VAPT for a Payment Gateway: Uncovering 12 Critical Vulnerabilities

The Challenge

The client — a fast-growing payment aggregator authorised by RBI — was approaching their annual PCI-DSS re-certification and had internal concerns about the security posture of their newly launched merchant onboarding API. Their internal VAPT from the previous year had missed several critical findings, and the board had mandated an independent, manual penetration test before the audit window opened.

Key constraints: the test had to be conducted in a staging environment that mirrored production, all testing had to be non-disruptive to 24×7 payment processing, and the final report had to be in a format accepted by their QSA.

Our Approach

eNeoteric conducted a 10-day black-box / grey-box hybrid engagement covering:

• Web application testing (OWASP Top 10 + OWASP ASVS L2)
• REST API penetration testing (all 47 documented endpoints)
• Authentication and session management deep-dive
• Business logic testing — transaction flow, refund logic, settlement API
• Mobile SDK testing (Android + iOS merchant apps)
• Infrastructure review of the exposed perimeter (3 subnets)

Testing was performed by OSCP-certified engineers, with findings triaged daily in a shared Slack channel with the client's CTO and CISO.

Key Findings

The engagement produced 12 critical, 8 high, 14 medium, and 19 low / informational findings. The most significant:

• IDOR in refund API — Merchants could modify merchant_id in refund requests to trigger refunds to arbitrary bank accounts. Exploitable without authentication bypass; estimated potential loss ₹50L per exploit chain.
• JWT algorithm confusion — RS256 → HS256 downgrade attack gave unauthenticated access to admin console.
• SQL injection in report export — Time-based blind SQLi in the transaction export endpoint; full database read possible.
• Exposed Swagger UI in production — Internal API documentation publicly accessible, reducing attacker reconnaissance time significantly.
• Weak TLS configuration — TLS 1.0 still negotiable; CBC cipher suites accepted on payment endpoints.

Outcomes & Impact

eNeoteric provided developer-specific remediation guidance for every finding. A complimentary re-test 45 days post-engagement confirmed 100% closure of all Critical and High findings. The client subsequently passed their PCI-DSS Level 1 re-certification audit with zero security non-conformities related to the tested scope.

The CTO later used the IDOR finding as a case study in their internal developer security training, reaching 40+ engineers.