S
StaffLoans
app

Red Team Simulation

Controlled adversarial testing to identify security gaps

⚠ Dangerous: These tests simulate real attacks. Run only on staging/test environment.

Test Execution
Privilege Escalation

Attempt to escalate from user to admin

Regular user → Admin (direct)
critical
Loan Officer → Super Admin (JWT manipulation)
critical
Employee → Employer Admin (permission confusion)
high
Token expiry bypass
critical
IDOR (Insecure Direct Object Reference)

Attempt to access other users' data by ID manipulation

Access other employee's loans (/api/loans/123)
critical
Access other employer's data
critical
Modify loan application of other user
critical
Access repayment records cross-tenant
high
Cross-Tenant Data Leakage

Attempt to access data from different employer tenants

Query employee list from different employer
critical
View loan applications across tenants
critical
Access tenant-specific settings
high
Enumerate tenant IDs via API errors
medium
Injection Attacks

Attempt code/query injection in input fields

SQL Injection in search fields
critical
NoSQL Injection in filters
critical
Command injection in loan number
critical
XSS in application notes/description
high
API Abuse & Rate Limiting

Attempt to abuse API endpoints

Rate limit bypass (burst requests)
high
Enumerate all user IDs via API
high
Brute force loan application creation
medium
Resource exhaustion (large file uploads)
high
Authentication Bypass

Attempt to bypass authentication mechanisms

Access protected endpoints without token
critical
Token replay attack (reuse old token)
high
Expired token acceptance
critical
SSO bypass (Google OAuth)
critical
Business Logic Attacks

Exploit business logic flaws

Apply for loan above limit
high
Create duplicate loan applications (race condition)
high
Modify repayment amount before submission
high
Bypass approval workflow stages
critical
Data Exposure

Attempt to extract sensitive data

Error messages leak system info
medium
Verbose API responses expose sensitive fields
medium
Backup files accessible via web
critical
Logs contain PII/credentials
critical
Response Protocol

CRITICAL: Fix within 48 hours, retest, then re-audit

HIGH: Fix within 1 week, include in next release

MEDIUM: Prioritize in backlog, fix before next quarter