Scenarios
bas-001 — External web → SQLi → DB data exposure
Login form on online.keensafeglobalbank.com is vulnerable to SQL injection. The injected query exfiltrates rows from the users table.
critical
bas-002 — API IDOR → customer data exposure
GET /api/v1/accounts/{id} returns account data for any id without ownership checks.
high
bas-003 — SSRF → cloud metadata simulation
GET /api/v1/fetch?url= follows arbitrary URLs, including the AWS instance metadata service simulation host.
high
bas-004 — Leaked VPN credential → internal access
CTI feed surfaced vpn.user@keensafeglobalbank.com:Summer2025!. Combined with no MFA on legacy VPN this would yield direct internal access.
critical
bas-005 — Exposed Jenkins → secret leak → cloud pivot
Jenkins admin credentials are weak and build logs leak fake AWS keys. Stolen keys pivot into S3 + IAM.
critical
bas-006 — LLM prompt injection → policy/data disclosure
Chatbot at chatbot.keensafeglobalbank.com responds to 'ignore previous instructions' by leaking the system prompt and customer-record content.
high
bas-007 — Credential stuffing — leaked admin → admin panel
CTI lkc-007 (admin@keensafeglobalbank.com:Admin123! from stealer log) reused on /admin/login.
critical