Health Check · externe, autorisierte Bewertung · durchgeführt am 23. Oktober 2026 von Ionuț-Robert Sandu
Ein oder mehrere Probleme erlauben einem Angreifer die Übernahme oder Datenextraktion. Beheben Sie die kritischen Punkte zuerst.
| Entdeckte Subdomains | 12 |
|---|---|
| Geprüfte aktive Hosts | 3 |
| Offene Ports / Dienste | 22/ssh, 80/http, 443/https, 3000/grafana, 3306/mysql |
| Erkannte Technologien | nginx, PHP, WordPress, jQuery, Grafana |
| E-Mail-Authentifizierung | SPF vorhanden · DMARC fehlt · DNSSEC aus |
| Formulare / Eingabepunkte | 9 |
| Offengelegte Secrets im Code | 2 |
| API-Oberfläche (OpenAPI) | Gefunden |
Ob jedes Ziel für Malware oder Phishing markiert ist (Cloudflare-Bedrohungsdaten und URLhaus, wo verfügbar) und ob seine Mail- und Webserver-Adressen auf öffentlichen Spam-Blocklists erscheinen.
203.0.113.11 (mail server) auf UCEPROTECT L1
admin.northwind-retail.example:3306
The MySQL service on admin.northwind-retail.example accepts connections from any address on port 3306. An exposed database is a direct route to full data theft and ransomware.
Behebung. Bind MySQL to localhost or a private network and block 3306 at the firewall. Rotate database credentials.
https://api.northwind-retail.example
The API runs a PHP version affected by CVE-2024-4577, an argument-injection flaw that allows remote code execution and is being exploited in the wild.
Behebung. Update PHP to 8.3.8 / 8.2.20 / 8.1.29 or later immediately, or apply your distribution's patched package.
https://grafana.northwind-retail.example
The Grafana instance accepts the default admin/admin credentials, exposing dashboards and data sources — and often database passwords stored in them.
Behebung. Change the admin password, disable default accounts, and put Grafana behind SSO or a VPN.
https://www.northwind-retail.example/.git/config
The .git directory is served publicly. Attackers can download the full source code and any secrets committed to it.
Behebung. Block access to /.git in the web server and remove the directory from the web root.
staging-old.northwind-retail.example
staging-old.northwind-retail.example points to a decommissioned cloud host that is no longer claimed. An attacker can register it and serve content from your domain.
Behebung. Remove the dangling DNS record, or reclaim the resource it points to.
https://shop.northwind-retail.example/search?q=
The product search endpoint returns database errors for crafted input, indicating an injectable parameter. Confirmed exploitation is part of the App Pen Test.
Behebung. Use parameterized queries / prepared statements and validate input. Review the endpoint for data exposure.
https://www.northwind-retail.example
The web server still negotiates TLS 1.0/1.1, which are deprecated and vulnerable to downgrade attacks.
Behebung. Disable TLS 1.0 and 1.1; serve only TLS 1.2 and 1.3.
https://www.northwind-retail.example
The server offers CBC-mode and RSA-key-exchange ciphers without forward secrecy.
Behebung. Prefer ECDHE suites with AES-GCM; remove CBC and static-RSA ciphers.
https://www.northwind-retail.example
The CSP permits inline scripts, which weakens its protection against cross-site scripting.
Behebung. Move to nonce- or hash-based CSP and remove 'unsafe-inline'.
https://shop.northwind-retail.example
Without HSTS, browsers may connect over plain HTTP first, where traffic can be intercepted.
Behebung. Send Strict-Transport-Security: max-age=31536000; includeSubDomains.
northwind-retail.example
Listed on UCEPROTECT L1. Email sent from this server may land in spam or be rejected.
Behebung. Find what sent spam (a compromised mailbox, form or plugin), fix it, then request delisting on each list.
https://northwind-retail.example
DNS answers for this domain cannot be cryptographically verified.
Behebung. Enable DNSSEC at your DNS provider and add the DS record at your registrar.
https://northwind-retail.example
No enforcing DMARC record, so spoofed mail using this domain is not rejected.
Behebung. Publish a DMARC record and move to p=quarantine then p=reject.
https://www.northwind-retail.example
Full page addresses can leak to third-party sites through links.
Behebung. Send Referrer-Policy: strict-origin-when-cross-origin.
https://www.northwind-retail.example
Browser features are not restricted, widening the impact of a compromise.
Behebung. Send a Permissions-Policy limiting camera, microphone and geolocation.
https://shop.northwind-retail.example
Sensitive pages may be cached by browsers or proxies.
Behebung. Send Cache-Control: no-store on authenticated responses.
https://https://www.northwind-retail.example
A token was found in a public JS bundle. Confirm it is not a privileged credential.
Behebung. Move secrets server-side and rotate the exposed token.
Dies war eine externer health check nach Black-Box-Prinzip von northwind-retail.example, vom Kunden autorisiert. Wir haben die Angriffsfläche so kartiert wie ein Angreifer — ohne Zugangsdaten oder internen Zugriff — mit unserer Offensive-Toolchain (Subdomain-Erkennung, Port- und Dienst-Scanning, TLS- und Header-Analyse, Technologie-Fingerprinting und einem Schwachstellen-Scan mit Nuclei und OpenVAS); jeder Befund wurde von einem Sicherheitsingenieur geprüft.
Ausgeführte Module: whois, subdomain_discovery, dns_resolution, shodan_enrich, port_scan, nmap_scan, tlsx, http_probe, resource_enum, vuln_scan. Die Befunde spiegeln den Zustand der Ziele zum Zeitpunkt des Scans wider. Eine externe Bewertung kann nicht garantieren, dass keine Schwachstelle existiert; sie spiegelt wider, was aus dem Internet im vereinbarten Umfang erreichbar und testbar ist. Es wurden keine Denial-of-Service- oder destruktiven Tests durchgeführt.