Overall Risk Score
52.5
Open Findings
30
Remediation
10.3%
Strategic Roadmap
14 /
14 /
6
Top MITRE Techniques
NIST Control Coverage
Attack Paths
Compliance Overview
Recent Findings
Showing top 10
| ID | Title | Severity | Asset | CVSS | Status |
|---|---|---|---|---|---|
| VULN-001 | Internet-Facing MySQL Service Exposed | Critical | 9.1 | Open | |
| VULN-002 | Hardcoded API Keys and Payment Credentials in Client-Side JavaScript | Critical | 9.3 | In Progress | |
| VULN-003 | Unauthenticated Building-Energy IoT Controller Exposed on Guest WiFi | Critical | 9.4 | In Progress | |
| VULN-004 | Windows Server Fleet — SMB/RDP Legacy Exposure (Pending Validation) | Critical | 9.8 | Open | |
| VULN-005 | WordPress Admin Panel Accessible Without Rate Limiting | Critical | 9.0 | In Progress | |
| VULN-006 | Development / Admin Subdomains Exposed | High | 7.5 | Open | |
| VULN-007 | Administrative / Hosting Panels Exposed | High | 7.3 | Open | |
| VULN-008 | Missing DMARC and Weak SPF (?all) Across Brand Domains | High | 7.4 | In Progress | |
| VULN-009 | WordPress User Enumeration via REST API and Author Pages | High | 7.1 | Mitigated | |
| VULN-010 | OpenSSH on Non-Standard Port with Legacy Algorithms | High | 7.0 | Open |
Executive SummaryFor non-technical stakeholders
Overall Security Posture: High
This assessment identified 36 vulnerabilities across the target environment, of which 5 are Critical and 11 are High severity. The overall risk score is 52.5/100 indicating a High risk posture. This DEMONSTRATION report presents fully fictional data for a sample hospitality client, Acacia Grove Hospitality Group. It illustrates how AIMI's continuous attack-simulation and reporting surface looks to a customer. No real organisation, system, or person is represented. Domains use the reserved .example namespace and IP addresses use RFC 5737 documentation ranges.
Key risks include potential data breach of customer PII, regulatory non-compliance (GDPR, PCI-DSS), and system compromise that could lead to service disruption. Immediate remediation is required for 14 critical findings.
52.5
Risk Score (0-100)
High
Per-Domain Risk BreakdownFindings by in-scope domain
| Domain | Risk | Total | Critical | High | Medium | Low | Info | Max CVSS |
|---|---|---|---|---|---|---|---|---|
| acaciagrovehotels.example | Critical | 12 | 2 | 3 | 5 | 2 | 0 | 9.3 |
| acaciagrove.example | Critical | 11 | 2 | 3 | 4 | 0 | 2 | 9.8 |
| savannasuites.example | Critical | 6 | 1 | 2 | 2 | 1 | 0 | 9.1 |
| AGHG Corporate / Shared Infrastructure | High | 5 | 0 | 3 | 2 | 0 | 0 | 7.5 |
| baobablodge.example | Low | 2 | 0 | 0 | 0 | 2 | 0 | 3.7 |
"Cross-Domain" groups findings that span more than one in-scope domain (e.g. DNSSEC, SPF/DMARC, shared hosting). Use the Domain filter on the Findings tab to drill into a single domain.
Business Impact Breakdown
Strategic Remediation Roadmap
14 items
Immediate (0-30 days)
Critical & High
VULN-001 Internet-Facing MySQL Service Exposed
VULN-002 Hardcoded API Keys and Payment Credentials in Client-Side JavaScript
VULN-003 Unauthenticated Building-Energy IoT Controller Exposed on Guest WiFi
VULN-004 Windows Server Fleet — SMB/RDP Legacy Exposure (Pending Validation)
VULN-005 WordPress Admin Panel Accessible Without Rate Limiting
14 items
Short-term (30-90 days)
Medium & Low
VULN-017 Internet-Facing DNS Server (BIND 9.16.23)
VULN-018 Missing Security Headers (CSP, X-Frame-Options, HSTS)
VULN-021 Outdated IIS 8.5 on Internal Windows Server
VULN-022 Internal Wireless Networks Use WPA2-PSK Only — No WPA3 / 802.1X / PMF
VULN-023 Self-Signed TLS Certificate with Excessive Validity on IoT Controller
6 items
Long-term (90+ days)
Architecture & Process
Remediated findings, architectural improvements, and process enhancements
All Findings
36 total| ID | Title | Severity | Asset | Type | CVSS | Status | Remediation | MITRE | |
|---|---|---|---|---|---|---|---|---|---|
| VULN-001 | Internet-Facing MySQL Service Exposed | Critical | Network | 9.1 | Open | 0/4 |
T1190 | ||
| VULN-002 | Hardcoded API Keys and Payment Credentials in Client-Side JavaScript | Critical | Web Application | 9.3 | In Progress | 1/3 |
T1552T1078 | ||
| VULN-003 | Unauthenticated Building-Energy IoT Controller Exposed on Guest WiFi | Critical | Network / IoT | 9.4 | In Progress | 1/2 |
T1190T1133 | ||
| VULN-004 | Windows Server Fleet — SMB/RDP Legacy Exposure (Pending Validation) | Critical | Network | 9.8 | Open | 0/4 |
T1190T1021 | ||
| VULN-005 | WordPress Admin Panel Accessible Without Rate Limiting | Critical | Web Application | 9.0 | In Progress | 1/2 |
T1110T1190 | ||
| VULN-006 | Development / Admin Subdomains Exposed | High | Web Application | 7.5 | Open | 0/3 |
T1190T1133 | ||
| VULN-007 | Administrative / Hosting Panels Exposed | High | Web Application | 7.3 | Open | 0/3 |
T1190 | ||
| VULN-008 | Missing DMARC and Weak SPF (?all) Across Brand Domains | High | Email Security | 7.4 | In Progress | 1/3 |
T1566T1589 | ||
| VULN-009 | WordPress User Enumeration via REST API and Author Pages | High | Web Application | 7.1 | Mitigated | 1/2 |
T1589T1087 | ||
| VULN-010 | OpenSSH on Non-Standard Port with Legacy Algorithms | High | Network | 7.0 | Open | 0/3 |
