Practice assessment: Velmora Bank (online banking)
You assess the fictional Velmora Bank’s web banking, signed mobile API and payment flow under the rules of a regulated sector, chain findings to show business impact, close detection gaps with the SOC and report to the board.
Level 501 · 14 lessons · 12 practice labs
Lessons
Preparation
- Engagement briefing: a regulated sector, scope and change freeze
- Architecture review: web, mobile back end and payment gateway
- A threat model for money movement
- Short task: submit the test plan and risk-acceptance list for approval
Testing
- Login, MFA and device-binding testing
- Money-transfer logic and race conditions
- Signed API requests and replay protection
- Cache and proxy-chain testing
- Source code review of the critical module
- Short task: chain findings to show the real business impact
Closing
- Detection gaps: a joint review with the SOC
- A risk summary for the board
- Retest and closing meeting
- Capstone: deliver the Velmora Bank assessment with report, presentation and retest note
Practice labs
- The Velmora architecture review: Draw the trust boundaries between web, mobile back end and payment gateway and mark the three riskiest crossings.
- A threat model for money movement: Work out the threats for the transfer flow and tie them to the test plan along with the risk acceptance list.
- A skipped step in Velmora MFA: Prove the second factor can be skipped in the device pairing flow, close it and retest.
- Testing under a change freeze: Prepare a plan with only low-risk tests suited to the freeze period and write the reasoning.
- Replay of a signed request: Prove a signed mobile API request is accepted when resent and add timestamp and nonce checks.
- A logic flaw in the transfer limit: Prove the daily limit is exceeded with split transfers and calculate the limit on the total.
- A race condition in money transfer: Prove in the lab that simultaneous transfers push the balance below zero and close it with locking and an atomic update.
- An account statement left in the cache: Prove the caching proxy stores a personal account statement and fix the cache rule.
- A risk summary for the board: Write a one-page summary that explains the technical findings in terms of financial loss and regulatory impact.
- A code review of the critical module: Find the signature verification flaw in the transfer module's source and propose the fix with tests.
- Show real business impact with a chain: Chain two medium findings to show in the lab that an unauthorised transfer is possible and apply the fix that breaks the chain.
- A detection gap review with the SOC: Find which of your test actions raised no alert and write the three missing detection rules.
About this course
You assess the fictional Velmora Bank’s web banking, signed mobile API and payment flow under the rules of a regulated sector, chain findings to show business impact, close detection gaps with the SOC and report to the board.
What you will learn
- Preparation
- Testing
- Closing
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.