Document Details

Table of Contents

1. Executive Summary
2. Scope and Methodology
3. Findings Summary
4. Detailed Findings by Vector
   1. Subdomain Discovery
   2. Subdomain Takeover Detection
   3. DNS Security
   4. Email Security (SPF, DKIM, DMARC, MTA-STS)
   5. Open Ports and Exposed Services
   6. TLS and SSL Configuration
   7. SSH Configuration Audit
   8. Known Vulnerability Detection
   9. Web Probing, Historical URLs, and Exposed Data
   10. Web Crawling
   11. Web Vulnerability Scanning
   12. HTTP Security Headers, Cookies, and CORS
5. Founder Review Note
6. Recommendations and Prioritisation
7. Tools and References
8. Limitations and Disclaimer

1. Executive Summary

Cybersecify ran an External Attack Surface Discovery scan against scan.acmesaas.io across 12 attack vectors using OpenEASD v2.4 (16 underlying tools). The scan completed in 2 days with 37 findings identified. A founder reviewed every finding, removed 4 false positives that scanner output included, and added prioritisation context before delivering this report.

Overall posture: Acme SaaS's external attack surface carries the kind of exposure that a Series A SaaS platform tends to accumulate as it ships fast: two Critical exposures on development and legacy infrastructure, a secret left behind in a public archive, and DNS and email hygiene gaps that make spoofing easy. None of this requires an attacker to be sophisticated. Most of it is reachable with public tooling and a few minutes.

Top themes from the scan:

Recommended priority for this week: Take Redis off the public internet (Section 4.5). Remove the dangling CNAME open to takeover (Section 4.2). Rotate the secrets exposed in the archived .env if they are still live (Section 4.9). Lock down the public S3 bucket listing (Section 4.9). Renew the expiring production certificate (Section 4.6). Harden email policy (Section 4.4) within 30 days. The Medium and Low findings can be addressed across the next quarter without urgency.

2. Scope and Methodology

2.1 Scope

The scan covered the apex domain scan.acmesaas.io and every subdomain discovered through passive enumeration, active enumeration, and DNS resolution. External-only, non-intrusive reconnaissance. No authentication attempted. No exploitation. No traffic to internal-only resources.

2.2 Methodology

OpenEASD scans across 12 attack vectors using 16 underlying tools. The scan flow:

1. Domain intelligence. RDAP query for domain registration and lock status. DNSSEC, CAA, and zone transfer checks.
2. Subdomain discovery. Passive enumeration (Subfinder against certificate transparency logs, search engine indexes, and public DNS databases) plus active enumeration (Amass DNS brute-forcing) plus permutation generation (Alterx variants of discovered names).
3. DNS resolution and filtering. DNSx resolves discovered hostnames to live IPs. Filters out wildcard responses and CDN noise.
4. Subdomain takeover. Subzy checks CNAME targets for deprovisioned cloud resources (S3 buckets, Heroku apps, Azure deployments, etc.) that an attacker could claim.
5. Port scanning. Naabu against resolved IPs across common service ports. Top 1000 TCP ports.
6. Service classification. Nmap version detection on identified open ports. Distinguishes web from non-web services.
7. Network CVE detection. Nmap NSE vulners scripts for non-web ports.
8. TLS and certificate analysis. Certificate expiry, weak or export ciphers, deprecated protocol versions (TLS 1.0 and 1.1), HSTS preload status.
9. SSH configuration audit. Algorithm negotiation, weak key exchange or MAC, protocol version.
10. Network protocol vulnerabilities. Nuclei network templates for non-HTTP protocol vulnerabilities.
11. Web layer discovery. httpx live probing on discovered hosts to identify web services. Status codes, technologies, redirects.
12. Historical URL recovery. Gau and waybackurls for archived URL paths. Often surfaces forgotten endpoints not in current site map.
13. Web crawling. Katana traversal of discovered web hosts to enumerate the live URL surface.
14. Web vulnerability scanning. Nuclei community templates against discovered web URLs.
15. HTTP security inspection. CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags (Secure, HttpOnly, SameSite), CORS configuration, server version disclosure.