T1110T1021 | ||
| VULN-011 | AGHG Email Accounts Present in Known Third-Party Data Breaches | High | Email Security | 7.5 | Open | 0/3 |
T1589T1078 | ||
| VULN-012 | Cloudflare Origin IP Exposure (reports.savannasuites.example) | High | Network | 6.8 | Open | 0/3 |
T1590T1595 | ||
| VULN-013 | Internal Web Application Stack Outdated (Apache/PHP/OpenSSL) | High | Web Application | 7.5 | Open | 0/3 |
T1190 | ||
| VULN-014 | Guest-Reachable Gateway Management Plane (SSH + DNS) on Network Edge | High | Network Architecture | 7.2 | Open | 0/3 |
T1046T1133 | ||
| VULN-015 | Pure-FTPd Anonymous Login Enabled on Port 21 | High | Network Service Exposure | 7.0 | Resolved | 1/3 |
T1078T1133 | ||
| VULN-016 | XML-RPC Enabled with Full Method Surface Exposed | High | Web Application | 6.9 | Open | 0/3 |
T1110T1190 | ||
| VULN-017 | Internet-Facing DNS Server (BIND 9.16.23) | Medium | Network | 5.3 | Open | 0/3 |
T1590 | ||
| VULN-018 | Missing Security Headers (CSP, X-Frame-Options, HSTS) | Medium | Web Application | 5.4 | Open | 0/2 |
T1189 | ||
| VULN-019 | WordPress and Plugin Versions Fingerprinted | Medium | Web Application | 5.0 | Mitigated | 1/2 |
T1592 | ||
| VULN-020 | WooCommerce Log Directories Disclosed in robots.txt | Medium | Web Application | 5.3 | Resolved | 1/2 |
T1592 | ||
| VULN-021 | Outdated IIS 8.5 on Internal Windows Server | Medium | Web Application | 5.3 | Open | 0/2 |
T1190 | ||
| VULN-022 | Internal Wireless Networks Use WPA2-PSK Only — No WPA3 / 802.1X / PMF | Medium | Wireless | 5.3 | Open | 0/3 |
T1040 | ||
| VULN-023 | Self-Signed TLS Certificate with Excessive Validity on IoT Controller | Medium | Network / IoT | 4.8 | Open | 0/3 |
|||
| VULN-024 | Shared Mail Hosting Across Brand Domains | Medium | DNS / Email | 5.0 | Open | 0/2 |
T1590 | ||
| VULN-025 | TLS Certificate Expiring Within 30 Days | Medium | Web Application | 4.0 | Resolved | 1/2 |
|||
| VULN-026 | Exim SMTP Service Exposed on Multiple Ports | Medium | Network | 5.3 | Open | 0/3 |
T1590 | ||
| VULN-027 | Hosting Control Panel Exposed on Public Subdomain | Medium | Web Application | 5.3 | Open | 0/3 |
T1190 | ||
| VULN-028 | Other Guest Peers Expose Windows RPC and UPnP Services | Medium | Wireless | 5.0 | Open | 0/2 |
T1046T1040 | ||
| VULN-029 | DNSSEC Unsigned Across All Domains | Medium | DNS / Email | 4.3 | Open | 0/2 |
T1565 | ||
| VULN-030 | Email Addresses Disclosed in Website Source | Low | Web Application | 3.7 | Open | 0/3 |
T1589 | ||
| VULN-031 | WordPress readme.html and license.txt Exposed | Low | Web Application | 3.1 | Resolved | 0/1 |
T1592 | ||
| VULN-032 | Missing robots.txt, sitemap.xml, and security.txt (RFC 9116) | Low | Web Application | 2.0 | Open | 0/1 |
|||
| VULN-033 | Missing X-Content-Type-Options and Referrer-Policy Headers | Low | Web Application | 3.1 | Open | 0/1 |
T1189 | ||
| VULN-034 | Verbose Server Version Banner on Reverse Proxy | Low | Web Application | 2.6 | Open | 0/1 |
T1592 | ||
| VULN-035 | Internal Management VLAN Default-Deny Posture Confirmed | Info | Network | 0.0 | Open | 0/1 |
T1046 | ||
| VULN-036 | Guest Wi-Fi Subnet High Device Density and Deferred Probing | Info | Wireless | 0.0 | Open | 0/1 |
T1040 |
Information Gathering Results
Passive Intelligence
| Source | Findings |
|---|---|
| DNS Records | 5 records found |
| Subdomains | 10 subdomains discovered |
| Tech Stack | 10 technologies identified |
| Total OSINT Sources | 25 data points |
Active Intelligence
| Type | Result |
|---|---|
| Open Ports | 12 open ports discovered |
| Services | 11 services enumerated |
| OS Detection | 2 OS fingerprints |
Asset Discovery
In Scope
0
Discovered
8
Coverage
100%
Attack Surface Summary
Exposed Services & Open Ports
| Port | Service | Version | Risk | Related Findings |
|---|---|---|---|---|
| / | - | |||
| / | - | |||
| / | - | |||
| / | - | |||
| / | - | |||
| / | - | |||
| / | - | |||
| / | - | |||
| / | - | |||
| / | - | |||
| / | - | |||
| / | - |
MITRE ATT&CK Matrix16 techniques mapped
Tactic Distribution
Technique Details
| Technique | Name | Tactic | Findings | Max Severity |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | 10 | Critical |
| T1133 | External Remote Services | Initial Access | 4 | Critical |
| T1078 | Valid Accounts | Initial Access | 3 | Critical |
| T1566 | Phishing | Initial Access | 1 | High |
| T1189 | Drive-by Compromise | Initial Access | 2 | Medium |
| T1110 | Brute Force | Credential Access | 3 | Critical |
| T1040 | Network Sniffing | Credential Access | 3 | Medium |
| T1087 | Account Discovery | Discovery | 1 | High |
| T1046 | Network Service Discovery | Discovery | 3 | High |
| T1021 | Remote Services | Lateral Movement | 2 | Critical |
| T1552 | Unsecured Credentials | Credential Access | 1 | Critical |
| T1565 | Data Manipulation | Impact | 1 | Medium |
| T1595 | Active Scanning | Reconnaissance | 1 | High |
| T1592 | Gather Victim Host Information | Reconnaissance | 4 | Medium |
| T1589 | Gather Victim Identity Information | Reconnaissance | 4 | High |
| T1590 | Gather Victim Network Information | Reconnaissance | 4 | High |
NIST Control Coverage by Family
