# Hollowpath Assessment Report

- **Mode:** external
- **Target:** acme\-demo\.com
- **Profile:** standard
- **Generated at:** 2026\-07\-14T11:00:00Z

## Executive Summary

- Assets: 6
- Services: 11
- Findings: 11
- Exploit candidates: 2

| Severity | Count |
|---|---|
| critical | 1 |
| high | 2 |
| medium | 3 |
| low | 3 |
| info | 2 |
| unknown | 0 |

## Scope

- ALLOW: `acme\-demo\.com`
- ALLOW: `\*\.acme\-demo\.com`

## Attack Surface / Asset Inventory

| Asset | IP | Hostname |
|---|---|---|
| api\.acme\-demo\.com | 203\.0\.113\.11 | api\.acme\-demo\.com |
| dev\.acme\-demo\.com | 192\.0\.2\.31 | dev\.acme\-demo\.com |
| files\.acme\-demo\.com | 192\.0\.2\.30 | files\.acme\-demo\.com |
| mail\.acme\-demo\.com | 198\.51\.100\.21 | mail\.acme\-demo\.com |
| vpn\.acme\-demo\.com | 198\.51\.100\.20 | vpn\.acme\-demo\.com |
| www\.acme\-demo\.com | 203\.0\.113\.10 | www\.acme\-demo\.com |

## Services & Exposed Technologies

| Asset | Port | Proto | Service | Product | Version |
|---|---|---|---|---|---|
| api\.acme\-demo\.com | 443 | tcp | https | nginx | 1\.24\.0 |
| dev\.acme\-demo\.com | 22 | tcp | ssh | OpenSSH | 8\.2p1 |
| dev\.acme\-demo\.com | 8080 | tcp | http | Werkzeug | 2\.0\.1 |
| files\.acme\-demo\.com | 21 | tcp | ftp | vsftpd | 3\.0\.3 |
| files\.acme\-demo\.com | 445 | tcp | microsoft\-ds | Samba | 4\.7\.6 |
| mail\.acme\-demo\.com | 25 | tcp | smtp | Postfix | 3\.4\.13 |
| mail\.acme\-demo\.com | 143 | tcp | imap | Dovecot | 2\.3\.4 |
| vpn\.acme\-demo\.com | 22 | tcp | ssh | OpenSSH | 7\.6p1 |
| vpn\.acme\-demo\.com | 8443 | tcp | https\-alt | unknown | unknown |
| www\.acme\-demo\.com | 80 | tcp | http | nginx | 1\.18\.0 |
| www\.acme\-demo\.com | 443 | tcp | https | nginx | 1\.18\.0 |

## Findings

### [CRITICAL] Default credentials accepted on exposed management interface

- **Asset:** vpn\.acme\-demo\.com
- **Service:** 8443/https\-alt
- **Category:** vulnerability
- **Confidence:** high
- **Verification:** verified
- **Discovered:** 2026\-07\-14T09:41:17Z

The management interface on vpn\.acme\-demo\.com:8443 accepted a vendor default credential pair\. This grants administrative access to the device without any prior authorization step\.

### [HIGH] SMB share allows unauthenticated \(anonymous\) read access

- **Asset:** files\.acme\-demo\.com
- **Service:** 445/microsoft\-ds
- **Category:** vulnerability
- **Confidence:** high
- **Verification:** verified
- **Discovered:** 2026\-07\-14T09:55:40Z

files\.acme\-demo\.com exposes an SMB share \('backups'\) that permits anonymous listing and read access\. The share contained non\-sensitive synthetic sample files for the purpose of this demonstration\.

### [HIGH] Outdated OpenSSH version predates several patched authentication issues

- **Asset:** vpn\.acme\-demo\.com
- **Service:** 22/ssh
- **Category:** vulnerability
- **Confidence:** high
- **Verification:** verified
- **Discovered:** 2026\-07\-14T09:12:03Z

vpn\.acme\-demo\.com:22 is running OpenSSH 7\.6p1, an end\-of\-life release\. Several authentication and cryptography issues fixed in later OpenSSH releases are not present in this version\. No exploitation was attempted against this finding\.

### [MEDIUM] Anonymous FTP login enabled

- **Asset:** files\.acme\-demo\.com
- **Service:** 21/ftp
- **Category:** vulnerability
- **Confidence:** high
- **Verification:** verified
- **Discovered:** 2026\-07\-14T10:02:11Z

vsftpd on files\.acme\-demo\.com accepts the 'anonymous' account with no password, exposing directory listings over an unencrypted protocol\.

### [MEDIUM] Directory listing enabled on /backup/

- **Asset:** www\.acme\-demo\.com
- **Service:** 443/https
- **Category:** vulnerability
- **Confidence:** high
- **Verification:** verified
- **Discovered:** 2026\-07\-14T10:10:02Z

Requesting https://www\.acme\-demo\.com/backup/ returns a directory index rather than a 403/404, exposing filenames that should not be enumerable\.

### [MEDIUM] TLS certificate uses a deprecated signature algorithm

- **Asset:** www\.acme\-demo\.com
- **Service:** 443/https
- **Category:** vulnerability
- **Confidence:** medium
- **Verification:** unverified
- **Discovered:** 2026\-07\-14T09:20:55Z

The certificate served on www\.acme\-demo\.com:443 is signed with SHA\-1, which is deprecated and rejected by modern browsers ahead of schedule in some configurations\.

