Health Check · external, authorized assessment · conducted 23 October 2026 by Ionuț-Robert Sandu
One or more issues let an attacker take over or extract data. Fix the critical items before anything else.
| Subdomains discovered | 12 |
|---|---|
| Live hosts probed | 3 |
| Open ports / services | 22/ssh, 80/http, 443/https, 3000/grafana, 3306/mysql |
| Technologies identified | nginx, PHP, WordPress, jQuery, Grafana |
| Email authentication | SPF present · DMARC missing · DNSSEC off |
| Forms / input points | 9 |
| Exposed secrets in code | 2 |
| API surface (OpenAPI) | Found |
Whether each target is flagged for malware or phishing (Cloudflare threat intelligence, and URLhaus where available), and whether its mail and web server addresses appear on public spam blocklists.
203.0.113.11 (mail server) on UCEPROTECT L1
admin.northwind-retail.example:3306
The MySQL service on admin.northwind-retail.example accepts connections from any address on port 3306. An exposed database is a direct route to full data theft and ransomware.
Remediation. Bind MySQL to localhost or a private network and block 3306 at the firewall. Rotate database credentials.
https://api.northwind-retail.example
The API runs a PHP version affected by CVE-2024-4577, an argument-injection flaw that allows remote code execution and is being exploited in the wild.
Remediation. Update PHP to 8.3.8 / 8.2.20 / 8.1.29 or later immediately, or apply your distribution's patched package.
https://grafana.northwind-retail.example
The Grafana instance accepts the default admin/admin credentials, exposing dashboards and data sources — and often database passwords stored in them.
Remediation. Change the admin password, disable default accounts, and put Grafana behind SSO or a VPN.
https://www.northwind-retail.example/.git/config
The .git directory is served publicly. Attackers can download the full source code and any secrets committed to it.
Remediation. Block access to /.git in the web server and remove the directory from the web root.
staging-old.northwind-retail.example
staging-old.northwind-retail.example points to a decommissioned cloud host that is no longer claimed. An attacker can register it and serve content from your domain.
Remediation. Remove the dangling DNS record, or reclaim the resource it points to.
https://shop.northwind-retail.example/search?q=
The product search endpoint returns database errors for crafted input, indicating an injectable parameter. Confirmed exploitation is part of the App Pen Test.
Remediation. Use parameterized queries / prepared statements and validate input. Review the endpoint for data exposure.
https://www.northwind-retail.example
The web server still negotiates TLS 1.0/1.1, which are deprecated and vulnerable to downgrade attacks.
Remediation. Disable TLS 1.0 and 1.1; serve only TLS 1.2 and 1.3.
https://www.northwind-retail.example
The server offers CBC-mode and RSA-key-exchange ciphers without forward secrecy.
Remediation. Prefer ECDHE suites with AES-GCM; remove CBC and static-RSA ciphers.
https://www.northwind-retail.example
The CSP permits inline scripts, which weakens its protection against cross-site scripting.
Remediation. Move to nonce- or hash-based CSP and remove 'unsafe-inline'.
https://shop.northwind-retail.example
Without HSTS, browsers may connect over plain HTTP first, where traffic can be intercepted.
Remediation. Send Strict-Transport-Security: max-age=31536000; includeSubDomains.
northwind-retail.example
Listed on UCEPROTECT L1. Email sent from this server may land in spam or be rejected.
Remediation. Find what sent spam (a compromised mailbox, form or plugin), fix it, then request delisting on each list.
https://northwind-retail.example
DNS answers for this domain cannot be cryptographically verified.
Remediation. Enable DNSSEC at your DNS provider and add the DS record at your registrar.
https://northwind-retail.example
No enforcing DMARC record, so spoofed mail using this domain is not rejected.
Remediation. Publish a DMARC record and move to p=quarantine then p=reject.
https://www.northwind-retail.example
Full page addresses can leak to third-party sites through links.
Remediation. Send Referrer-Policy: strict-origin-when-cross-origin.
https://www.northwind-retail.example
Browser features are not restricted, widening the impact of a compromise.
Remediation. Send a Permissions-Policy limiting camera, microphone and geolocation.
https://shop.northwind-retail.example
Sensitive pages may be cached by browsers or proxies.
Remediation. Send Cache-Control: no-store on authenticated responses.
https://https://www.northwind-retail.example
A token was found in a public JS bundle. Confirm it is not a privileged credential.
Remediation. Move secrets server-side and rotate the exposed token.
This was an external, black-box health check of northwind-retail.example, authorized by the client. We mapped the attack surface the way an attacker would — no credentials or internal access — using the RedAmon toolchain (subdomain discovery, port and service scanning, TLS and header analysis, technology fingerprinting, and a vulnerability scan with Nuclei and OpenVAS), with every finding reviewed by a security engineer.
Modules run: whois, subdomain_discovery, dns_resolution, shodan_enrich, port_scan, nmap_scan, tlsx, http_probe, resource_enum, vuln_scan. Findings reflect the state of the targets at the time of the scan. An external assessment cannot guarantee that no vulnerability exists; it reflects what is reachable and testable from the internet within the agreed scope. No denial-of-service or destructive testing was performed.