Summary
18
Controls Covered
258
Total Controls
7.0% coverage
Control Families
| Control ID | Name | Description | Findings |
|---|---|---|---|
| AC-1 | Policy and Procedures | Access control policy and procedures | — |
| AC-2 | Account Management | Managing system accounts lifecycle | 1 |
| AC-3 | Access Enforcement | Enforcing authorized access | 7 |
| AC-4 | Information Flow Enforcement | Controlling information flow | 2 |
| AC-5 | Separation of Duties | Separation of duties to reduce risk | — |
| AC-6 | Least Privilege | Granting minimum necessary access | — |
| AC-7 | Unsuccessful Logon Attempts | Limiting failed login attempts | 2 |
| AC-8 | System Use Notification | Displaying use notification banners | — |
| AC-9 | Previous Logon Notification | Notifying users of previous logon | — |
| AC-10 | Concurrent Session Control | Limiting concurrent sessions | — |
| AC-11 | Session Lock | Locking sessions after inactivity | — |
| AC-12 | Session Termination | Terminating sessions at logout | — |
| AC-14 | Permitted Actions Without Identification | Actions allowed without authentication | — |
| AC-17 | Remote Access | Controlling remote access | 1 |
| AC-18 | Wireless Access | Controlling wireless access | — |
| AC-19 | Mobile Device Management | Managing mobile device access | — |
| AC-20 | External Information Systems | External systems use | — |
| AC-21 | Information Sharing | Information sharing with external entities | — |
| AC-22 | Publicly Accessible Content | Managing publicly accessible content | — |
| AC-23 | Data Mining Protection | Protecting against data mining | — |
| AC-24 | Access Control Decisions | Making access control decisions | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| AT-1 | Policy and Procedures | Training policy and procedures | — |
| AT-2 | Literacy Training and Awareness | Security awareness training | — |
| AT-3 | Role-Based Training | Training specific to roles | — |
| AT-4 | Training Records | Maintaining training records | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| AU-1 | Policy and Procedures | Audit policy and procedures | — |
| AU-2 | Event Logging | Events to be logged | — |
| AU-3 | Content of Audit Records | Content of audit logs | — |
| AU-4 | Audit Log Storage Capacity | Storage capacity for audit logs | — |
| AU-5 | Response to Audit Logging Failures | Responding to logging failures | — |
| AU-6 | Audit Record Review, Analysis, and Reporting | Reviewing audit records | — |
| AU-7 | Audit Record Reduction and Report Generation | Tools for audit analysis | — |
| AU-8 | Time Stamps | Synchronized timestamps | — |
| AU-9 | Protection of Audit Information | Protecting audit logs from tampering | — |
| AU-10 | Non-Repudiation | Protecting against repudiation | — |
| AU-11 | Audit Record Retention | Retaining audit records | — |
| AU-12 | Audit Record Generation | Generating audit records | — |
| AU-13 | Monitoring for Information Disclosure | Monitoring for data leaks | — |
| AU-14 | Session Audit | Auditing user sessions | — |
| AU-16 | Cross-Organizational Auditing | Coordinating auditing across orgs | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| CA-1 | Policy and Procedures | Assessment policy and procedures | — |
| CA-2 | Security Assessments | Conducting security assessments | — |
| CA-3 | System Interconnections | Managing system interconnections | — |
| CA-5 | Plan of Action and Milestones | Tracking remediation POA&M | — |
| CA-6 | Authorization | System authorization | — |
| CA-7 | Continuous Monitoring | Continuous security monitoring | — |
| CA-8 | Penetration Testing | Conducting penetration tests | — |
| CA-9 | Internal System Connections | Managing internal connections | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| CM-1 | Policy and Procedures | CM policy and procedures | — |
| CM-2 | Baseline Configuration | Establishing baseline configurations | — |
| CM-3 | Configuration Change Control | Managing configuration changes | — |
| CM-4 | Impact Analyses | Analyzing change impacts | — |
| CM-5 | Access Restrictions for Change | Restricting change access | — |
| CM-6 | Configuration Settings | Secure configuration settings | 6 |
| CM-7 | Least Functionality | Disabling unnecessary functionality | — |
| CM-8 | System Component Inventory | Maintaining system inventory | — |
| CM-9 | Configuration Management Plan | CM planning | — |
| CM-10 | Software Usage Restrictions | Restricting unauthorized software | — |
| CM-11 | User-Installed Software | Controlling user-installed software | — |
| CM-12 | Information Location | Tracking information location | — |
| CM-13 | Automation Support for CM | Automating CM processes | — |
| CM-14 | Signed Components | Using signed software components | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| CP-1 | Policy and Procedures | CP policy and procedures | — |
| CP-2 | Contingency Plan | Developing contingency plans | — |
| CP-3 | Contingency Training | Training for contingency roles | — |
| CP-4 | Contingency Plan Testing | Testing contingency plans | — |
| CP-6 | Alternate Storage Site | Alternate storage locations | — |
