CAP-PL ENS case studies

CAP-PL ENS · Put your knowledge to work in context.

CAP-PL ENS is a certification exam offered through the pentesting exams programme described on The SecOps Group website, which presents its exams as "Perfect for assessing and recruiting pentesters", "Based on real-world scenarios" and "Trusted by leading industry experts". The site also describes the exam programme as "Online, on-demand and affordable" and states that through its exams it provides "an authentic and credible certification that is modern, relevant and represents real life business risks". The CAP-PL ENS case studies are 5 cases and about 3,966 words.

The Adjacent /24: Scope Creep on Day 3 of a 5-Day External Test

You are on day 3 of a 5-day external network assessment for a mid-size retailer. The signed statement of work scopes 'all internet-facing IP addresses owned by Client', and the kickoff spreadsheet lists exactly one range: 10.20.0.0/24.

793 words, about 4 min 2

Retest Verdict: Fixed Endpoint, Unfixed Vulnerability Class

Two weeks ago you delivered a report containing a Critical SQL injection in GET /api/v2/reports?id=, proven with a boolean-based payload that returned other tenants' report metadata. The developers rewrote that endpoint to use a parameterized query.

784 words, about 4 min 3

The Disputed XSS Finding and a Live Token in the Appendix

You deliver a web application assessment for a healthcare SaaS provider. One finding is reflected XSS on the patient portal search page: the q parameter is reflected unencoded into an HTML attribute (value="..."), and a payload using a double quote plus an onfocus handler executes in current Chrome.

806 words, about 4 min 4

Three Invoices, Real Customers: Proof Depth on a Live Fintech API

You are testing a fintech's public REST API in production under an SOW that permits read-only testing with client-supplied test accounts. While checking object-level authorization on GET /v1/invoices/{id}, you request invoice IDs 1001, 1002 and 1003 using a single test account and receive three different customers' invoices.

796 words, about 4 min 5

'Prove It or We Won't Fix It': Validating an IAM Escalation Path Without Modifying IAM

A logistics company hires you for a 5-day cloud security review of an AWS organization. The rules of engagement permit read-only API calls only: 'No creation, modification, or deletion of IAM, compute, storage, or network resources.' You are given an auditor role with SecurityAudit and ViewOnlyAccess.

787 words, about 4 min