Audio Magic

Overview

Audio Magic engaged me for a black-box security assessment of its web application and API surface. With no prior knowledge of the internals assumed, the engagement focused on how far an outside attacker could get — probing authentication, authorisation and input-handling across the application and its API endpoints.

Assessment Focus

• Broken object-level and function-level authorisation across the API (IDOR).
• Cross-site scripting (XSS) in user-reachable input paths.
• Privilege-escalation routes from ordinary user context.
• General OWASP Top 10 coverage across web and API layers.

Documented Contribution

• Conducted black-box web application and API penetration testing end to end.
• Uncovered high-severity flaws including IDOR, XSS and privilege escalation.
• Provided structured remediation reports so the client could fix issues in priority order.

Findings & Remediation Summary

The assessment surfaced high-severity access-control weaknesses — objects and functions reachable beyond a user's intended permissions (IDOR) — alongside cross-site scripting and privilege-escalation paths. Each finding was documented in a structured remediation report, giving the client a clear, prioritised fix list. Specific tool assignments, evidence and counts are not published here.