| CP-7 | Alternate Processing Site | Alternate processing locations | — |
| CP-8 | Telecommunications Services | Alternate telecom services | — |
| CP-9 | System Backup | Backup procedures | — |
| CP-10 | System Recovery and Reconstitution | System recovery procedures | — |
| CP-11 | Alternate Communications Protocols | Alternative communication methods | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| IA-1 | Policy and Procedures | IA policy and procedures | — |
| IA-2 | Identification and Authentication (Organizational Users) | User identification and authentication | 3 |
| IA-3 | Device Identification and Authentication | Device authentication | — |
| IA-4 | Identifier Management | Managing user identifiers | — |
| IA-5 | Authenticator Management | Managing authenticators | 2 |
| IA-6 | Authenticator Feedback | Obscuring authentication feedback | — |
| IA-7 | Cryptographic Module Authentication | Using cryptographic modules | — |
| IA-8 | Identification and Authentication (Non-Org Users) | External user authentication | — |
| IA-9 | Service Identification and Authentication | Service account authentication | — |
| IA-10 | Adaptive Authentication | Risk-based authentication | — |
| IA-11 | Re-authentication | Periodic re-authentication | — |
| IA-12 | Identity Proofing | Verifying identity during enrollment | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| IR-1 | Policy and Procedures | IR policy and procedures | — |
| IR-2 | Incident Response Training | Training for incident response | — |
| IR-3 | Incident Response Testing | Testing IR capabilities | — |
| IR-4 | Incident Handling | Incident handling procedures | — |
| IR-5 | Incident Monitoring | Monitoring for incidents | — |
| IR-6 | Incident Reporting | Reporting incidents | 1 |
| IR-7 | Incident Response Assistance | Providing IR assistance | — |
| IR-8 | Incident Response Plan | Developing IR plans | — |
| IR-9 | Information Spillage Response | Responding to data spills | — |
| IR-10 | Integrated Information Security Analysis | Integrated security analysis | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| MA-1 | Policy and Procedures | Maintenance policy and procedures | — |
| MA-2 | Controlled Maintenance | Controlling system maintenance | — |
| MA-3 | Maintenance Tools | Controlling maintenance tools | — |
| MA-4 | Nonlocal Maintenance | Remote maintenance controls | — |
| MA-5 | Maintenance Personnel | Assigning maintenance personnel | — |
| MA-6 | Timely Maintenance | Performing timely maintenance | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| MP-1 | Policy and Procedures | Media protection policy | — |
| MP-2 | Media Access | Controlling media access | — |
| MP-3 | Media Marking | Labeling media | — |
| MP-4 | Media Storage | Storing media securely | — |
| MP-5 | Media Transport | Protecting media in transit | — |
| MP-6 | Media Sanitization | Sanitizing media before disposal | — |
| MP-7 | Media Use | Restricting media use | — |
| MP-8 | Media Downgrading | Downgrading media classification | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| PE-1 | Policy and Procedures | Physical security policy | — |
| PE-2 | Physical Access Authorizations | Authorizing physical access | — |
| PE-3 | Physical Access Control | Controlling physical access | — |
| PE-4 | Access Control for Transmission | Protecting transmission media | — |
| PE-5 | Access Control for Output Devices | Controlling output devices | — |
| PE-6 | Monitoring Physical Access | Monitoring physical access | — |
| PE-8 | Visitor Access Records | Maintaining visitor logs | — |
| PE-9 | Power Equipment and Cabling | Protecting power equipment | — |
| PE-10 | Emergency Shutdown | Emergency shutdown procedures | — |
| PE-11 | Emergency Power | Emergency power supply | — |
| PE-12 | Emergency Lighting | Emergency lighting | — |
| PE-13 | Fire Protection | Fire detection and suppression | — |
| PE-14 | Temperature and Humidity Controls | Environmental controls | — |
| PE-15 | Water Damage Protection | Water damage protection | — |
| PE-16 | Delivery and Removal | Tracking deliveries and removals | — |
| PE-17 | Alternate Work Site | Remote work site security | — |
| PE-18 | Location of System Components | Secure component locations | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| PL-1 | Policy and Procedures | Planning policy | — |
| PL-2 | System Security and Privacy Plan | System security plan | — |
| PL-4 | Rules of Behavior | Rules of behavior for users | — |
| PL-7 | Concept of Operations | Security concept of operations | — |
| PL-8 | Security and Privacy Architectures | Security architecture | — |
| PL-9 | Central Management | Centrally managing controls | — |
| PL-10 | Baseline Selection | Selecting security baselines | — |
| PL-11 | Baseline Tailoring | Tailoring baselines | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| PM-1 | Information Security Program Plan | Security program plan | — |
| PM-2 | Information Security Program Leadership | Security leadership roles | — |
| PM-3 | Information Security Resources | Allocating security resources | — |
| PM-4 | Plan of Action and Milestones Process | POA&M management | — |
