How to Conduct a Comprehensive VAPT (Step-by-Step Practical Field Checklist & CERT-In Audit Guide)
The definitive human-language field manual for Indian engineering and security teams executing a Vulnerability Assessment & Penetration Testing (VAPT) engagement. Built for compliance with CERT-In 2022 Directions and RBI Master Direction, covering pre-test scoping, zero-downtime rules, manual IDOR exploitation, and remediation attestation.
Interactive Technical Checklist (14 Verification Checkpoints)
-
[Phase 1: Pre-Engagement Scoping] Execute mutual Non-Disclosure Agreement (NDA) and formal Rules of Engagement (RoE) specifying testing hours.Mandate: CERT-In Scope Alignment
-
[Phase 1: Pre-Engagement Scoping] Define exact in-scope IP ranges and domain names in Indian cloud zones (e.g., AWS ap-south-1 Mumbai, Azure Pune) and exclude unmanaged third-party SaaS.Mandate: IT Act Sec 70B Compliance
-
[Phase 1: Pre-Engagement Scoping] Whitelist testing IP addresses in perimeter firewalls, Cloudflare, AWS WAF, and local SOC SIEM alerts.Mandate: SOC Alert Coordination
-
[Phase 1: Pre-Engagement Scoping] Provision test accounts across every role tier (Admin, Branch Manager, Teller, Standard User, Read-Only Auditor).Mandate: RBAC Privilege Testing
-
[Phase 2: Discovery & Reconnaissance] Perform passive OSINT reconnaissance: Indian domain WHOIS, public subdomains, and exposed GitHub credentials.Mandate: External Exposure Check
-
[Phase 2: Discovery & Reconnaissance] Map open network ports and service banners without volumetric probing that could trigger ISP throttles.Mandate: Safe Recon Standard
-
[Phase 3: Automated Probing & Fingerprinting] Run targeted vulnerability scans to identify known CVEs in web frameworks and underlying operating systems.Mandate: Baseline Vulnerability Scan
-
[Phase 3: Automated Probing & Fingerprinting] Fingerprint authentication mechanisms, session token structures (JWT/OAuth), and rate-limiting on OTP endpoints.Mandate: RBI 2FA Verification
-
[Phase 4: Deep Manual Exploitation] Manually test authorization boundaries: BOLA / IDOR by mutating user IDs across REST and GraphQL endpoints.Mandate: OWASP API Top 10
-
[Phase 4: Deep Manual Exploitation] Probe for injection flaws (SQL, NoSQL, SSRF, Template Injection) using non-destructive canary payloads.Mandate: Safe Canary Probing
-
[Phase 4: Deep Manual Exploitation] Test business logic flaws: cart price tampering, race conditions on financial fund transfers, and SMS OTP bypasses.Mandate: NPCI / Payment Core Safety
-
[Phase 5: Reporting & Retesting] Compile findings into Executive Summary and Technical Dossier with CVSS v3.1/v4.0 scoring.Mandate: CERT-In Report Format
-
[Phase 5: Reporting & Retesting] Provide developers with exact cURL reproduction commands and framework-specific code remediation snippets.Mandate: Developer Actionable PoC
-
[Phase 5: Reporting & Retesting] Re-test resolved vulnerabilities within 30 days and issue official Attestation of Security Testing Certificate.Mandate: Regulatory Filing Attestation
In India, conducting a VAPT is not just a security best practice—it is a statutory requirement under Section 70B of the IT Act 2000, RBI Cyber Security Framework for Banks, and SEBI CSCRF for market intermediaries. If a critical vulnerability is actively exploited, it triggers the mandatory 6-hour disclosure window to CERT-In.
1. Why Most Enterprise VAPT Engagements Fail
Many organizations procure a "VAPT" only to receive a 250-page automated PDF scanner export filled with false positives, missing SSL ciphers, and zero business logic flaws. A true enterprise penetration test is 80% manual human investigation by certified ethical hackers (CEH, PenTest+) and 20% automated baseline scanning.
2. Phase-by-Phase Technical Execution
1 Scoping & Safeguarded RoE
Establish strict target boundaries. Whitelist testing IPs on perimeter WAFs and Cloudflare. Ensure zero destructive stress testing (no volumetric DoS or unconstrained DROP TABLE queries).
2 Authentication & Privilege Escalation
Test horizontal and vertical access controls. In Banking and FinTech cores, test whether a Branch Clerk can execute unauthorized approvals reserved for Branch Managers (BOLA / Broken Object Level Authorization).
3. Reproduction Standard: The 60-Second Developer Test
Every vulnerability reported in a BlueCiphr dossier must be reproducible by a backend engineer in under 60 seconds using a curl script or Postman request. Here is an example of an actionable Broken Object-Level Authorization (BOLA) reproduction:
curl -X POST https://api.enterprise.in/v1/accounts/statement/export \
-H "Authorization: Bearer [User_A_Token]" \
-H "Content-Type: application/json" \
-d '{"account_id": "ACC_VICTIM_9921", "export_format": "PDF"}'
4. Remediation Code Standard (Node.js & Python)
Security reports should never simply say "apply proper input validation." They must give developers the exact defensive code pattern:
const userAccount = await Account.findOne({ _id: req.body.account_id, ownerId: req.user._id });
if (!userAccount) {
return res.status(403).json({ error: "Access denied: Account does not belong to authenticated user" });
}
Need Accredited Auditors to Execute This Audit or Gap Assessment?
BlueCiphr's certified lead auditors (CEH Master, PenTest+, ISO 27001 Lead Auditors) conduct deep technical verification and produce board-ready evidence binders complying with RBI, SEBI CSCRF, CERT-In, and the DPDP Act 2023.