24 ways in, tried · Ridgeline Outfitters · 1 player · 8 stages

Storefront security test, 12 March

Numbers — the HUD

Attack types tried
24 → 24
Blocked
0 → 24
Secrets found in the site
0 → 0
Admin routes reachable without login
3 → 0
Time to lockout on brute force
none → 2 s
Rate limit on checkout
none → 60/min

Attacks — the eight stages

  1. SQL injection on product search — HELD (parameterised from the start)
  2. Price tampering in the cart POST — FIXED, then HELD (server re-prices every line)
  3. Coupon stacking — FIXED (one code per order, server side)
  4. Webhook forgery — HELD (HMAC checked, replay window 5 min)
  5. Staff login brute force — HELD (lockout after 8 tries)
  6. Order lookup by guessing IDs (/orders/1041) — FIXED (owner check)
  7. Open redirect on ?next= — FIXED (allow-list)
  8. CSV upload path traversal — HELD (filenames rewritten)

How to play — the card on the bezel

We attacked our own store for a day. The three findings that mattered were all the same shape: the server trusted a number the browser sent. Cart prices, coupon counts, order IDs. Each fix is the same fix — the server decides, the browser asks.

Everything else held because it was boring. Parameterised queries, a signed webhook, a lockout counter. Boring is the point. The test runs again every Monday; the numbers above are a baseline, not a trophy.

Re-run the test

  1. basecamp sec run --all from a staff laptop on the office network.
  2. Read the summary; any row not HELD opens a ticket automatically.
  3. For a new FIXED row, add its check to the Monday list.
  4. Rotate the test account password after the run.
  5. Post the one-line result in #ops.

High scores — attack · vector · result · fix

AttackVectorResultFix
Price tamperingcart POST bodyfixedserver re-prices
Coupon stackingrepeat applyfixedone code per order
Order ID guessing/orders/:idfixedowner check
Brute forcestaff loginheldlockout 8 tries

Service menu — behind the coin door

basecamp sec run --all
basecamp sec report --last        # 24 tried, 24 held, 0 secrets
basecamp sec schedule monday 07:00
“The server decides. The browser asks.”
exit