🔍 Breaking Down a Healthcare Web Application: A Complete VAPT Walkthrough .

Healthcare platforms hold some of the most sensitive data imaginable patient records, medical histories, and personal identifiable information (PII). So when I set out to perform a Vulnerability Assessment & Penetration Test (VAPT) on a healthcare web application, my goal was clear: find every weakness before a real attacker does.

In this post, I'll walk you through my complete methodology from reconnaissance to exploitation the exact tools I used, the vulnerabilities I discovered (including a Critical XSS and an unrestricted file upload), and what developers can do to fix them.

📋 Table of Contents

1. Introduction & Scope

2. Methodology & Approach

3. Tools Used

4. Step-by-Step Testing Process

5. Findings & Vulnerabilities

6. Impact Analysis

7. Recommendations

8. Conclusion

1️⃣ Introduction

Objective: To conduct a comprehensive Vulnerability Assessment and Penetration Test (VAPT) on a healthcare platform to identify security weaknesses that could be exploited by malicious actors.

Scope:

· Web application security testing

· Input validation vulnerabilities

· File upload security

· Configuration security

· Information disclosure

Timeline: ~5 hours total — Reconnaissance: 1 hour · Active Testing: 3 hours · Documentation: 1 hour

2️⃣ Methodology & Approach

I followed a structured, industry-standard methodology to ensure nothing was missed:

VAPT METHODOLOGY ─────────────────────────────────────────

1. Reconnaissance ↓
2. Information Gathering ↓
3. Vulnerability Identification ↓
4. Exploitation / POC Testing ↓
5. Documentation & Reporting ↓
6. Recommendations

Frameworks referenced throughout:

· OWASP Top 10 (2021) — primary vulnerability reference

· WSTG (Web Security Testing Guide) — testing procedures

· PTES (Penetration Testing Execution Standard) — methodology

3️⃣ Tools Used : Reconnaissance

🌐 Web Application Testing

⚡ Vulnerability Assessment

Environment: Kali Linux on VirtualBox — a complete penetration testing distribution.

4️⃣ Step-by-Step Testing Process

STEP 1: Reconnaissance (Information Gathering)

1. DNS Lookup nslookup healthcare-..*****************.

2. Technology Detection whatweb https://healthc…………………….

3. Connectivity Test ping -c 5 healthca.***************************.app

Output:

❯ Server: G……….. ❯ IP: 216.1*0..* ❯ Technology: HTML5, JavaScript ❯ Email: info@h***********.***

What I discovered:

· ✅ Server is hosted on ………..

· ✅ Site uses HTML5 & JavaScript

· ✅ Business email exposed: info@h***********.***