Summit Property Group
Bedrock
Summit Property Group is a Denver-based property-management firm running a multi-service web stack: a public marketing site, a tenant portal, an applicant-intake form, an owners' dashboard with PDF generation, an internal staff admin panel, and a Metabase analytics deployment. Find every flag without insider access.
The Engagement
Summit's IT lead has asked for an external assessment after their external auditor flagged "broad attack surface, untested." You start as an anonymous attacker on the public marketing site and work your way through the apply funnel, the tenant portal, the owners' PDF pipeline, and the internal staff dashboard. Six flags, one engagement.
Background
Summit Property Group manages forty-one residential units across twelve buildings in north and east Denver. Their stack grew organically — a Wordpress marketing site got migrated to a static build last year, an Express applicant form was bolted on, the owners' dashboard was outsourced to a Laravel shop in Lima, the tenant portal is the original Django app written by a contractor in 2019, and Metabase was added during the last refinance to give partners visibility into rent rolls. Nothing here is brand-new — and that's the point. The vulnerabilities are the kind that real engagements turn up: a NoSQL injection on a forgotten admin login, an SSRF in a PDF-generation endpoint, an IDOR on a lease URL, a Metabase deployment pinned to a known-CVE version, and a staff dashboard the team forgot was reachable from the internal service mesh.
WebRanges are included in Pro+. Get the full platform for $19.99/mo.
Get Pro+Open in dashboardTechniques