Penetration Testing for Vehicle Dealerships in the UK

The Digital Footprint of a Modern Car Dealership

A vehicle dealership's online presence has grown substantially beyond a static inventory page. Today a typical UK dealership website handles finance pre-qualification enquiries, part-exchange valuations, service booking, online reservations with deposit payments, and customer account portals. Each of these functions introduces data collection, third-party integrations, and potential attack surface.

The data flowing through a dealership website is commercially sensitive and personally identifiable. Finance enquiries capture income details, employment status, and date of birth alongside contact information. Service records link vehicle registration plates to customer addresses. CRM integrations pull live data into the public-facing web tier.

This combination — regulated activity, PII, financial data, and complex integrations — makes dealership websites a worthwhile target for penetration testing.

Regulatory Context for UK Dealerships

Most vehicle dealerships offering finance products are regulated by the Financial Conduct Authority. FCA authorisation carries obligations around data security and operational resilience. The FCA expects firms to have adequate systems and controls, which includes protecting customer data handled in connection with regulated activities.

The FCA's operational resilience requirements, which came into full effect in 2022, require firms to identify their important business services and set impact tolerances for disruptions. For a dealership, an online finance portal or booking system could qualify as an important business service.

UK GDPR applies to all personal data processed by the dealership, including data collected via the website. The data categories collected — financial circumstances, employment, vehicle ownership — require appropriate technical security measures under Article 32.

What Attack Surface Does a Dealership Website Present

Finance application flows

Online finance calculators and pre-qualification forms are high-value targets. They handle sensitive personal data and often integrate with third-party finance platforms via API. API endpoints that accept finance application data should be tested for injection vulnerabilities, insecure direct object references, and improper authorisation controls that could allow one customer to access another's application status.

Part-exchange and valuation tools

Valuation tools that return price estimates based on registration plate lookups process vehicle registration data and often authenticate back-end requests with API keys embedded in the frontend JavaScript bundle. Exposed API keys can be extracted and used to make unauthorised requests.

Service booking portals

Booking systems that allow customers to view upcoming and past appointments represent an access control risk. If the booking reference or customer ID is predictable and the application does not enforce authorisation correctly, an attacker can enumerate other customers' appointment details — a classic insecure direct object reference vulnerability.

CRM and DMS integrations

Dealer Management Systems (DMS) integrate with the website to pull live stock data and push customer enquiries back to the sales team. These integrations use credentials and API connections that, if misconfigured, can be leveraged to access broader internal systems.

Staff login portals

Many dealership websites include staff-facing sections for managing stock, viewing leads, or processing bookings. Administrative portals are primary targets for credential attacks. Single-factor authentication, weak passwords, and login pages without brute-force protection are common weaknesses.

What a Penetration Test Covers

A web application penetration test for a vehicle dealership typically addresses the following:

**Injection testing** — Testing all input points (finance forms, search fields, contact forms, booking flows) for SQL injection, cross-site scripting, server-side template injection, and command injection vulnerabilities.

**Authentication and session security** — Assessing login pages for brute-force protection, testing session token randomness and expiry, checking for insecure password reset flows, and verifying multi-factor authentication where implemented.

**Authorisation controls** — Attempting to access other users' data by manipulating identifiers in requests. Testing whether a logged-in customer can view appointments, orders, or finance applications belonging to other customers.

**API security** — Reviewing API endpoints for proper authentication, testing for excessive data exposure in responses, checking for GraphQL introspection that reveals internal data structures, and testing rate limiting.

**Third-party integrations** — Identifying API keys and credentials exposed in frontend JavaScript, checking CORS configuration on API endpoints, and assessing the security of iframe-embedded finance tools.

**Information disclosure** — Checking for exposed configuration files, package manifests, error messages revealing internal paths, and server banners that assist fingerprinting.

**Email authentication** — Verifying SPF, DKIM, and DMARC records that prevent attackers from spoofing the dealership's email domain to target customers with phishing messages.

The Specific Risk of Exposed Finance API Keys

This deserves particular attention. Finance calculator tools — used to show estimated monthly payments — often make requests to third-party pricing APIs. Those API keys are sometimes embedded in the page's JavaScript or sent in request headers that are visible in browser developer tools.

An attacker who extracts a finance platform API key can make requests to that platform directly, potentially accessing rate data, customer records, or application processing functions depending on what the key is scoped to. In a regulated context, this is a significant compliance concern alongside the security risk.

A penetration test that reviews the client-side JavaScript bundle for embedded credentials and tests the associated API endpoints is standard practice and directly relevant for dealerships.

After the Test: What Dealerships Typically Find and Fix

Common findings in dealership web assessments include missing security headers (particularly Content-Security-Policy and X-Frame-Options), login pages without account lockout mechanisms, exposed dependency manifests (/package.json, /composer.json) that reveal software versions to attackers, and CORS misconfiguration on API endpoints that allows cross-origin requests from arbitrary domains.

Less commonly but more seriously, assessments uncover IDOR vulnerabilities in booking and enquiry flows, and exposed API credentials in JavaScript bundles.

Remediation is typically handled by the dealership's web development partner or platform provider. A clear, prioritised penetration test report makes it straightforward to brief an external developer on what needs fixing without requiring them to repeat the assessment work.

Yrzo AI delivers 44 automated security checks with a full written report in under 20 minutes. Starting from £399 at yrzoai.dev.