The Enterprise Web App Penetration Testing Checklist: OWASP Top 10 Audit Guide

Many companies run an automated scanner like Nessus or OWASP ZAP and assume their application is secure if the report returns green. However, automated tools cannot understand business context. A scanner cannot know that user account A should never be able to download the invoice PDF of user account B simply by incrementing the URL parameter from id=4102 to id=4103 (IDOR).

Professional penetration testing involves manual adversary emulation: probing multi-step checkout workflows, token replay scenarios, and privilege escalation vulnerabilities that require human intuition.

When an application accepts a URL input (such as generating a PDF from a user-supplied link or importing an image from a URL), attackers pass internal loopback or cloud metadata addresses to extract temporary AWS/GCP session credentials.

import { isIP } from 'net';
import dns from 'dns/promises';

export async function validateSafeEgressUrl(inputUrl: string): Promise<URL> {
  const parsed = new URL(inputUrl);
  if (!['http:', 'https:'].includes(parsed.protocol)) {
    throw new Error('Disallowed protocol');
  }

  // Resolve DNS to verify actual IP destination
  const addresses = await dns.resolve(parsed.hostname);
  for (const ip of addresses) {
    if (
      ip.startsWith('127.') || // Loopback
      ip.startsWith('10.') || // RFC1918 Private
      ip.startsWith('192.168.') || // RFC1918 Private
      ip.startsWith('172.16.') || // RFC1918 Private
      ip === '169.254.169.254' // Cloud Metadata Endpoint
    ) {
      throw new Error('Access to private / internal network addresses is forbidden');
    }
  }
  return parsed;
}