2.3 Severity Rating

3. Findings Summary

3.1 Findings by Severity

3.2 Findings by Attack Vector

4. Detailed Findings by Vector

How to read these findings. OpenEASD sees your infrastructure from the outside, the way an attacker would. It points at what is exposed and the direction to close it. It cannot see your internal architecture, your code, or your data model, so the exact fix is your team's call (or a follow-on engagement). Each finding lists a Direction, not a prescriptive patch. The evidence shown for Critical and High findings is pure observation: DNS lookups, service banners, TLS handshakes, and public archives. Nothing here logged in, sent app commands, or touched private data.

4.1 Subdomain Discovery

Vector intent: Identify every hostname an attacker could find. Forgotten staging environments, dev tooling, and shadow IT are typically where breaches start.

Method used: Subfinder (passive) plus Amass (active brute-force) plus Alterx (permutation). DNSx for resolution.

Result: 47 unique subdomains identified. 33 actively resolving. 14 listed in DNS but not resolving (CNAME stale or NXDOMAIN).

• F-001 (Medium): 6 subdomains contain "staging", "dev", or "test" tokens and respond on common web ports. None require authentication on the landing page. Direction: add VPN or IP allowlist requirement before HTTP layer, or shut down environments not actively used.
• F-002 (Medium): old-admin.scan.acmesaas.io serves a legacy login form on TLS 1.0. Likely a deprecated panel. Verify ownership and decommission or harden.
• F-003 (Low): 4 subdomains point to GitHub Pages with default domain (`*.github.io`). Acceptable for marketing landing pages, but verify the corresponding repos are still under your organisation control.
• F-004 (Informational): 8 subdomains use Cloudflare. Recommended; consider Cloudflare WAF rules for the staging subdomains in F-001.

4.2 Subdomain Takeover Detection

Vector intent: Identify CNAME records pointing at deprovisioned cloud resources. An attacker who claims the dangling resource hosts content under your subdomain and phishes your users with a legitimate-looking URL.

Method used: Subzy against discovered CNAME chains.

• F-005 (Critical): old-marketing.scan.acmesaas.io CNAME points to acmesaas-old-bucket.s3.amazonaws.com which returns NoSuchBucket. An attacker can register a new S3 bucket with this exact name and host arbitrary content (including phishing pages with valid TLS) at the scan.acmesaas.io subdomain. Direction: remove the CNAME from your DNS provider this week. If the subdomain was ever used in marketing links, audit referrers for in-flight phishing.
  Evidence (observation only)

  $ dig +short CNAME old-marketing.scan.acmesaas.io
  acmesaas-old-bucket.s3.amazonaws.com.
  
  $ curl -s https://old-marketing.scan.acmesaas.io/ | head
  <Error><Code>NoSuchBucket</Code>
  <Message>The specified bucket does not exist</Message>
  <BucketName>acmesaas-old-bucket</BucketName></Error>

4.3 DNS Security

Vector intent: Identify DNS-layer weaknesses that enable cache poisoning, subdomain enumeration, or zone information disclosure.

Method used: dig and dnsx against discovered authoritative nameservers. RDAP for domain registration.

• F-006 (Medium): DNSSEC is not enabled. Cache poisoning resistance is limited and DNSSEC adoption is an expectation in regulated industries.
• F-007 (Medium): CAA record is missing. Any certificate authority can issue a certificate for scan.acmesaas.io. CAA constrains issuance to specific CAs (Let's Encrypt and DigiCert in your current usage).
• F-008 (Low): Zone transfer (AXFR) is correctly refused on all 4 authoritative nameservers. Good.

4.4 Email Security (SPF, DKIM, DMARC, MTA-STS)

Vector intent: Identify email policy weaknesses that allow attackers to spoof email from your domain.

Method used: dig TXT and DNS queries against published SPF, DKIM, DMARC, MTA-STS, and BIMI records. checkdmarc parsing.

