logo

E-commerce penetration testing for the Mellow platform – how Core Logic helped improve web application security

  1. Core Logic>
  2. Know how>
  3. Articles>
  4. E-commerce penetration testing for the Mellow platform – how Core Logic helped improve web application security>
Konrad Matyas
Spis treści

In this article, you will learn:

  • why e-commerce platforms require regular security testing,
  • how automated scanning differs from manual penetration testing,
  • why analysing an application’s business logic is so important,
  • what a security testing report contains and how retesting is conducted,
  • what business benefits can be achieved by improving platform security.

Web application security has a direct impact on business continuity, the protection of customer information and brand credibility. For ecommerce platforms, security vulnerabilities in a web app may lead to unauthorised access to sensitive data, order manipulation, disruption of system operations, security breaches or financial losses.

Mellow, a company that provides printing services and allows customers to place orders online, decided to verify the ecommerce security and wider cyber security of its platform. To achieve this, Mellow commissioned Core Logic to carry out comprehensive penetration testing for its ecommerce platform.

The objective of the project was to identify potential vulnerabilities, verify whether the security mechanisms worked correctly and provide the Mellow team with specific recommendations for addressing the security weaknesses and cyber threats identified during the assessment.

The client and its web application

Mellow operates an online platform through which business and individual customers can order printed materials and manage order fulfilment. From a security perspective, this type of web application requires particular protection. The web app processes user information, customer data, order details and parameters that affect the value of the services provided. Any security flaws involving access control, data validation or business logic could therefore affect both customers and the client’s day-to-day operations.

The challenge: security vulnerabilities, security issues and cyber attacks

The primary challenge was to determine whether the way the web app operated could be exploited for purposes other than those intended by its developers.

The web application security test was designed to answer questions such as:

  • Does the application effectively protect sensitive information and customer data?

  • Do the authentication and access control mechanisms work correctly?

  • Are the processes carried out within the system adequately protected?

  • Does the web application correctly validate submitted data?

  • Is the system resistant to common vulnerabilities, cyber attacks and attempts at unauthorised access?

It was important to assess not only the technical layer, but also the business logic of the ecommerce platform. The security testing used a hybrid approach that combined automated scanning with in-depth manual testing. Vulnerability scanning tools helped detect vulnerabilities associated with known technical classes, while manual testing made it possible to assess more complex relationships between users, user accounts, orders, forms and individual stages of the purchasing process.

Core Logic’s scope: web app pen test and security testing

The penetration testing was carried out in a test environment provided by Mellow. This made it possible to simulate different usage and attack scenarios safely and assess the web app without affecting real customers, live orders or financial transactions.

The work was divided into several stages:

  1. Reconnaissance of the web application and its functionality.

  2. Automated vulnerability scanning and an initial web application security test.

  3. Manual web application penetration test activities.

  4. Analysis of how the identified security vulnerabilities could affect the availability, confidentiality and integrity of data in the application.

  5. Preparation of a report containing findings and recommendations.

  6. Implementation of fixes by Mellow.

  7. Retesting to verify whether the implemented changes had effectively addressed the security issues.

This approach enabled the security team to move from a general ecommerce security assessment to a detailed review of individual functions, including the web app’s behaviour during simulated payments. As a result, Core Logic gained a deeper understanding of the application’s mechanisms and could recommend targeted measures to improve its security.

Stage 1. Understanding the web application, entry points and business logic

The first step was to become familiar with the structure of the Mellow platform. A Core Logic expert analysed the available user roles, forms, sections, subpages and individual stages of the ordering process.

The expert also examined how the web application communicated with the server and which operations users could perform. This reconnaissance helped the penetration testers understand:

  • which functions the system made available;

  • what data was transmitted between the browser and the web app;

  • where information was validated;

  • what relationships existed between user accounts and orders;

  • which elements and exposure points required more detailed verification.

A thorough understanding of how the system worked was essential before the manual web app pen test began. In ecommerce platforms, security weaknesses may arise not only from a technical error, such as SQL injection, cross site scripting or other injection flaws, but also from an improperly designed business process or broken access controls.

Stage 2. Vulnerability scanner, common vulnerabilities and automated security testing

The next stage involved automated security tools designed for vulnerability scanning of web applications. The vulnerability scanner executed predefined scenarios and checked the web app for typical classes of security vulnerabilities.

