Audit name:
[PT] DuexCash | Web+API | Sep2025
Date:
Oct 21, 2025
Table of Content
Introduction
We express our gratitude to the DuexCash team for the collaborative engagement that enabled the execution of this Pentest.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for DuexCash |
| Audited By | |
| Approved By | |
| Website | https://duex.cash→ |
| Changelog | 10/10/2025 - Preliminary Report |
| Changelog | 21/10/2025 - Final Report |
| Platform | Web & API |
| Methodology | https://hackenio.cc/pentest_methodology→ |
Document
- Name
- Pentest and Security Analysis Report for DuexCash
- Audited By
- Approved By
- Website
- https://duex.cash→
- Changelog
- 10/10/2025 - Preliminary Report
- Changelog
- 21/10/2025 - Final Report
- Platform
- Web & API
- Methodology
- https://hackenio.cc/pentest_methodology→
Review Scope | |
|---|---|
| Web Application | https://duex.cash→ |
| API | https://duex.cash/api→ |
Review Scope
- Web Application
- https://duex.cash→
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
DuexCash presents itself as a next-generation cryptocurrency exchange built atop years of fintech development, combining professional expertise with direct input from early users. The platform’s founders initially focused on building and supporting financial technology systems, but eventually expanded into crypto markets when they recognized unmet demand from their client base.
The service promises a balance between simplicity, speed, and security: users are offered “instant and secure transactions” across a variety of digital assets, while also being reassured that “reliable data protection” is a core priority. The team emphasizes making crypto exchange accessible to all—striving to eliminate unnecessary complexity or risk in the user experience.
In summary, DuexCash positions itself as a user-centric crypto exchange that leverages fintech roots and customer feedback to deliver a platform where security, usability, and performance are central pillars.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-1347 | Default Admin Credentials Enabled on Partner Panel | fixed | Critical | |
| F-2025-1347 | Denial of Service (DoS) caused by unauthenticated directory enumeration. Application becomes unavailable during high-volume path fuzzing | fixed | High | |
| F-2025-1347 | Missing X-XSS-Protection Header | fixed | Observation |
Appendix 1. Severity Definitions
Findings are categorized based on their potential impact and assigned a severity level using the Common Vulnerability Scoring System (CVSS) version 4.0: →
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following:
Scope Details | |
|---|---|
| Web Application | https://duex.cash→ |
| API | https://duex.cash/api/→ |
Scope Details
- Web Application
- https://duex.cash→
Appendix 3. Additional Valuables
Frameworks and Methodologies
This security assessment was conducted in alignment with recognised penetration testing standards, methodologies and guidelines, including the NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment →, the Penetration Testing Execution Standard (PTES) →, and the OWASP Testing Guide →. These assets provide a structured foundation for planning, executing, and documenting technical evaluations such as vulnerability assessments, exploitation activities, and security code reviews. Hacken’s internal penetration testing methodology extends these principles to Web2 and Web3 environments to ensure consistency, repeatability, and verifiable outcomes.