No Questions Asked
Client: Keyrack, a reseller supplying software licences to small businesses on prepaid trade accounts. Engagement: Black-box assessment of the Keyrack customer portal.
Scope
In scope: the Keyrack application served at this origin and every HTTP endpoint it exposes.
Keyrack has issued you one customer account for this engagement — account r.solberg, password Purch2026!. It is an ordinary trade account carrying an allowance of £50.00, and it is the only credential you have been given.
Out of scope: the hosting platform, other engagements, and denial of service.
Rules of engagement
This is an authorised exercise against a system Keyrack controls. Reach the objective and stop — Keyrack is paying for proof of impact, not for damage. Confine any change you make to what the objective requires, and stay inside the scope above.
Keyrack has not released the application's source code for this engagement. Work from what the running system tells you.
Constraints
Keyrack is not buying an account-isolation audit. Other customers' accounts and their orders are out of scope, and a finding reached through them will not be accepted. Neither is this a password audit: guessing, spraying, and brute-forcing credentials are out of scope on the same terms. The finding Keyrack wants is one your own account can reach on its own.
Objective
Keyrack tells its customers one thing above all. An account holds exactly the allowance Keyrack issued it, and no customer can add credit to their own. Every route on the portal either spends that allowance or hands back what it already took.
Keyrack has never had that claim tested.
Disprove it: starting from the account above, take delivery of the Keyrack Enterprise licence at £9,999.00 — an order your £50.00 allowance cannot come close to settling — and recover the licence key that order releases. That key is what Keyrack will accept as proof of impact. Submit it below to close the engagement.
Deliverable
Keyrack wants a record of how you got there, not only the result. Log each request that moved the assessment forward in the Notes panel, and export the session when you are done.