Automated vulnerability scanning makes it possible to review a large number of parameters and entry points quickly. A vulnerability scanner can submit multiple combinations of data, analyse server responses and highlight behaviours that require further investigation.

This type of automated scanning is an important part of a web application penetration test, but it has limitations. A vulnerability scanner does not understand the business purpose of the web app and cannot always determine whether a particular operation should be available to a specific user. It may also generate false positives or fail to detect security gaps that depend on a sequence of actions, relationships between user accounts or the logic used to calculate an order value.

Stage 3. Manual testing during the web application penetration test

The most extensive part of the project consisted of manual testing by ethical hackers. During this stage, a Core Logic expert analysed communication between the web application and the server and checked how the system responded to intentionally modified data.

Burp Suite, one of the standard security tools used for web application security testing, was among the tools used to intercept and analyse HTTP requests. It allowed the penetration tester to reproduce a request sent by the browser, modify its parameters and observe how the target application responded.

The manual web app pen test covered areas including:

  • access control for data and functions;

  • validation of information submitted by users;

  • handling of invalid or unusual parameters;

  • the correctness of mechanisms affecting prices and order values;

  • separation of customer data belonging to different users;

  • web app behaviour in response to repeated or modified requests;

  • the system’s resistance to actions that could interrupt its operation.

Manual testing allowed the specialist to examine the application from the perspective of a potential attacker. The ethical hackers did not simply follow predefined scenarios. Instead, they analysed relationships between functions and checked whether the web app could be used in ways its developers had not anticipated.

Secure collaboration during the pen test

Penetration testing may involve scenarios that cause unusual web application behaviour and, in some cases, temporary disruption. For this reason, the web app pen test was carried out in a test environment and in close cooperation with the Mellow team.

The client was informed in advance about the scope of the security testing and the possible consequences of the activities. In situations requiring intervention, the Mellow team could quickly restore the environment to normal operation or remove test data.

This approach made it possible to assess the cyber security and resilience of the web app thoroughly without exposing real users, sensitive information or live sales processes to critical security risks. Clear communication also allowed the penetration testers and Mellow’s security and development teams to respond quickly if the web application behaved unexpectedly.

The penetration testing report: findings, security issues and false positives

After completing the technical part of the web application penetration test, Core Logic prepared a comprehensive report summarising the work performed.

The document was not limited to a list of detected security vulnerabilities. Each issue was described together with the context required to understand and resolve it. The report included:

  • the location of the vulnerability;

  • the method used to detect it;

  • an example exploitation scenario;

  • its potential impact on the web application and the company’s operations;

  • the risk to data confidentiality, integrity or availability;

  • recommended remediation measures;

  • technical guidance for the team responsible for developing the ecommerce platform.

The report also distinguished confirmed security weaknesses from vulnerability scanner alerts and false positives. Problems were presented from both technical and business perspectives. This allowed the document to support not only developers and security teams, but also people responsible for risk management and product development.

A well-structured penetration testing report also enabled technical and business stakeholders to work from the same assessment of risk.

Implementing fixes and retesting the web app

Based on the report, the Mellow team began implementing the recommended changes. The next stage of the cooperation involved retesting, meaning that the previously prepared web app pen test scenarios were repeated.

The retests were intended to verify whether:

  • the security vulnerabilities had been correctly remediated;

  • the implemented fixes genuinely reduced risk;

  • the changes had not introduced new security issues;

  • a previously successful exploitation scenario could no longer be reproduced.

Retesting is an essential part of penetration testing. Simply reporting that a vulnerability exists does not confirm that it has been resolved effectively. Only another independent web application security test can verify whether the implemented solution works as intended.

Project outcomes: stronger ecommerce security

The penetration testing gave Mellow a detailed view of the security posture of its ecommerce platform.

The main outcomes of the project included:

  • identification of potential vulnerabilities that standard functional tests could not detect;

  • verification of the security of order placement processes;

  • assessment of access control and separation of customer data;

  • evaluation of the web application’s resistance to parameter manipulation;

  • identification of security concerns that could lead to financial losses or system disruption;

  • preparation of specific remediation recommendations;

  • support for the structured implementation of fixes by the Mellow team;

  • independent confirmation of the effectiveness of the changes during retesting.