• F-009 (High): SPF policy ends in ~all (softfail) instead of -all (hardfail). Receivers may quarantine spoofed mail instead of rejecting. Direction: harden to -all after confirming SPF includes all legitimate senders.
  Evidence (observation only)

  $ dig +short TXT scan.acmesaas.io
  "v=spf1 include:_spf.google.com include:mailgun.org ~all"

• F-010 (High): DMARC policy is p=none. No enforcement. Spoofing is allowed. Direction: move to p=quarantine; pct=50 first, then p=reject after a monitoring period via the aggregate reports.
  Evidence (observation only)

  $ dig +short TXT _dmarc.scan.acmesaas.io
  "v=DMARC1; p=none; rua=mailto:dmarc@scan.acmesaas.io"

• F-011 (Medium): DKIM selector observed for google (Workspace). No selector for mailgun despite SPF including Mailgun. Either remove Mailgun from SPF or publish a DKIM selector.
• F-012 (Low): MTA-STS not published. Inbound mail TLS can be downgraded by an in-path attacker. Publish _mta-sts.scan.acmesaas.io TXT record and mta-sts.scan.acmesaas.io/.well-known/mta-sts.txt policy.

4.5 Open Ports and Exposed Services

Vector intent: Identify publicly reachable services that should not be internet-exposed.

Method used: Naabu top 1000 TCP port scan against resolved IPs. Nmap version detection for fingerprinting.

• F-013 (Critical): Port 6379 (Redis) reachable from the public internet on dev.scan.acmesaas.io. The service banner reports Redis with no authentication required. Unauthenticated Redis is a known path to write SSH authorized_keys or shell payloads. Direction: bind Redis to localhost (or your private network), enable requirepass, and rotate any data this Redis has touched. Shut down this exposure today.
  Evidence (banner observation only, no service commands issued)

  $ nmap -Pn -sV -p 6379 dev.scan.acmesaas.io
  PORT     STATE SERVICE  VERSION
  6379/tcp open  redis    Redis key-value store 6.2.6
  
    NOTE: version banner captured by service detection.
    No Redis command (PING, CONFIG, KEYS) was sent.

• F-014 (High): Port 22 (SSH) reachable from the public internet on 3 production hosts. Direction: IP-restrict to bastion or VPN, or migrate to SSH-via-SSM (AWS) or equivalent.
  Evidence (banner observation only)

  $ nmap -Pn -p 22 prod-1.scan.acmesaas.io prod-2.scan.acmesaas.io prod-3.scan.acmesaas.io
  Host: prod-1.scan.acmesaas.io   22/tcp open  ssh
  Host: prod-2.scan.acmesaas.io   22/tcp open  ssh
  Host: prod-3.scan.acmesaas.io   22/tcp open  ssh

• F-015 (Low): Port 25 (SMTP) reachable on a marketing host. Expected for inbound mail receiving. The SMTP banner and advertised capabilities look like a standard inbound configuration. Direction: confirm on your side that the host is hardened and not an open relay.

4.6 TLS and SSL Configuration

Vector intent: Identify weak protocol versions, expired or expiring certificates, and downgrade risks.

Method used: testssl.sh equivalent inside OpenEASD. Custom checks for expiry windows.

• F-016 (High): Production certificate for scan.acmesaas.io expires in 11 days. Auto-renewal via Let's Encrypt is configured but the certificate has not rolled over. Direction: investigate the renewal path and renew this week.
  Evidence (TLS handshake observation only)

  $ echo | openssl s_client -connect scan.acmesaas.io:443 2>/dev/null \
      | openssl x509 -noout -issuer -enddate
  issuer=C=US, O=Let's Encrypt, CN=R3
  notAfter=Jun  9 11:59:00 2026 GMT

• F-017 (High): legacy.scan.acmesaas.io negotiates TLS 1.0. Modern browsers warn or refuse. Payment processors and many security questionnaires require TLS 1.2+ minimum. Direction: disable TLS 1.0 and 1.1 on this host.
  Evidence (protocol observation only)

  $ testssl --protocols legacy.scan.acmesaas.io
   TLS 1     offered (deprecated)
   TLS 1.1   offered (deprecated)
   TLS 1.2   offered
   TLS 1.3   not offered

• F-018 (Medium): HSTS not present on apex or www. Add Strict-Transport-Security header with at least 6-month max-age, then submit to the HSTS preload list.
• F-019 (Low): 3DES cipher suite still negotiable on 2 subdomains. Disable.
• F-020 (Informational): All production hosts using ECDSA certificates (P-256). Good.

