CAP-C01 case studies
CAP-C01 · Put your knowledge to work in context.
CAP-C01 is a penetration-testing certification exam offered through The SecOps Group's exam programme, which the company describes as "Perfect for assessing and recruiting pentesters" and "Based on real-world scenarios." It is aimed at security practitioners who want a credential that reflects practical offensive-security work: web application testers, internal and external network testers, mobile application testers, source-code reviewers, and cloud security assessors. The six published domains mirror the consultancy service lines The SecOps Group advertises - web application, internal network, external network, mobile application, source-code analysis, and cloud security assessment - with the heaviest weighting on web and internal network topics. The CAP-C01 case studies are 6 cases and about 2,226 words.
1Session Fixation in a Legacy Authentication Flow
A B2B SaaS platform lets tenants configure SSO. During a review you notice the login flow: GET /login issues a pre-authentication session cookie (JSESSIONID) and a hidden CSRF token; POST /login validates credentials, then calls HttpSession.invalidate() and creates a new session, but reuses the same JSESSIONID value by copying it from the old session into the new one via a custom session-id generator.
394 words, about 2 min2Segmentation Gap Behind a 'Compliant' PCI Boundary
A retailer's cardholder data environment (CDE) is a /24 VLAN with a firewall between it and the corporate LAN. The firewall ACL permits the corporate /16 to reach the CDE on 443, 445, and 3389 'for admin support.' A quarterly internal scan of the CDE finds one unpatched Windows host (MS17-010-class SMB vulnerability) and a domain-joined jump box.
347 words, about 2 min3TLS Misconfiguration on an External Endpoint
An external scan of a company's public IP range finds a load balancer terminating TLS for a customer portal. The cipher list includes TLS 1.0/1.1, RC4, and 3DES; the certificate is valid but the SAN list includes an internal hostname (intranet.corp.example).
361 words, about 2 min4Hardcoded Key and Weak Crypto in a Mobile Build
A fintech Android app stores an API signing key as a string constant in the APK, uses AES/ECB with a static IV for local caching, and pins certificates by comparing the SHA-256 of the leaf certificate to a value in strings.xml . The app also logs full request bodies (including account numbers) to logcat in release builds.
372 words, about 2 min5Taint Analysis False Negative in a Framework
A SAST tool reports zero SQL injection findings across a Java Spring codebase. Manual review finds a repository method that concatenates a sort query parameter into an ORDER BY clause.
389 words, about 2 min6Over-Permissive IAM Role in a Multi-Account Cloud
A cloud org has 40 AWS accounts under an organization. A CI/CD role in the shared-services account has an inline policy granting s3: and iam:PassRole on , plus sts:AssumeRole on .
363 words, about 2 min