Sample report · External network penetration test
Network Penetration Test
An external network penetration test that started cold on the internet — and finished inside private cloud infrastructure with administrative and IAM credentials in hand.
What happened
OSec breached the external perimeter, reached internal systems and private AWS infrastructure, and pulled administrative and IAM credentials from an uninitialised InfluxDB instance — a single critical chain, plus twelve more findings.
Scope. The external network perimeter, including internet-facing web applications and cloud infrastructure.
What’s inside
The report, section by section
- Executive summary
- Scope
- Rules of engagement
- Findings summary
- Walkthrough (step-by-step)
- Conclusion
The findings
- Uninitialised InfluxDB instance leading to account takeover
- GitLab username disclosure
- Source code disclosure
- Path traversal in file create
- Unauthenticated API access
- Unauthenticated GraphQL introspection enabled
- Username enumeration
- Insecure XML-RPC functions enabled
- API keys disclosed in source code
- CORS arbitrary origin sharing
- Host running an unmaintained operating system
- Vulnerable and outdated components
- Information disclosure via response headers
Client names, dates, hosts and other identifying details are redacted throughout. Everything else — findings, severity, method, and the walkthrough — is exactly as delivered.
The document
Read the full redacted report.
PDF not showing? Get a downloadable copy →
Take it with you
Get the PDF, plus all three sample reports.
You’ve read it here. Drop your email and we’ll send this report, plus the other two, as downloadable PDFs.