4.7 SSH Configuration Audit

Vector intent: Identify SSH services with weak algorithm negotiation.

Method used: ssh-audit equivalent. Algorithm negotiation captured without auth attempt.

• F-021 (Medium): SHA-1 HMAC algorithms still accepted on 2 hosts. Disable hmac-sha1, hmac-sha1-96.
• F-022 (Low): SSH banner reveals OpenSSH version 8.4p1 (2 minor versions behind current LTS).

4.8 Known Vulnerability Detection

Vector intent: Identify hosts running software versions with publicly known CVEs.

Method used: Nmap NSE vulners scripts and Nuclei network templates.

• F-023 (High): Nginx version banner reveals 1.18.0 on production proxy. CVE-2021-23017 (DNS resolver vulnerability) and CVE-2022-41741 (mp4 module memory disclosure) apply. Direction: upgrade to 1.24.x and suppress the version banner.
  Evidence (HTTP header observation only)

  $ curl -sI https://scan.acmesaas.io/ | grep -i server
  Server: nginx/1.18.0

• F-024 (Medium): Tomcat 9.0.45 server header on a Java microservice. 3 documented CVEs since this version. Upgrade to current 9.0.x.

4.9 Web Probing, Historical URLs, and Exposed Data

Vector intent: Identify the live web URL surface, endpoints recoverable from public archives, and any data or secrets left exposed in archives or open cloud storage.

Method used: httpx active probing for the live surface. Gau and waybackurls to recover archived URL paths that are no longer linked. Public read checks against cloud storage endpoints found in DNS and archives.

• F-035 (High): An archived snapshot of staging.scan.acmesaas.io/.env is preserved in the public Wayback Machine (captured 2025-08-15) and surfaced by gau. The archived file lists secret variable names including AWS_SECRET_ACCESS_KEY, STRIPE_SECRET_KEY, and DATABASE_URL. The live path now returns 404, but the archived copy remains publicly retrievable. Detection-only note: we observed the archived snapshot; no credential was read in full or used against any system. Direction: treat all secrets that ever appeared in this file as compromised and rotate them (AWS keys, Stripe keys, database credentials), then request removal of the archived snapshot and stop serving .env files from any web root.
  Evidence (public archive observation only, values not read)

  $ gau staging.scan.acmesaas.io | grep -i '\.env'
  https://web.archive.org/web/20250815/https://staging.scan.acmesaas.io/.env
  
  $ curl -s "https://web.archive.org/web/20250815id_/https://staging.scan.acmesaas.io/.env" \
      | grep -oE '^[A-Z_]+=' | sort -u
  AWS_ACCESS_KEY_ID=
  AWS_SECRET_ACCESS_KEY=
  DATABASE_URL=
  STRIPE_SECRET_KEY=
  
    NOTE: variable names extracted; secret values were not captured or used.

• F-036 (High): The S3 bucket acmesaas-public-assets has directory listing enabled and returns its object index to anonymous requests. The listing includes paths that look like backups (backups/db-dump-2025.sql) alongside expected marketing assets. Detection-only note: we confirmed the listing responds; we did not download the objects. Direction: disable public listing on the bucket, apply a bucket policy that blocks anonymous access, and move any backup or database artefacts out of a public bucket entirely.
  Evidence (public listing observation only, objects not downloaded)

