Hollowpath Assessment Report

Mode: external
Target: acme-demo.com
Profile: standard
Generated at: 2026-07-14T11:00:00Z

Executive Summary

Assets: 6
Services: 11
Findings: 11
Exploit candidates: 2

Severity	Count
critical	1
high	2
medium	3
low	3
info	2
unknown	0

Scope

ALLOW: acme-demo.com
ALLOW: *.acme-demo.com

Attack Surface / Asset Inventory

Asset	IP	Hostname
api.acme-demo.com	203.0.113.11	api.acme-demo.com
dev.acme-demo.com	192.0.2.31	dev.acme-demo.com
files.acme-demo.com	192.0.2.30	files.acme-demo.com
mail.acme-demo.com	198.51.100.21	mail.acme-demo.com
vpn.acme-demo.com	198.51.100.20	vpn.acme-demo.com
www.acme-demo.com	203.0.113.10	www.acme-demo.com

Services & Exposed Technologies

Asset	Port	Proto	Service	Product	Version
api.acme-demo.com	443	tcp	https	nginx	1.24.0
dev.acme-demo.com	22	tcp	ssh	OpenSSH	8.2p1
dev.acme-demo.com	8080	tcp	http	Werkzeug	2.0.1
files.acme-demo.com	21	tcp	ftp	vsftpd	3.0.3
files.acme-demo.com	445	tcp	microsoft-ds	Samba	4.7.6
mail.acme-demo.com	25	tcp	smtp	Postfix	3.4.13
mail.acme-demo.com	143	tcp	imap	Dovecot	2.3.4
vpn.acme-demo.com	22	tcp	ssh	OpenSSH	7.6p1
vpn.acme-demo.com	8443	tcp	https-alt	unknown	unknown
www.acme-demo.com	80	tcp	http	nginx	1.18.0
www.acme-demo.com	443	tcp	https	nginx	1.18.0

Findings

[CRITICAL] Default credentials accepted on exposed management interface

Asset: vpn.acme-demo.com
Service: 8443/https-alt
Category: vulnerability
Confidence: high
Verification: verified
Discovered: 2026-07-14T09:41:17Z

The management interface on vpn.acme-demo.com:8443 accepted a vendor default credential pair. This grants administrative access to the device without any prior authorization step.

[HIGH] SMB share allows unauthenticated (anonymous) read access

Asset: files.acme-demo.com
Service: 445/microsoft-ds
Category: vulnerability
Confidence: high
Verification: verified
Discovered: 2026-07-14T09:55:40Z

files.acme-demo.com exposes an SMB share ('backups') that permits anonymous listing and read access. The share contained non-sensitive synthetic sample files for the purpose of this demonstration.

[HIGH] Outdated OpenSSH version predates several patched authentication issues

Asset: vpn.acme-demo.com
Service: 22/ssh
Category: vulnerability
Confidence: high
Verification: verified
Discovered: 2026-07-14T09:12:03Z

vpn.acme-demo.com:22 is running OpenSSH 7.6p1, an end-of-life release. Several authentication and cryptography issues fixed in later OpenSSH releases are not present in this version. No exploitation was attempted against this finding.

[MEDIUM] Anonymous FTP login enabled

Asset: files.acme-demo.com
Service: 21/ftp
Category: vulnerability
Confidence: high
Verification: verified
Discovered: 2026-07-14T10:02:11Z

vsftpd on files.acme-demo.com accepts the 'anonymous' account with no password, exposing directory listings over an unencrypted protocol.

[MEDIUM] Directory listing enabled on /backup/

Asset: www.acme-demo.com
Service: 443/https
Category: vulnerability
Confidence: high
Verification: verified
Discovered: 2026-07-14T10:10:02Z

Requesting https://www.acme-demo.com/backup/ returns a directory index rather than a 403/404, exposing filenames that should not be enumerable.

[MEDIUM] TLS certificate uses a deprecated signature algorithm

Asset: www.acme-demo.com
Service: 443/https
Category: vulnerability
Confidence: medium
Verification: unverified
Discovered: 2026-07-14T09:20:55Z

The certificate served on www.acme-demo.com:443 is signed with SHA-1, which is deprecated and rejected by modern browsers ahead of schedule in some configurations.

