Case Study — BI SNAP API Penetration Testing (Bank Indonesia SNAP)
Scanner said “clean”. We moved money between accounts with a single BOLA.
Client Context
Top-10 Indonesian bank — launching BI SNAP v1.3 (27 endpoints: balance, transfer, virtual account) to 4 fintech partners. Deadline: OJK/BI self-assessment + partner due-diligence in 3 weeks. Scanner: 0 critical.
Challenge
SNAP spec demands strict auth + signature + consent, but implementations vary per bank. Risk: BOLA/BFLA, signature replay, and partner-side abuse = fund diversion + BI sanction. Need OWASP API Top 10 + BI SNAP assurance with pen-test evidence for QSA/OJK.
Scope — Snipeyes API Pen-Test (CREST, 10-day SLA)
- 90-min scoping workshop: auth flows, SNAP signature (HMAC) & timestamp, partner consent model
- 27 SNAP endpoints + 4 partner sandboxes: BOLA/BFLA, IDOR, mass assignment, signature replay, rate-limit & consent bypass
- mTLS & Vault review: cert pinning, key storage, log leakage
- Mapped to OWASP API Top 10, OWASP ASVS 4.0, PCI DSS 4.0 Req 6.2/11.3, ISO 27001 A.8
Key Findings (redacted)
- CRITICAL: BOLA on
transfer— alteredaccountNowith valid partner token → fund divert to attacker account (chained 2 lows into takeover, PoC provided) - HIGH: SNAP
X-SIGNATUREreplay within window — missing nonce + clock skew allowed replayed transfer - MEDIUM: BFLA on admin
settlementReport— partner role could fetch other partner’s data - 18 findings: 1 Critical chain, 2 High, 6 Medium, 9 Low — CVSS + exploitability ranked, board narrative (regulatory + fraud impact)
Outcome
- Fix in 4 days, retest passed 100%, QSA/OJK accepted first time — no launch delay
- 80% critical reduction at retest, partner onboarding unblocked, continuous Auto PenTest hooked to every SNAP deploy
- Now used as BI SNAP reference evidence for fintech due-diligence
Relevance for you: If you expose SNAP, open banking, or partner APIs — we test auth flows, not just endpoints, with free retest before go-live.