Bridging the Gap: Elevating Red Team Assessments with Application Security Testing

Mandiant describes integrating AppSec specialists into Red Team engagements to improve external perimeter coverage, with a case study where a decompiled mobile app revealed a hardcoded API key. Using that key, the team exploited a server-side request forgery (SSRF) and chained it to a ViewState deserialization vulnerability in an internal document management application—obtaining a reliable foothold in the target's internal network.