[LOW] Verbose application errors disclose internal file paths

Asset: api.acme-demo.com
Service: 443/https
Category: vulnerability
Confidence: high
Verification: verified
Discovered: 2026-07-14T10:22:47Z

A malformed request to api.acme-demo.com returns a stack trace including internal filesystem paths and framework version details.

[LOW] Missing HTTP security headers

Asset: www.acme-demo.com
Service: 443/https
Category: vulnerability
Confidence: high
Verification: verified
Discovered: 2026-07-14T09:18:30Z

Responses from www.acme-demo.com do not set Content-Security-Policy, X-Content-Type-Options, or Strict-Transport-Security.

[LOW] Outdated jQuery version identified

Asset: www.acme-demo.com
Service: 443/https
Category: detection
Confidence: medium
Verification: unverified
Discovered: 2026-07-14T09:25:14Z

Page source on www.acme-demo.com references jQuery 1.12.4, an unmaintained release. Flagged by technology fingerprinting; not independently exploited.

[INFO] SMTP banner discloses Postfix version

Asset: mail.acme-demo.com
Service: 25/smtp
Category: observation
Confidence: high
Verification: verified
Discovered: unknown

mail.acme-demo.com:25 returns its exact Postfix version in the banner, useful for an attacker fingerprinting the mail stack.

[INFO] robots.txt discloses internal path structure

Asset: www.acme-demo.com
Category: observation
Confidence: high
Verification: verified
Discovered: 2026-07-14T09:05:02Z

www.acme-demo.com/robots.txt lists several disallowed paths (/internal-admin/, /staging/) that reveal application structure to an attacker even though they are not directly linked from the site.

Exploit Intelligence

The candidates below were identified by a SearchSploit/Metasploit search and confidence-scored against the detected service banner. Their presence indicates a POTENTIAL MATCH ONLY — it does NOT confirm the target is actually exploitable, vulnerable, or that any candidate has been executed.

Source	Title	Confidence	Reference	EDB-ID
Metasploit Framework	auxiliary/scanner/smb/smb_enumshares	high	smb_enumshares	—
ExploitDB / SearchSploit	OpenSSH < 7.7 - User Enumeration	medium	45939	45939

Evidence

Source: httpx Kind: raw Collected: 2026-07-14T09:05:02Z

User-agent: *
Disallow: /internal-admin/
Disallow: /staging/
Disallow: /backup/

Source: nmap Kind: raw Collected: 2026-07-14T09:12:03Z Artifact: scans/nmap/vpn.acme-demo.com.xml

22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)

Source: httpx Kind: parsed Collected: 2026-07-14T09:18:30Z

content-security-policy: (absent)
x-content-type-options: (absent)
strict-transport-security: (absent)

Source: openssl Kind: parsed Collected: 2026-07-14T09:20:55Z

Signature Algorithm: sha1WithRSAEncryption
Not Before: 2025-02-11
Not After: 2027-02-11

Source: katana Kind: parsed Collected: 2026-07-14T09:25:14Z

script[src] matched: /assets/vendor/jquery-1.12.4.min.js

Source: manual-verification Kind: raw Collected: 2026-07-14T09:41:17Z

POST /login HTTP/1.1
Host: vpn.acme-demo.com:8443

username=admin&password=admin

HTTP/1.1 302 Found
Location: /dashboard

Source: smbclient Kind: raw Collected: 2026-07-14T09:55:40Z

smb: \> ls
  .                DA        0  Mon Jul 13 22:04:11 2026
  ..               DA        0  Mon Jul 13 22:04:11 2026
  quarterly-notes.txt   A     412  Mon Jul 13 22:03:58 2026

Source: manual-verification Kind: raw Collected: 2026-07-14T10:02:11Z

220 (vsFTPd 3.0.3)
USER anonymous
331 Please specify the password.
PASS 
230 Login successful.

Source: httpx Kind: raw Collected: 2026-07-14T10:10:02Z

GET /backup/ -> 200 OK
Index of /backup/
backup-2026-06-01.tar.gz  14-Jun-2026 03:00  842M

Source: manual-verification Kind: raw Collected: 2026-07-14T10:22:47Z

Traceback (most recent call last):
  File "/srv/acme-api/app.py", line 118, in handle
    raise ValueError(payload)
ValueError: invalid payload

Technical Appendix

Tools: httpx, katana, manual-verification, nmap, openssl, smbclient

Artifact paths:

scans/nmap/vpn.acme-demo.com.xml