| PM-5 | System Inventory | Maintaining system inventory | — |
| PM-6 | Measures of Performance | Security performance measures | — |
| PM-7 | Enterprise Architecture | Security in enterprise architecture | — |
| PM-8 | Critical Infrastructure Plan | Critical infrastructure planning | — |
| PM-9 | Risk Management Strategy | Risk management strategy | — |
| PM-10 | Authorization Process | Authorization process | — |
| PM-11 | Mission and Business Process Definition | Mission/business process definition | — |
| PM-12 | Insider Threat Program | Insider threat program | — |
| PM-13 | Information Security Workforce | Security workforce management | — |
| PM-14 | Testing, Training, and Monitoring | Testing and monitoring programs | — |
| PM-15 | Contacts with Groups | External security groups | — |
| PM-16 | Threat Awareness Program | Threat intelligence program | — |
| PM-17 | Cybersecurity Consortium | Participating in cybersecurity consortia | — |
| PM-18 | Privacy Program Plan | Privacy program plan | — |
| PM-20 | Dissemination of Privacy Program Information | Privacy information dissemination | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| PS-1 | Policy and Procedures | Personnel security policy | — |
| PS-2 | Position Risk Designation | Risk designation for positions | — |
| PS-3 | Personnel Screening | Screening personnel | — |
| PS-4 | Personnel Termination | Termination procedures | — |
| PS-5 | Personnel Transfer | Transfer procedures | — |
| PS-6 | Access Agreements | Access agreements | — |
| PS-7 | External Personnel Security | Third-party personnel security | — |
| PS-8 | Personnel Sanctions | Sanctions for non-compliance | — |
| PS-9 | Position Descriptions | Security in position descriptions | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| PT-1 | Policy and Procedures | PII policy and procedures | — |
| PT-2 | Authority to Process PII | Authority for PII processing | — |
| PT-3 | Purpose Specification | Specifying PII processing purposes | — |
| PT-4 | Consent | Obtaining consent for PII processing | — |
| PT-5 | Privacy Notice | Privacy notices | — |
| PT-6 | System of Records Notice | SORN requirements | — |
| PT-7 | Social Security Numbers | SSN usage restrictions | — |
| PT-8 | Computer Matching | Computer matching requirements | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| RA-1 | Policy and Procedures | Risk assessment policy | — |
| RA-2 | Security Categorization | Categorizing systems | — |
| RA-3 | Risk Assessment | Conducting risk assessments | — |
| RA-5 | Vulnerability Monitoring and Scanning | Vulnerability scanning | — |
| RA-6 | Technical Surveillance Countermeasures | TSCM | — |
| RA-7 | Risk Response | Responding to risks | — |
| RA-8 | Privacy Impact Assessment | Privacy impact assessments | — |
| RA-9 | Criticality Analysis | Criticality analysis | — |
| RA-10 | Threat Hunting | Threat hunting program | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| SA-1 | Policy and Procedures | Acquisition policy | — |
| SA-2 | Allocation of Resources | Resource allocation for security | — |
| SA-3 | System Development Life Cycle | SDLC security integration | — |
| SA-4 | Acquisition Process | Acquisition process | — |
| SA-5 | System Documentation | System documentation | — |
| SA-8 | Security and Privacy Engineering | Security engineering principles | — |
| SA-9 | External System Services | External service procurement | — |
| SA-10 | Developer Configuration Management | Developer CM | — |
| SA-11 | Developer Testing and Evaluation | Developer security testing | — |
| SA-15 | Development Process, Standards, and Tools | Development standards | — |
| SA-16 | Developer-Provided Training | Developer training | — |
| SA-17 | Developer Security and Privacy Architecture | Developer security architecture | — |
| SA-20 | Customized Development of Critical Components | Custom development | — |
| SA-21 | Developer Screening | Developer screening | — |
| SA-22 | Unsupported System Components | Managing unsupported components | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| SC-1 | Policy and Procedures | SC policy | — |
| SC-2 | Separation of System and User Functionality | Separating system and user functions | — |
| SC-3 | Security Function Isolation | Isolating security functions | — |
| SC-4 | Information in Shared Resources | Protecting shared resources | — |
| SC-5 | Denial of Service Protection | DoS protection | — |
| SC-6 | Resource Availability | Ensuring resource availability | — |
| SC-7 | Boundary Protection | Network perimeter security | 11 |
| SC-8 | Transmission Confidentiality and Integrity | Encrypting data in transit | 3 |
| SC-10 | Network Disconnect | Network disconnection | — |
| SC-11 | Trusted Path | Trusted communication path | — |
| SC-12 | Cryptographic Key Establishment and Management | Key management | 1 |
| SC-13 | Cryptographic Protection | Cryptographic mechanisms | 1 |
| SC-15 | Collaborative Computing Devices | Collaborative devices security | — |
| SC-20 | Secure Name/Address Resolution Service | DNS security | 1 |
| SC-21 | Secure Name/Address Resolution Service (Recursive) | Recursive DNS security | 1 |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | DNS architecture | — |
