Health Check · évaluation externe et autorisée · réalisée le 23 octobre 2026 par Ionuț-Robert Sandu
Un ou plusieurs problèmes permettent à un attaquant de prendre le contrôle ou d'extraire des données. Corrigez les éléments critiques en priorité.
| Sous-domaines découverts | 12 |
|---|---|
| Hôtes actifs sondés | 3 |
| Ports / services ouverts | 22/ssh, 80/http, 443/https, 3000/grafana, 3306/mysql |
| Technologies identifiées | nginx, PHP, WordPress, jQuery, Grafana |
| Authentification e-mail | SPF présent · DMARC manquant · DNSSEC désactivé |
| Formulaires / points d'entrée | 9 |
| Secrets exposés dans le code | 2 |
| Surface d'API (OpenAPI) | Trouvé |
Si chaque cible est signalée pour malware ou phishing (renseignements Cloudflare, et URLhaus le cas échéant), et si les adresses de ses serveurs mail et web figurent sur des listes publiques de blocage du spam.
203.0.113.11 (mail server) sur UCEPROTECT L1
admin.northwind-retail.example:3306
The MySQL service on admin.northwind-retail.example accepts connections from any address on port 3306. An exposed database is a direct route to full data theft and ransomware.
Remédiation. Bind MySQL to localhost or a private network and block 3306 at the firewall. Rotate database credentials.
https://api.northwind-retail.example
The API runs a PHP version affected by CVE-2024-4577, an argument-injection flaw that allows remote code execution and is being exploited in the wild.
Remédiation. Update PHP to 8.3.8 / 8.2.20 / 8.1.29 or later immediately, or apply your distribution's patched package.
https://grafana.northwind-retail.example
The Grafana instance accepts the default admin/admin credentials, exposing dashboards and data sources — and often database passwords stored in them.
Remédiation. Change the admin password, disable default accounts, and put Grafana behind SSO or a VPN.
https://www.northwind-retail.example/.git/config
The .git directory is served publicly. Attackers can download the full source code and any secrets committed to it.
Remédiation. Block access to /.git in the web server and remove the directory from the web root.
staging-old.northwind-retail.example
staging-old.northwind-retail.example points to a decommissioned cloud host that is no longer claimed. An attacker can register it and serve content from your domain.
Remédiation. Remove the dangling DNS record, or reclaim the resource it points to.
https://shop.northwind-retail.example/search?q=
The product search endpoint returns database errors for crafted input, indicating an injectable parameter. Confirmed exploitation is part of the App Pen Test.
Remédiation. Use parameterized queries / prepared statements and validate input. Review the endpoint for data exposure.
https://www.northwind-retail.example
The web server still negotiates TLS 1.0/1.1, which are deprecated and vulnerable to downgrade attacks.
Remédiation. Disable TLS 1.0 and 1.1; serve only TLS 1.2 and 1.3.
https://www.northwind-retail.example
The server offers CBC-mode and RSA-key-exchange ciphers without forward secrecy.
Remédiation. Prefer ECDHE suites with AES-GCM; remove CBC and static-RSA ciphers.
https://www.northwind-retail.example
The CSP permits inline scripts, which weakens its protection against cross-site scripting.
Remédiation. Move to nonce- or hash-based CSP and remove 'unsafe-inline'.
https://shop.northwind-retail.example
Without HSTS, browsers may connect over plain HTTP first, where traffic can be intercepted.
Remédiation. Send Strict-Transport-Security: max-age=31536000; includeSubDomains.
northwind-retail.example
Listed on UCEPROTECT L1. Email sent from this server may land in spam or be rejected.
Remédiation. Find what sent spam (a compromised mailbox, form or plugin), fix it, then request delisting on each list.
https://northwind-retail.example
DNS answers for this domain cannot be cryptographically verified.
Remédiation. Enable DNSSEC at your DNS provider and add the DS record at your registrar.
https://northwind-retail.example
No enforcing DMARC record, so spoofed mail using this domain is not rejected.
Remédiation. Publish a DMARC record and move to p=quarantine then p=reject.
https://www.northwind-retail.example
Full page addresses can leak to third-party sites through links.
Remédiation. Send Referrer-Policy: strict-origin-when-cross-origin.
https://www.northwind-retail.example
Browser features are not restricted, widening the impact of a compromise.
Remédiation. Send a Permissions-Policy limiting camera, microphone and geolocation.
https://shop.northwind-retail.example
Sensitive pages may be cached by browsers or proxies.
Remédiation. Send Cache-Control: no-store on authenticated responses.
https://https://www.northwind-retail.example
A token was found in a public JS bundle. Confirm it is not a privileged credential.
Remédiation. Move secrets server-side and rotate the exposed token.
Il s'agissait d'une health check externe en boîte noire de northwind-retail.example, autorisée par le client. Nous avons cartographié la surface d'attaque comme le ferait un attaquant — sans identifiants ni accès interne — avec notre chaîne d'outils offensive (découverte de sous-domaines, scan de ports et services, analyse TLS et en-têtes, empreinte des technologies et une analyse des vulnérabilités avec Nuclei et OpenVAS), chaque découverte étant examinée par un ingénieur en sécurité.
Modules exécutés : whois, subdomain_discovery, dns_resolution, shodan_enrich, port_scan, nmap_scan, tlsx, http_probe, resource_enum, vuln_scan. Les découvertes reflètent l'état des cibles au moment du scan. Une évaluation externe ne peut garantir l'absence de vulnérabilité ; elle reflète ce qui est accessible et testable depuis Internet dans le périmètre convenu. Aucun test de déni de service ni destructeur n'a été effectué.