Web application security testing: protecting checkout before a big sale

In online retail, the most costly weaknesses often sit in the business rules, such as how discounts combine or how a payment is confirmed. Automated scanners rarely catch these flaws, yet they let people take goods without paying. An e-commerce platform asked us to test exactly that before its largest campaign of the year.

ILLUSTRATION: WEB TEST COVERAGE (OWASP-BASED)
Auth & Session
Bypass, fixation, OTP
Injection
XSS, SQLi, SSTI
Logic
Cart, voucher, race

The client and the deadline

The client was a large e-commerce platform with around 12 million monthly users. It ran a web storefront, a seller center and a promotion engine that powers its discount campaigns. The 11.11 sale was five weeks away, and an earlier voucher-abuse incident had already cost the company Rp800 million.

Why a scanner alone would not do

Shopping carts, vouchers and payment confirmations follow business rules that scanners do not understand. The client needed testing built around known attack patterns and recognized standards (the OWASP Application Security Verification Standard and Web Security Testing Guide). It also had to be safe to run in a staging environment loaded with realistic data.

How we tested the shopping journey

  • We mapped the full journey for buyers, sellers and administrators, from browsing the catalog to the cart, checkout, payment and refunds, while logged in as each role.
  • Automated test packs covered logins, access control, injection attacks, abuse of business rules, file uploads and tampering with payment confirmations.
  • A tester confirmed every high and critical finding by hand. Each came with the exact request and response, a video, a CVSS severity score and an OWASP risk rating.
  • Developers received each finding with step-by-step instructions to reproduce it.

What we found

In total we reported 34 findings: 2 critical, 5 high, 12 medium and 15 low. Three of them carried most of the business risk.

  • Critical: a discount code called ADMIN90, which was never meant to be public, could be combined with free shipping and cashback. Stacked together, they brought an order down to Rp0. We reproduced this three times.
  • High: a stored cross-site scripting flaw in the product question-and-answer section let an attacker plant code that would hijack a seller’s admin session.
  • High: the system accepted a payment confirmation saying status=paid without checking its digital signature, so an order could be marked as paid with no money transferred.

Ready for the campaign

The logic fixes went live before 11.11. Payment confirmations are now signed and checked, and each one can only be processed once. A retest confirmed that all critical and high findings were closed. The test pack now runs again before every promotional release, and the findings were mapped to OWASP ASVS 4.0 as evidence for the company’s ISO/IEC 27001 certification.

Any business where money changes hands inside its own website or app, especially around big promotions, has the same kind of exposure in its business rules.