| SC-23 | Session Authenticity | Session security | — |
| SC-24 | Fail in Known State | Failing securely | — |
| SC-25 | Thin Nodes | Thin client security | — |
| SC-28 | Protection of Information at Rest | Encrypting data at rest | 1 |
| SC-29 | Heterogeneity | Using diverse technologies | — |
| SC-30 | Concealment and Misdirection | Deception technologies | — |
| SC-32 | System Partitioning | System segmentation | — |
| SC-34 | Non-Modifiable Executable Programs | Immutable executables | — |
| SC-36 | Processing Distribution | Distributed processing | — |
| SC-38 | Operations Security | OPSEC | — |
| SC-39 | Process Isolation | Process isolation | — |
| SC-40 | Wireless Link Protection | Wireless security | — |
| SC-41 | Port and I/O Device Access | Port/IO device control | — |
| SC-42 | Sensor Capability and Data | Sensor security | — |
| SC-43 | Usability Metrics | Security usability | — |
| SC-44 | Detonation Chambers | Sandboxing | — |
| SC-45 | System Time Synchronization | Time synchronization | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| SI-1 | Policy and Procedures | SI policy | — |
| SI-2 | Flaw Remediation | Remediating system flaws | 3 |
| SI-3 | Malicious Code Protection | Anti-malware protection | — |
| SI-4 | System Monitoring | Monitoring system activity | — |
| SI-5 | Security Alerts, Advisories, and Directives | Security advisories | — |
| SI-6 | Security and Privacy Function Verification | Verifying security functions | — |
| SI-7 | Software, Firmware, and Information Integrity | Software integrity | — |
| SI-8 | Spam Protection | Spam filtering | 1 |
| SI-10 | Information Input Validation | Input validation | — |
| SI-11 | Error Handling | Proper error handling | — |
| SI-12 | Information Management and Retention | Data management | — |
| SI-13 | Predictable Failure Prevention | Preventing predictable failures | — |
| SI-14 | Non-Persistence | Non-persistent computing | — |
| SI-15 | Information Output Filtering | Output filtering | — |
| SI-16 | Memory Protection | Memory protection | — |
| SI-17 | Fail-Safe Procedures | Fail-safe procedures | — |
| SI-18 | Cybersecurity Operations Center | SOC operations | — |
| SI-19 | Deception Environment | Honeypots and deception | — |
| SI-20 | Tainted Information Analysis | Analyzing tainted data | — |
| SI-21 | Information Deletion | Data deletion | — |
| Control ID | Name | Description | Findings |
|---|---|---|---|
| SR-1 | Policy and Procedures | SCRM policy | — |
| SR-2 | Supply Chain Risk Management Plan | SCRM plans | — |
| SR-3 | Supply Chain Controls and Processes | Supply chain controls | — |
| SR-4 | Provenance | Provenance tracking | — |
| SR-5 | Acquisition Strategies, Tools, and Methods | Secure acquisition | — |
| SR-6 | Supplier Assessments and Reviews | Supplier evaluations | — |
| SR-7 | Supply Chain Operations Security | Supply chain OPSEC | — |
| SR-8 | Notification Agreements | Supply chain notifications | — |
| SR-9 | Tamper Resistance and Detection | Tamper detection | — |
| SR-10 | Inspection of Systems or Components | Component inspection | — |
| SR-11 | Component Authenticity | Authentic components | — |
| SR-12 | Component Disposal | Disposal of components | — |
CIS Benchmark Coverage
Summary
11
Benchmarks Covered
150
Total Benchmarks
7.3% coverage
Linux Operating System
2/27 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-UB-1.1 | Filesystem Configuration | Configure filesystem partitions and mount options securely | Pass | — |
| CIS-UB-1.2 | Configure Software Updates | Configure package repository and automatic updates | Pass | — |
| CIS-UB-1.3 | Filesystem Integrity Checking | Verify filesystem integrity with AIDE | Pass | — |
| CIS-UB-1.4 | Secure Boot Settings | Configure bootloader password and permissions | Pass | — |
| CIS-UB-1.5 | Additional Process Hardening | Enable ASLR, core dump restrictions, prelink | Pass | — |
| CIS-UB-1.6 | Mandatory Access Control | Configure SELinux or AppArmor | Pass | — |
| CIS-UB-1.7 | Warning Banners | Configure login banners and MOTD | Pass | — |
| CIS-UB-1.8 | GNOME Display Manager | Secure GDM configuration | Pass | — |
| CIS-UB-2.1 | inetd Services | Remove or disable unused inetd services | Pass | — |
| CIS-UB-2.2 | Special Purpose Services | Securely configure special purpose services | Pass | — |
| CIS-UB-2.3 | Service Clients | Remove or disable unnecessary service clients | Pass | — |
| CIS-UB-3.1 | Network Parameters (Host Only) | Configure network kernel parameters | Failed | 1 |
| CIS-UB-3.2 | Network Parameters (Host and Router) | Configure network parameters | Pass | — |
| CIS-UB-3.3 | IPv6 | Disable or secure IPv6 | Pass | — |
| CIS-UB-3.4 | TCP Wrappers | Configure TCP wrappers | Pass | — |
| CIS-UB-3.5 | Uncommon Network Protocols | Disable uncommon network protocols | Pass | — |
| CIS-UB-3.6 | Firewall Configuration | Configure iptables/nftables/firewalld | Pass | — |
| CIS-UB-4.1 | Configure System Accounting | Configure auditd and logging | Pass | — |
| CIS-UB-4.2 | Configure Logging | Configure rsyslog or syslog-ng | Pass | — |
