What is Parasym Syndicate?

Parasym Syndicate (intelligence. security. innovation.) is an offensive security technology and assessment organization. Parasym builds autonomous offensive security software and delivers expert-led penetration testing, adversary simulation, and practical cybersecurity education.

What products does Parasym Syndicate offer?

Parasym Syndicate develops Lightbringer (autonomous enterprise adversary simulation) and Lightbringer Lite v1.0 (evidence-driven web application and API security testing platform), alongside specialist platforms catalogued in the dedicated Platforms directory.

What cybersecurity services does Parasym Syndicate provide?

Parasym Syndicate provides advanced cybersecurity services including adversary simulation and red teaming, threat detection and cyber intelligence, security architecture resilience assessment, AI security and red teaming, digital forensics, cybercrime investigation, and strategic advisory services.

What is Lightbringer Lite?

Lightbringer Lite v1.0 is an evidence-driven web application and API security testing platform designed to assess websites, web applications, and APIs through safe exploit validation, reproducible evidence, and structured reporting.

Does Parasym Syndicate provide VAPT and Penetration Testing in India?

Yes, Parasym Syndicate provides elite Vulnerability Assessment and Penetration Testing (VAPT), red teaming, and adversary simulation services across India, including Mumbai, Delhi, and Bangalore, as well as worldwide.

What is AI Red Teaming and LLM Security?

AI Red Teaming is the adversarial testing of artificial intelligence systems, including LLMs, to discover vulnerabilities like prompt injection, data poisoning, and alignment bypass. Parasym Syndicate specializes in enterprise AI Security and LLM Red Teaming.

What cybersecurity training courses does Parasym Academy offer?

Parasym Academy provides live-fire cyber range courses including the VAPT Masterclass (PCVP), Advanced Red Teaming & Adversary Simulation (PCRT), SOC Analyst L1/L2 Incident Response Bootcamp (PCSA), Enterprise Penetration Testing & Ethical Hacking (PCEPT), AI Security & LLM Red Teaming (PCAIS), and Military OSINT (PMOT).

What is the VAPT course curriculum and certification?

The Parasym Academy VAPT Masterclass is an intensive 12-week program covering advanced manual web application pentesting, OWASP API Top 10, internal network exploitation, Active Directory privilege escalation, and Indian regulatory compliance (RBI, SEBI, CERT-In, DPDP Act), culminating in the practical PCVP (Parasym Certified VAPT Professional) credential.

What is the SOC L1 course syllabus at Parasym Academy?

The SOC Analyst L1/L2 Bootcamp is a 10-week hands-on training covering SIEM deployment (Splunk, Elastic, Microsoft Sentinel), Sysmon telemetry analysis, Wireshark and Zeek packet forensics, phishing triage, Sigma/YARA detection engineering, and live-fire ransomware containment playbooks, preparing graduates for the PCSA certification.

Back to Case Studies

Web Application & API Penetration TestingAnonymized Client Assessment

Broken Object Level Authorization (BOLA/IDOR) in Multi-Tenant Payment Settlement API

SECTOR: Financial Services & Payment Infrastructure|intelligence. security. innovation.

Authorized Client Engagement Anonymization DisclosureClient identity, internal hostnames, and proprietary configuration parameters are anonymized in accordance with commercial non-disclosure agreements and responsible disclosure policies. All vulnerability findings and outcomes represent genuine authorized assessment activity.

Target Scope & Environment

Authorized Staging Payment Gateway

Classification / Standard

CWE-639: Authorization Bypass Through User-Controlled Key

Client / Testbed

Confidential FinTech Institution

01.Context & Authorized Scope

During an authorized penetration testing engagement for a payment settlement provider, Parasym Syndicate was tasked with assessing their microservice payment settlement gateway. The scope was strictly limited to a staging environment replicating multi-tenant REST and GraphQL endpoints handling merchant ledger exports, dispute resolution records, and webhook callbacks.

02.Security Question Tested

Does the settlement gateway enforce tenant-level authorization checks to prevent an authenticated merchant from querying or extracting the transaction records and financial ledgers of other merchant organizations?

03.Testing Approach & Methodology

Operators conducted state differential testing across isolated authenticated sessions. After establishing baseline requests as Merchant A (ws_merchant_alpha_7829), operators issued requests targeting resources created by Merchant B (ws_merchant_beta_9914) on the endpoint GET /v2/merchants/{merchant_uuid}/reports/settlements/{settlement_id} while observing backend authentication and authorization behaviors.

04.Observed Technical Evidence

Although the gateway properly validated JWT cryptographic signatures and token expiration, the underlying microservice failed to verify whether the authenticated caller held authorization over the requested merchant_uuid parameter. When Merchant A's valid session token was submitted with Merchant B's identifier, the gateway responded with HTTP 200 OK and exposed Merchant B's synthetic transaction ledger schema.

Reproducible Cross-Tenant Verification Request

curl -i -s -k -X 'GET' \
  -H 'Host: api-staging.settlement.internal' \
  -H 'Authorization: Bearer eyJhbGciOi...[MERCHANT_A_TOKEN]' \
  -H 'X-Parasym-Audit-Ref: ENG-FIN-8821' \
  'https://api-staging.settlement.internal/v2/merchants/ws_merchant_beta_9914/reports/settlements/stl_90241'

# Observed Unpatched Response: HTTP/1.1 200 OK (Cross-Tenant Leak)
# Observed Patched Response:   HTTP/1.1 403 Forbidden (Access Denied)

05.Demonstrated Impact & Operational Assumptions

In an unhardened production environment, this flaw would have allowed an authenticated merchant with standard API credentials to systematically query and extract confidential transaction records, customer dispute data, and settlement schedules from competing merchants. (Operational Assumption: Exploitation requires a valid authenticated merchant account and knowledge or enumeration of target merchant UUIDs).

06.Engineering Remediation

Parasym collaborated with the client's platform engineering team to deploy defense-in-depth authorization controls: 1. Implemented Attribute-Based Access Control (ABAC) middleware at the API routing layer to validate token tenant_id claims against requested route parameters before routing. 2. Refactored database queries to use composite tenant-scoped filters (WHERE id = ? AND tenant_id = ?), eliminating horizontal parameter tampering at the data layer. 3. Added automated dual-tenant integration tests into the CI/CD pipeline to verify tenancy isolation across all CRUD endpoints prior to release.

07.Verified Retest Outcome

Retesting across the patched staging environment confirmed that all cross-tenant requests were consistently rejected with HTTP 403 Forbidden. The client hardened their settlement gateway prior to production deployment, preventing potential regulatory non-compliance under financial data protection mandates.

Require an authorized security assessment?

Discuss your architecture, testing scope, and safe-harbor requirements with our offensive engineering team.

Book an Assessment