[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573437-105":53,"doc-detail-573437-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","report-uri-penetration-testing-report-2022","Report URI - Penetration Testing Report - 2022","","Penetration testing was performed for the Report URI platform and its web application and API to validate that security controls align with industry best practices. The assessment covered black-box, rogue authenticated user, and white-box scenarios, including source code and repository review. Testing focused on identifying vulnerabilities and providing remediation guidance, resulting in documented technical findings such as outdated software issues, account enumeration, and server-side request forgery (SSRF).",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/report-uri-penetration-testing-report-2022/573437/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/report-uri-penetration-testing-report-2022/573437.png","ImageObject",442,249,{"name":88,"@type":89},"Anna Hans","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-16","2026-10-14",true,{"@type":98,"interactionType":99,"userInteractionCount":79},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What was the purpose of the penetration testing engagement?","Question",{"text":108,"@type":109},"The engagement aimed to provide independent assurance that security controls were aligned with industry best practices and to identify vulnerabilities that could be exploited across a computer network.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"Which testing scenarios were included?",{"text":113,"@type":109},"The assessment included black-box testing for unauthenticated access, a rogue user simulation for authenticated paid and free tier accounts, and a white-box review using provided source code, repositories, and access to staff.",{"name":115,"@type":106,"acceptedAnswer":116},"What key technical findings were highlighted?",{"text":117,"@type":109},"The document highlights vulnerabilities in outdated software, account enumeration, and server-side request forgery (SSRF).","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},573437,1792170742,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":79,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":15},5909892332657,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","Report URI  \nPenetration Testing Report  \n2710  \nReport URI & API  \n29/11/2022  \nAuthor: Paul Ritchie  \n26a The Downs, Altrincham, Cheshire, WA14 2PU  \nTel: +44 (0)161 233 0100  \n[Web](Web: www.pentest.co.uk)[:](Web: www.pentest.co.uk)[ ](Web: www.pentest.co.uk)[www.pentest.co.uk](Web: www.pentest.co.uk)  \nCOPYRIGHT PENTEST LIMITED 2021 ALL RIGHTS RESERVED. NO PART OF THIS PUBLICATION MAY BE REPRODUCED, STORED IN A RETRIEVAL SYSTEM, OR TRANSMITTED IN ANY FORM, OR BY ANY MEANS, ELECTRONIC, MECHANICAL, PHOTOCOPYING, RECORDING OR OTHERWISE, WITHOUT THE PRIOR WRITTEN PERMISSION OF THE COPYRIGHT HOLDER.  \nTable of Contents  \n1 Document Revision History....................................................................................................3  \n2 Introduction ............................................................................................................................4  \n3 Executive Summary ...............................................................................................................6  \n4 Recommended Actions ........................................................................................................ 10  \n5 Technical Findings ............................................................................................................... 11  \n5.1 Vulnerabilities in Outdated Software Detected ................................................................. 12  \n5.2 Account Enumeration ........................................................................................................ 14  \n5.3 Server Side Request Forgery (SSRF) .............................................................................. 16  \n6 Additional Information ..........................................................................................................21  \nAppendix A. Testing Notes ............................................................................................................28  \nA1 . Source Code Analysis .......................................................................................................28  \nA2 . Dependency Checking ......................................................................................................28  \nA3 . GitHub Repository Secrets Hunting ..................................................................................29  \nA4 . Bug Hunting in Pem Decoder [Not Vulnerable] ................................................................30  \nA5 . Automated Application Scanning Challenges ...................................................................31  \n1 Document Revision History  \n\n| Name | Date | Version | Comment |\n| --- | --- | --- | --- |\n| Paul Ritchie | 28/11/2022 | 0.1 | Initial Document |\n| Kyle Fleming | 29/11/2022 | 0.2 | QA by senior consultant. |\n| Paul Ritchie | 29/11/2022 | 1.0 | Final Draft |\n\n2 Introduction  \nReport URI engaged Pentest Limited to undertake this project. This was to gain independent assurance that security controls are in-line with industry best practices.  \nReport URI was created to take the pain out of monitoring security policies like CSP and other modern security features. When you can easily monitor what's happening on your site in real time you react faster and more efficiently, allowing you to rectify issues without your users ever having to tell you. The Report URI platform is constantly evolving to help better protect your users.  \nReport URI are the best real-time monitoring platform for cutting edge web standards. Their experience, focus and exposure allow them to take the hassle out of collecting, processing, and understanding reports, giving you just the information you need.  \nReport URI have indicated the need for a security test, of their ‘Report URI’ application to identify vulnerabilities to attacks that could be launched across a computer network and to provide security assurances regarding their systems. Such a test will allow Report URI to undertake remediation efforts and increase t","cbCaiifNDctEINRh","https://ap.wps.com/l/cbCaiifNDctEINRh","pdf",967474,35,"English","# Document Revision History\n# Introduction\n## Scope & Duration\n## Scenarios Included\n## Target(s)\n# Executive Summary\n# Recommended Actions\n# Technical Findings\n## Vulnerabilities in Outdated Software Detected\n## Account Enumeration\n## Server Side Request Forgery (SSRF)\n# Additional Information\n# Appendix A. Testing Notes\n## Source Code Analysis\n## Dependency Checking\n## GitHub Repository Secrets Hunting\n## Bug Hunting in Pem Decoder [Not Vulnerable]\n## Automated Application Scanning Challenges","[{\"question\":\"What was the purpose of the penetration testing engagement?\",\"answer\":\"The engagement aimed to provide independent assurance that security controls were aligned with industry best practices and to identify vulnerabilities that could be exploited across a computer network.\"},{\"question\":\"Which testing scenarios were included?\",\"answer\":\"The assessment included black-box testing for unauthenticated access, a rogue user simulation for authenticated paid and free tier accounts, and a white-box review using provided source code, repositories, and access to staff.\"},{\"question\":\"What key technical findings were highlighted?\",\"answer\":\"The document highlights vulnerabilities in outdated software, account enumeration, and server-side request forgery (SSRF).\"}]","Report URI - Penetration Testing Report - 2022 | PDF",1791939742]