| CIS-UB-4.3 | Configure logrotate | Configure log rotation | Pass | — |
| CIS-UB-5.1 | Configure cron | Secure cron configuration | Pass | — |
| CIS-UB-5.2 | Configure SSH Server | Secure SSH daemon configuration | Failed | 1 |
| CIS-UB-5.3 | Configure PAM | Secure PAM configuration | Pass | — |
| CIS-UB-5.4 | User Accounts and Environment | Configure user accounts and environment | Pass | — |
| CIS-UB-5.5 | Root Login Restrictions | Restrict root login | Pass | — |
| CIS-UB-6.1 | System File Permissions | Verify system file permissions | Pass | — |
| CIS-UB-6.2 | User and Group Settings | Verify user and group settings | Pass | — |
Microsoft Windows Server
2/14 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-WS-1.1 | Account Policies | Configure password policy, lockout policy, and Kerberos policy | Pass | — |
| CIS-WS-2.1 | Audit Policy | Configure advanced audit policy | Failed | 1 |
| CIS-WS-2.2 | User Rights Assignment | Set appropriate user rights | Failed | 1 |
| CIS-WS-2.3 | Security Options | Configure security options | Pass | — |
| CIS-WS-3.1 | Windows Firewall | Configure Windows Firewall profiles | Pass | — |
| CIS-WS-4.1 | Microsoft Defender Antivirus | Configure Defender AV | Pass | — |
| CIS-WS-4.2 | Windows Defender Features | Configure Windows Defender features | Pass | — |
| CIS-WS-5.1 | Administrative Templates - Control Panel | Configure control panel policies | Pass | — |
| CIS-WS-5.2 | Administrative Templates - MSS Settings | Configure MSS security settings | Pass | — |
| CIS-WS-5.3 | Administrative Templates - Network | Configure network policies | Pass | — |
| CIS-WS-5.4 | Administrative Templates - System | Configure system policies | Pass | — |
| CIS-WS-5.5 | Administrative Templates - Windows Components | Configure Windows component policies | Pass | — |
| CIS-WS-6.1 | Domain Controller Policies | Configure domain controller specific policies | Pass | — |
| CIS-WS-7.1 | Additional Security Settings | Additional security hardening | Pass | — |
Apache HTTP Server
3/13 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-AP-1.1 | Directory Permissions | Set appropriate directory permissions | Failed | 1 |
| CIS-AP-1.2 | Apache User and Group | Configure dedicated Apache user and group | Pass | — |
| CIS-AP-2.1 | Minimize Loaded Modules | Disable unnecessary Apache modules | Pass | — |
| CIS-AP-2.2 | Server Information Leakage | Disable server signature and banner | Pass | — |
| CIS-AP-2.3 | Directory Listing | Disable directory listing | Failed | 2 |
| CIS-AP-2.4 | HTTP Methods | Restrict HTTP methods | Failed | 7 |
| CIS-AP-2.5 | Timeout Settings | Configure timeout settings | Pass | — |
| CIS-AP-3.1 | SSL/TLS Configuration | Configure HTTPS with strong ciphers | Pass | — |
| CIS-AP-3.2 | HTTP Strict Transport Security | Enable HSTS header | Pass | — |
| CIS-AP-4.1 | Logging Configuration | Configure Apache logging | Pass | — |
| CIS-AP-4.2 | Limit Request Size | Configure request size limits | Pass | — |
| CIS-AP-5.1 | File Permissions on Apache Files | Set secure file permissions | Pass | — |
| CIS-AP-5.2 | Deny Access to System Files | Restrict access to system files | Pass | — |
Nginx Web Server
3/12 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-NG-1.1 | Minimize Loaded Modules | Disable unnecessary nginx modules | Pass | — |
| CIS-NG-1.2 | Nginx User and Group | Configure dedicated nginx user | Pass | — |
| CIS-NG-2.1 | Server Information Leakage | Disable server tokens | Failed | 1 |
| CIS-NG-2.2 | Directory Listing | Disable directory listing | Pass | — |
| CIS-NG-2.3 | HTTP Methods | Restrict HTTP methods | Failed | 3 |
| CIS-NG-2.4 | Timeouts Configuration | Configure timeouts | Failed | 2 |
| CIS-NG-3.1 | SSL/TLS Configuration | Configure HTTPS with strong ciphers | Pass | — |
| CIS-NG-3.2 | HSTS Header | Enable HSTS | Pass | — |
| CIS-NG-4.1 | Limit Request Rate | Configure rate limiting | Pass | — |
| CIS-NG-4.2 | Client Body Size | Limit client body size | Pass | — |
| CIS-NG-5.1 | Logging Configuration | Configure nginx logging | Pass | — |
| CIS-NG-5.2 | File Permissions | Set secure file permissions | Pass | — |
MySQL Database
1/12 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-MY-1.1 | Operating System Level Configuration | Database OS hardening | Pass | — |
| CIS-MY-2.1 | MySQL Installation and Patches | Keep MySQL up to date | Pass | — |
| CIS-MY-2.2 | Dedicated MySQL User | Run MySQL as dedicated user | Pass | — |
| CIS-MY-3.1 | Authentication and Authorization | Secure authentication | Failed | 1 |
| CIS-MY-3.2 | Password Policies | Configure password policies | Pass | — |
| CIS-MY-3.3 | Anonymous Accounts | Remove anonymous accounts | Pass | — |
| CIS-MY-3.4 | Remote Root Access | Restrict remote root access | Pass | — |
| CIS-MY-4.1 | Audit Logging | Enable MySQL audit logging | Pass | — |
| CIS-MY-4.2 | Log File Permissions | Protect log files | Pass | — |
| CIS-MY-5.1 | Network Security | Configure network binding | Pass | — |
| CIS-MY-5.2 | SSL/TLS for Connections | Enable TLS for MySQL connections | Pass | — |
| CIS-MY-6.1 | File System Security | Secure MySQL file permissions | Pass | — |