  $ curl -s "https://acmesaas-public-assets.s3.amazonaws.com/?list-type=2" | head
  <ListBucketResult>
    <Name>acmesaas-public-assets</Name>
    <Contents><Key>marketing/logo.png</Key></Contents>
    <Contents><Key>backups/db-dump-2025.sql</Key></Contents>
  </ListBucketResult>

• F-025 (Low): /admin on old-marketing.scan.acmesaas.io returns a Wordpress login page. Direction: decommission or move behind VPN.
• F-026 (Low): 2 staging subdomains return server-side default pages (Apache default, Nginx welcome). Direction: customise or remove.
• F-027 (Informational): Production application is a Next.js SSR app reverse-proxied via Cloudflare. Fingerprintable but no direct risk.

4.10 Web Crawling

Vector intent: Walk the live URL surface to enumerate accessible endpoints beyond the public sitemap.

Method used: Katana deep crawl with depth 5 against discovered web hosts.

• F-028 (Informational): Crawled 1,247 URLs. No directory listing exposed. No sensitive files (.env, .git, backup archives) in document root. Good.

4.11 Web Vulnerability Scanning

Vector intent: Detect known web vulnerabilities, misconfigurations, and exposed admin or panel endpoints.

Method used: Nuclei community templates against discovered web URLs.

• F-037 (Medium): A Grafana login page is reachable from the public internet at metrics.scan.acmesaas.io with no IP restriction. The panel requires credentials, so this is exposure rather than a confirmed break, but an internet-facing monitoring dashboard widens the attack surface for credential stuffing and known-CVE targeting of the Grafana version. Direction: put the dashboard behind VPN or an IP allowlist, confirm default credentials are not in use, and keep the Grafana build patched.
• F-029 (Medium): /.well-known/security.txt not published. Direction: add for responsible disclosure flow.
• F-030 (Low): API endpoint /api/health returns build version and commit SHA. Minor information disclosure. Acceptable for some use cases (status dashboards) but flag if not intended.

4.12 HTTP Security Headers, Cookies, and CORS

Vector intent: Identify missing or misconfigured browser security policies.

Method used: httpx header capture. Manual review by founder of relevant configs.

• F-031 (Medium): Content-Security-Policy header missing on the marketing site. Adopt at least a baseline policy.
• F-032 (Medium): Access-Control-Allow-Origin: * on api.scan.acmesaas.io while Access-Control-Allow-Credentials is set to true. This combination is rejected by browsers but indicates a configuration error. Replace wildcard with explicit allowlist.
• F-033 (Low): Session cookies missing Secure attribute on 1 staging subdomain. Add.
• F-034 (Low): Server: Apache/2.4.41 header reveals exact version. Strip server banner.

5. Founder Review Note

This is the section you do not get from a raw scanner dump. A founder reviewed every finding before the report shipped. Four observations specific to Acme SaaS:

• The Critical Redis exposure (F-013) is the single thing to fix this week. Everything else can wait if you prioritise correctly. Unauthenticated Redis is a known attacker target; bot scanners hit it within hours of new exposure. If this has been up for more than a day, audit the data and assume potential compromise.
• The leaked staging secrets (F-035) are already public, so speed matters more than cleanup. The live .env path is gone, but the archived copy is not, and you cannot un-publish it quickly. The only reliable fix is to rotate every secret that ever sat in that file. Assume the AWS keys, Stripe key, and database credentials named there are burned until they are rotated. Removal of the archived snapshot is worth requesting, but rotation is what actually closes the risk.
• The subdomain takeover risk (F-005) ties to your past marketing infrastructure. If old-marketing.scan.acmesaas.io was ever in an email campaign or a customer-facing link, audit referrer logs. An attacker who takes the dangling S3 bucket and serves phishing content can ride your domain authority.
• The email security findings (F-009 to F-012) compound. Each one alone is recoverable. Together, they make spoofing your domain trivially possible. Recommend tackling SPF + DMARC together as one change, monitoring DMARC aggregate reports for 2 weeks, then tightening.

