Practice assessment: Corvane Clinic (patient portal and API)
You assess the fictional Corvane Clinic’s patient portal, OIDC sign-in and REST and GraphQL APIs with a risk-based plan, escalate the critical finding urgently, and report the remediation plan and personal data impact.
Level 401 · 13 lessons · 11 practice labs
Lessons
Preparation
- Engagement briefing: health data, scope and authorisation
- A quick threat model: patient, doctor and insurer roles
- Mapping the portal, mobile API and appointment service
- Short task: hand in a risk-based test plan
Testing
- OIDC sign-in and session testing
- Object-level authorisation testing on patient records
- The reporting service’s GraphQL interface
- Document upload, PDF generation and SSRF
- Short task: escalate the critical finding under the urgent-notification rule
Fixing and reporting
- The remediation plan and interim measures
- Retest and residual risk
- Personal data impact: notification duties from country to country
- Capstone: deliver the Corvane Clinic assessment with report and retest note
Practice labs
- A quick threat model for Corvane: Work out the five most critical threats to Corvane Clinic across the patient, doctor and insurer roles.
- The Corvane risk-based test plan: Prepare a test plan that ranks the portal, mobile API and appointment service by risk.
- A validation gap in the Corvane OIDC login: Find the validation the Corvane portal skips on the ID token, close it and retest.
- The Corvane session: lifetime on doctor accounts: Prove doctor sessions stay open on a shared computer and add timeout and re-authentication rules.
- Object-level authorisation on patient records: Prove one patient can reach another's test result and add the ownership check.
- An unprotected field in Corvane GraphQL: Find the unprotected field returning patient identifiers in the reporting GraphQL interface and add authorisation in the resolver.
- SSRF in the PDF service: Prove report PDF generation reaches internal services and apply an allow list and an egress rule.
- Health data leaking through document upload: Prove uploaded documents are served publicly at guessable addresses and switch to signed, time-limited links.
- Escalate a critical finding by the urgent-notice rule: Escalate the critical finding that reaches patient data, briefly and clearly, under the urgent-notice rule in the agreement.
- Interim measures and a fix plan: Plan the interim measures to apply until the lasting fix and the order of fixes.
- Corvane retest and residual risk: Retest the fixes and add residual risk and an assessment of personal-data notification duties to the report.
About this course
You assess the fictional Corvane Clinic’s patient portal, OIDC sign-in and REST and GraphQL APIs with a risk-based plan, escalate the critical finding urgently, and report the remediation plan and personal data impact.
What you will learn
- Preparation
- Testing
- Fixing and reporting
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.