A day of testing, replayed

Watch a pentest, not a sales pitch.

A real test is patient, hands-on work. This is a short, illustrative replay of the kind of thing we do and find, for a made-up shop.

vanorika / engagement

scope zuva-shop.co.zw (authorised, signed)

mapping pages, forms and API endpoints

found: login, product search, orders API, admin area

review access control on the orders API

requesting an order that belongs to another account

HIGHan order was returned with no ownership check

review the admin area

CRITICALthe admin area opens without a login

review the search input

HIGHsearch reflects input without cleaning it

compile report

findings ranked by risk, each with a fix

critical and high findings fixed and confirmed on retest

this is what a day of patient, manual testing looks like.

That is the whole point of manual testing: a person who thinks like an attacker, working through your systems by hand.

This replay is illustrative and the target is fictional. Real engagements are private, authorised in writing, and never shown.