4 false-positive findings from raw scanner output were removed before this report shipped: a deprecated CVE for a Nginx version we verified is actually patched (debian backport), a CORS misconfiguration on a marketing iframe that is intentional, an "open" port that is filtered, and a TLS cipher suite warning that does not apply to your TLS 1.3 negotiation.

6. Recommendations and Prioritisation

6.1 This Week

1. F-013: Take Redis off the public internet. Bind to localhost or private network. Rotate any keys this Redis has held.
2. F-035: Rotate every secret that appeared in the archived .env (AWS keys, Stripe key, database credentials). Request removal of the Wayback snapshot. Stop serving .env from any web root.
3. F-005: Remove the dangling CNAME for old-marketing.scan.acmesaas.io. Audit referrers for in-flight campaigns.
4. F-036: Disable public listing on the acmesaas-public-assets bucket. Move backup and database artefacts out of any public bucket.
5. F-016: Renew the expiring production certificate. Investigate the failed Let's Encrypt auto-renewal.

6.2 Within 30 Days

1. F-014: IP-restrict SSH access on 3 production hosts.
2. F-037: Put the public Grafana dashboard behind VPN or an IP allowlist. Confirm default credentials are not in use.
3. F-009, F-010: Harden SPF (-all) and DMARC (p=quarantine then p=reject).
4. F-011: Either remove Mailgun from SPF or publish DKIM selector.
5. F-017: Disable TLS 1.0 on legacy.scan.acmesaas.io.
6. F-023: Upgrade Nginx to 1.24.x.

6.3 Next Quarter

1. Mediums and Lows. Address as part of normal hardening sprints.
2. Enable DNSSEC if your registrar supports it (F-006).
3. Publish CAA record (F-007).
4. Publish MTA-STS policy (F-012).
5. Add Content-Security-Policy (F-031).
6. Decommission unused staging environments (F-001).

6.4 Beyond OpenEASD

OpenEASD covers external attack surface. It does not cover:

• Authenticated application testing. Business logic flaws, authorisation gaps between user roles, IDOR, payment race conditions. Covered by a founder-led pentest.
• Internal network testing. Lateral movement, internal service exposure, Active Directory hardening. Out of scope.

7. Tools and References

OpenEASD is open source. Source available on GitHub: github.com/cybersecify/OpenEASD. The 16 underlying tools used in this scan:

• Subdomain discovery: Subfinder, Amass, Alterx
• DNS: dnsx, dig, RDAP
• Subdomain takeover: Subzy
• Port scanning: Naabu, Nmap
• Network CVEs: Nmap NSE vulners, Nuclei network templates
• TLS: testssl.sh-equivalent inside OpenEASD
• SSH: ssh-audit-equivalent
• Web probing: httpx
• URL recovery: Gau, waybackurls
• Web crawling: Katana
• Web vulnerabilities: Nuclei community templates

References for severity definitions: OWASP Web Security Testing Guide v4.2, OWASP API Security Top 10 2023, NIST SP 800-115. CVSS v3.1 used for individual vulnerability scoring where applicable.

8. Limitations and Disclaimer

This is a sample report. All findings, the client name (Acme SaaS), the domain (scan.acmesaas.io), and all enumerated subdomains and IPs are fictional. Any resemblance to real systems is coincidental. Use this sample to evaluate format and depth. It is not a benchmark for the volume or severity of findings in any real engagement.

External-only scanning. OpenEASD performs external, non-intrusive reconnaissance against publicly observable infrastructure. The scan does not authenticate, exploit, or perform any intrusive action. It does not access private systems or non-public data.

Point-in-time. The scan reflects external posture during the scan window. Changes to systems, code, configuration, or the threat landscape after the engagement window are not covered.

Not a substitute for a full security assessment. OpenEASD covers external attack surface only. Internal application authorisation, business logic, payment flows, and audit-evidence quality require a founder-led pentest.

Founder review caveat. The founder review removes false positives where verifiable and prioritises findings. It is not a substitute for the client's own context. We do not have access to your customer data, internal architecture decisions, or threat model. Apply judgement when prioritising fixes.