### [LOW] Verbose application errors disclose internal file paths

- **Asset:** api\.acme\-demo\.com
- **Service:** 443/https
- **Category:** vulnerability
- **Confidence:** high
- **Verification:** verified
- **Discovered:** 2026\-07\-14T10:22:47Z

A malformed request to api\.acme\-demo\.com returns a stack trace including internal filesystem paths and framework version details\.

### [LOW] Missing HTTP security headers

- **Asset:** www\.acme\-demo\.com
- **Service:** 443/https
- **Category:** vulnerability
- **Confidence:** high
- **Verification:** verified
- **Discovered:** 2026\-07\-14T09:18:30Z

Responses from www\.acme\-demo\.com do not set Content\-Security\-Policy, X\-Content\-Type\-Options, or Strict\-Transport\-Security\.

### [LOW] Outdated jQuery version identified

- **Asset:** www\.acme\-demo\.com
- **Service:** 443/https
- **Category:** detection
- **Confidence:** medium
- **Verification:** unverified
- **Discovered:** 2026\-07\-14T09:25:14Z

Page source on www\.acme\-demo\.com references jQuery 1\.12\.4, an unmaintained release\. Flagged by technology fingerprinting; not independently exploited\.

### [INFO] SMTP banner discloses Postfix version

- **Asset:** mail\.acme\-demo\.com
- **Service:** 25/smtp
- **Category:** observation
- **Confidence:** high
- **Verification:** verified
- **Discovered:** unknown

mail\.acme\-demo\.com:25 returns its exact Postfix version in the banner, useful for an attacker fingerprinting the mail stack\.

### [INFO] robots\.txt discloses internal path structure

- **Asset:** www\.acme\-demo\.com
- **Category:** observation
- **Confidence:** high
- **Verification:** verified
- **Discovered:** 2026\-07\-14T09:05:02Z

www\.acme\-demo\.com/robots\.txt lists several disallowed paths \(/internal\-admin/, /staging/\) that reveal application structure to an attacker even though they are not directly linked from the site\.


## Exploit Intelligence

> The candidates below were identified by a SearchSploit/Metasploit search and confidence\-scored against the detected service banner\. Their presence indicates a POTENTIAL MATCH ONLY — it does NOT confirm the target is actually exploitable, vulnerable, or that any candidate has been executed\.

| Source | Title | Confidence | Reference | EDB-ID |
|---|---|---|---|---|
| Metasploit Framework | auxiliary/scanner/smb/smb\_enumshares | high | smb\_enumshares | — |
| ExploitDB / SearchSploit | OpenSSH < 7\.7 \- User Enumeration | medium | 45939 | 45939 |

## Evidence

- **Source:** httpx  **Kind:** raw  **Collected:** 2026\-07\-14T09:05:02Z
```
User-agent: *
Disallow: /internal-admin/
Disallow: /staging/
Disallow: /backup/
```

- **Source:** nmap  **Kind:** raw  **Collected:** 2026\-07\-14T09:12:03Z
  **Artifact:** `scans/nmap/vpn\.acme\-demo\.com\.xml`
```
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
```

- **Source:** httpx  **Kind:** parsed  **Collected:** 2026\-07\-14T09:18:30Z
```
content-security-policy: (absent)
x-content-type-options: (absent)
strict-transport-security: (absent)
```

- **Source:** openssl  **Kind:** parsed  **Collected:** 2026\-07\-14T09:20:55Z
```
Signature Algorithm: sha1WithRSAEncryption
Not Before: 2025-02-11
Not After: 2027-02-11
```

- **Source:** katana  **Kind:** parsed  **Collected:** 2026\-07\-14T09:25:14Z
```
script[src] matched: /assets/vendor/jquery-1.12.4.min.js
```

- **Source:** manual\-verification  **Kind:** raw  **Collected:** 2026\-07\-14T09:41:17Z
```
POST /login HTTP/1.1
Host: vpn.acme-demo.com:8443

username=admin&password=admin

HTTP/1.1 302 Found
Location: /dashboard
```

- **Source:** smbclient  **Kind:** raw  **Collected:** 2026\-07\-14T09:55:40Z
```
smb: \> ls
  .                DA        0  Mon Jul 13 22:04:11 2026
  ..               DA        0  Mon Jul 13 22:04:11 2026
  quarterly-notes.txt   A     412  Mon Jul 13 22:03:58 2026
```

- **Source:** manual\-verification  **Kind:** raw  **Collected:** 2026\-07\-14T10:02:11Z
```
220 (vsFTPd 3.0.3)
USER anonymous
331 Please specify the password.
PASS 
230 Login successful.
```

- **Source:** httpx  **Kind:** raw  **Collected:** 2026\-07\-14T10:10:02Z
```
GET /backup/ -> 200 OK
Index of /backup/
backup-2026-06-01.tar.gz  14-Jun-2026 03:00  842M
```

- **Source:** manual\-verification  **Kind:** raw  **Collected:** 2026\-07\-14T10:22:47Z
```
Traceback (most recent call last):
  File "/srv/acme-api/app.py", line 118, in handle
    raise ValueError(payload)
ValueError: invalid payload
```


## Technical Appendix

- **Tools:** httpx, katana, manual\-verification, nmap, openssl, smbclient
- **Artifact paths:**
  - `scans/nmap/vpn\.acme\-demo\.com\.xml`