahi.
A manual assessment, with findings validated by hand after an automated pass with Nuclei, OpenVAS, Burp Suite and Gobuster. 8 findings across the OWASP Top 10.
| Finding | OWASP category | Severity |
|---|---|---|
| SQL injection on the login page (authentication bypass) | A03 Injection | Critical |
| SQL injection on a product page (full database read) | A03 Injection | Critical |
| Reflected XSS in the search bar | A03 Injection | Critical |
| Credentials exposed in a world-readable file | A01 / A05 | Critical |
Local file inclusion (LFI) to /etc/passwd |
A01 Broken access control | High |
Sensitive directories exposed (/admin, /CVS) |
A05 Misconfiguration | High |
| No rate limiting - login brute force possible | A07 Auth failures | High |
| Cleartext HTTP, weak password policy, no MFA | A02 / A07 | Medium |
Each finding was documented with its description, impact, affected endpoint, proof and a remediation (parameterised queries, input validation and output encoding, access controls, rate limiting, TLS, a strong password policy and MFA).
| Tool | Target | Result |
|---|---|---|
| Flawfinder | C source | Highest-risk file flagged with 39 hits, including buffer overflows via gets and unchecked string copies (CWE-120/128) |
| Bandit | Python source | Worst file: 23 issues (9 high, 13 medium), including SQL injection (CWE-89) and use of eval() for arbitrary code execution (CWE-95) |
| Tool | Target | Result |
|---|---|---|
| OWASP ZAP | OWASP Broken Web Apps VM 1.2 | 35 alerts, including a critical XSS and a path-traversal reading /etc/passwd |
| Dirb / Gobuster | testphp.vulnweb.com | Hidden paths discovered (/admin, /cgi-bin, /CVS, /vendor), with a recommendation to lock down access control and remove exposed version-control data |
A threat model of a classic user → web server → database flow, enumerating the Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege threats per element, each with a mitigation.
- Coverage of the full application-security lifecycle: manual pentest, SAST, DAST, content discovery and threat modelling, not a single tool run.
- Findings mapped to the OWASP Top 10 and to CWEs, with severity and concrete remediation.
- Working knowledge of Burp Suite, OWASP ZAP, Nuclei, OpenVAS, Flawfinder, Bandit, Dirb and Gobuster.
Rayen Gader - Cyber Security Engineer, L2 SOC analyst · Portfolio · LinkedIn · rayengader9@gmail.com