---
title: internal-app-pentest
studio: security-assessment
stages: [reconnaissance, enumeration, exploitation, post-exploitation, reporting]
status: complete
---

# Internal Admin Dashboard Pentest

Pre-launch pentest of the internal admin dashboard before it's opened to partner admins. Scope is the web app and the API it calls; infrastructure is excluded. Both authenticated and unauthenticated testing, with focus on the partner-admin role and privilege-escalation paths.

## Goals

- Recon and enumeration of all admin routes and API endpoints
- Authenticated test as partner-admin — privilege escalation to super-admin
- Unauthenticated surface testing for auth bypass and IDOR
- Report with severity-ranked findings and remediation recommendations
