Sample report · External network penetration test
Network Penetration Test
An external network penetration test that started cold on the internet — and finished inside private cloud infrastructure with administrative and IAM credentials in hand.
What happened
OSec breached the external perimeter, reached internal systems and private AWS infrastructure, and pulled administrative and IAM credentials from an uninitialized InfluxDB instance — a single critical chain, plus twelve more findings.
Scope. The external network perimeter, including internet-facing web applications and cloud infrastructure.
What’s inside
The report, section by section
- Executive summary
- Scope
- Rules of engagement
- Findings summary
- Walkthrough (step-by-step)
- Conclusion
The findings
- Uninitialized InfluxDB instance leading to account takeover
- GitLab username disclosure
- Source code disclosure
- Path traversal in file create
- Unauthenticated API access
- Unauthenticated GraphQL introspection enabled
- Username enumeration
- Insecure XML-RPC functions enabled
- API keys disclosed in source code
- CORS arbitrary origin sharing
- Host running an unmaintained operating system
- Vulnerable and outdated components
- Information disclosure via response headers
Client names, dates, hosts and other identifying details are redacted throughout. Everything else — findings, severity, method, and the walkthrough — is exactly as delivered.
The document
The full report, redacted.
All 44 pages, exactly as delivered. Download the PDF → or see all three →