The project enabled Mellow to reduce the risks associated with making the ecommerce platform available to customers and improve the protection of its sales processes. It also showed how a well-planned web app pen test can reveal security gaps that are difficult to identify through functional testing or automated scanning alone.

The business value of penetration testing for ecommerce platforms

For ecommerce platforms, web application security is directly linked to financial performance and company reputation.

A security weakness that makes it possible to change a price, interfere with an order or gain unauthorised access to another user’s data may lead to financial losses, complaints and reduced customer trust. A vulnerability that affects the availability of the web app may temporarily prevent the company from completing sales.

Penetration testing helps ecommerce organisations detect vulnerabilities before they can be exploited in real cyber attacks or other cyber threats. An independent pen test can also help to:

  • support a secure software development lifecycle;

  • meet the requirements of customers and business partners;

  • prepare the organisation for audits, cyber security reviews and regulatory requirements;

  • support ecommerce security and, where relevant, help with ensuring compliance with PCI DSS;

  • build the image of a company that takes the protection of user data seriously;

  • reduce the cost of responding to security breaches;

  • maintain continuous operation of critical systems.

Summary: web application security verified through a pen test

The cooperation between Core Logic and Mellow covered the complete penetration testing process: understanding the web application, running automated vulnerability scanning, manually analysing its business logic, preparing a detailed report and independently verifying the implemented fixes.

Combining advanced tools with the experience of ethical hackers helped identify security threats that a standard vulnerability scanner alone would not have been able to detect. The manual web app pen test added the context needed to understand how technical security weaknesses could affect orders, customers’ information and business continuity.

Mellow received not only information about the security vulnerabilities identified during the web application penetration test, but also practical recommendations for resolving them and improving the resilience of the ecommerce platform.

The project demonstrates that professionally conducted penetration testing for ecommerce platforms is an important part of developing secure web applications. A comprehensive pen test helps protect sensitive data, sales processes and business continuity before potential security issues are exploited by unauthorised parties.

FAQ

Penetration testing of an e-commerce platform involves controlled testing to determine whether application vulnerabilities could enable unauthorised access to data, interference with orders, manipulation of transaction parameters or disruption of the system. Core Logic combines automated scanning with a manual assessment of security mechanisms and the application’s business logic.

No. Automated scanners help identify known classes of vulnerabilities, but they do not understand the application’s business purpose or the relationships between users, orders and payments. Security testing should therefore also include a manual assessment conducted by an experienced security expert.

A penetration testing report describes the identified vulnerabilities, where they occur, potential exploitation scenarios and their impact on application security and business operations. It also contains a risk assessment, recommended remediation measures and technical guidance for the development team. This enables the organisation to prioritise and implement fixes according to the severity of each threat.

Retesting confirms whether the identified vulnerabilities have been successfully resolved and whether the implemented changes have introduced any new issues. During a retest, the expert reproduces the original testing scenarios and verifies whether the vulnerability can still be exploited. In the project conducted by Core Logic for Mellow, retesting was the final stage of the e-commerce platform security assessment.

Penetration testing should be conducted regularly and following significant changes to the application’s architecture, functionality or business processes. Additional testing is particularly important after introducing new payment methods, modifying the purchasing process, integrating external systems or expanding authentication and access control mechanisms.

Konrad Matyas

Konrad Matyas

Konrad jako wiceprezes Core Logic odpowiada za rozwój rozwiązań technologicznych wspierających wzrost biznesu klientów. Ma ponad 20-letnie doświadczenie w branży IT, obejmujące prowadzenie ambitnych projektów związanych z budową, skalowaniem i zabezpieczaniem infrastruktury IT. Specjalizuje się w obszarach DevOps, mikroserwisów i rozwiązań chmurowych. Łączy perspektywę technologiczną z biznesową, dzięki czemu potrafi przekładać złożone potrzeby organizacji na stabilne, bezpieczne i efektywne systemy.

Porozmawiajmy

Jesteś gotowy, aby razem rozpocząć Twoją cyfrową podróż? Wypełnij nasz formularz lub skontaktuj się z nami telefonicznie.