Top 3 marketplace · a 4-week Red Team before Black Friday
A 4-week Red Team for one of Turkey's top 3 e-commerce marketplaces before Black Friday. Pentest of the payment flow · admin panel · vendor portal · return system. 23 findings · 4 critical · closed in 10 days · 0 incidents on Black Friday.
01 The Challenge
Before Black Friday the marketplace would take 14 times the usual traffic for 30 days. The previous year there had been a 2-hour outage in the payment flow on Black Friday, with a loss of 8M TL in revenue. This year the CISO gave the directive 'no repeat of the same mistake.' A full-scope DSET Red Team engagement: the backend API · payment integration · admin panel · vendor portal · return flow · mobile app · web.
02 DSET's Approach
Week 1 · Recon + scope
260 API endpoints · 47 admin pages · 3 payment integrations · vendor portal · return module. Traffic patterns were analyzed. Black Friday load modeling.
Week 2 · API + payment
API authorization flaws (IDOR) · race conditions (using the same coupon 1000 times) · payment manipulation (price manipulation, currency swap) tests.
Week 3 · Admin + vendor
Authorization bypass for the admin panel · SSRF in the vendor portal · file upload (web shell) · sub-domain takeover scans.
Week 4 · Mobile + final
iOS + Android app reverse engineering · API contract testing · jailbreak/root detection bypass · a stress test simulation (14x traffic).