PostgreSQL Database
0/11 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-PG-1.1 | File Permissions | Set secure file permissions on PostgreSQL files | Pass | — |
| CIS-PG-1.2 | Dedicated User | Run PostgreSQL as dedicated user | Pass | — |
| CIS-PG-2.1 | Authentication Configuration | Configure pg_hba.conf securely | Pass | — |
| CIS-PG-2.2 | Password Policies | Configure password policies | Pass | — |
| CIS-PG-2.3 | Superuser Restrictions | Restrict superuser access | Pass | — |
| CIS-PG-3.1 | Audit Logging | Enable PostgreSQL audit logging | Pass | — |
| CIS-PG-3.2 | Log File Permissions | Protect PostgreSQL log files | Pass | — |
| CIS-PG-4.1 | Network Security | Configure listen_addresses | Pass | — |
| CIS-PG-4.2 | SSL/TLS Configuration | Enable TLS for connections | Pass | — |
| CIS-PG-5.1 | Installation and Updates | Keep PostgreSQL updated | Pass | — |
| CIS-PG-6.1 | Connection Pooling | Secure connection pooling | Pass | — |
Amazon Web Services
0/14 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-AW-1.1 | IAM Account Security | Configure IAM password policies and MFA | Pass | — |
| CIS-AW-1.2 | IAM Users and Groups | Least privilege IAM configuration | Pass | — |
| CIS-AW-1.3 | IAM Root Account | Secure root account | Pass | — |
| CIS-AW-2.1 | CloudTrail | Enable CloudTrail logging | Pass | — |
| CIS-AW-2.2 | CloudWatch Monitoring | Configure monitoring | Pass | — |
| CIS-AW-3.1 | S3 Bucket Permissions | Secure S3 bucket policies | Pass | — |
| CIS-AW-3.2 | S3 Bucket Encryption | Enable S3 default encryption | Pass | — |
| CIS-AW-4.1 | VPC Security | Configure VPC flow logs and security groups | Pass | — |
| CIS-AW-4.2 | Security Groups | Restrict security group rules | Pass | — |
| CIS-AW-4.3 | Network ACLs | Configure network ACLs | Pass | — |
| CIS-AW-5.1 | RDS Security | Secure RDS instances | Pass | — |
| CIS-AW-5.2 | EC2 Security | Secure EC2 instances | Pass | — |
| CIS-AW-6.1 | Lambda Security | Secure Lambda functions | Pass | — |
| CIS-AW-6.2 | KMS Key Management | Configure KMS key rotation | Pass | — |
Microsoft Azure
0/12 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-AZ-1.1 | Identity and Access Management | Configure Azure AD and RBAC | Pass | — |
| CIS-AZ-1.2 | Azure AD Privileged Identity | Configure PIM | Pass | — |
| CIS-AZ-2.1 | Storage Account Security | Secure storage accounts | Pass | — |
| CIS-AZ-2.2 | Storage Encryption | Enable storage encryption | Pass | — |
| CIS-AZ-3.1 | SQL Database Security | Secure Azure SQL | Pass | — |
| CIS-AZ-4.1 | Network Security Groups | Configure NSG rules | Pass | — |
| CIS-AZ-4.2 | Azure Firewall | Configure Azure Firewall | Pass | — |
| CIS-AZ-5.1 | Monitoring and Logging | Enable Azure Monitor and Log Analytics | Pass | — |
| CIS-AZ-5.2 | Security Center | Configure Defender for Cloud | Pass | — |
| CIS-AZ-6.1 | Virtual Machine Security | Secure VM configurations | Pass | — |
| CIS-AZ-6.2 | Key Vault | Configure Key Vault access | Pass | — |
| CIS-AZ-7.1 | Kubernetes Services | Secure AKS clusters | Pass | — |
Google Cloud Platform
0/12 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-GC-1.1 | IAM and Organization | Configure IAM policies | Pass | — |
| CIS-GC-1.2 | Service Accounts | Secure service accounts | Pass | — |
| CIS-GC-2.1 | Cloud Storage | Secure Cloud Storage buckets | Pass | — |
| CIS-GC-2.2 | Cloud Storage Encryption | Enable CMEK for storage | Pass | — |
| CIS-GC-3.1 | Cloud SQL | Secure Cloud SQL instances | Pass | — |
| CIS-GC-4.1 | VPC and Firewall | Configure VPC firewall rules | Pass | — |
| CIS-GC-4.2 | Cloud Armor | Configure Cloud Armor WAF | Pass | — |
| CIS-GC-5.1 | Logging and Monitoring | Enable Cloud Audit Logs | Pass | — |
| CIS-GC-5.2 | Security Command Center | Configure SCC | Pass | — |
| CIS-GC-6.1 | Compute Engine | Secure VM instances | Pass | — |
| CIS-GC-6.2 | GKE Security | Secure GKE clusters | Pass | — |
| CIS-GC-7.1 | Cloud KMS | Configure Cloud KMS | Pass | — |
Docker Container Security
0/10 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-DK-1.1 | Host Configuration | Configure Docker host securely | Pass | — |
| CIS-DK-1.2 | Docker Daemon | Secure Docker daemon | Pass | — |
| CIS-DK-2.1 | Dockerfile Security | Secure Dockerfile practices | Pass | — |
| CIS-DK-2.2 | Image Security | Use trusted images and scan | Pass | — |
| CIS-DK-3.1 | Container Runtime | Secure container runtime | Pass | — |
| CIS-DK-3.2 | Container Privileges | Restrict container privileges | Pass | — |
| CIS-DK-4.1 | Docker Networking | Configure Docker networks | Pass | — |
| CIS-DK-4.2 | Docker Swarm | Secure Docker swarm mode | Pass | — |
| CIS-DK-5.1 | Logging and Auditing | Configure Docker logging | Pass | — |
| CIS-DK-6.1 | Secrets Management | Manage Docker secrets securely | Pass | — |
Kubernetes
0/13 covered
| ID | Benchmark | Description | Status | Findings |
|---|---|---|---|---|
| CIS-K8-1.1 | Control Plane Security | Secure control plane components | Pass | — |
| CIS-K8-1.2 | API Server | Secure kube-apiserver configuration | Pass | — |
| CIS-K8-1.3 | Controller Manager | Secure kube-controller-manager | Pass | — |
| CIS-K8-1.4 | Scheduler | Secure kube-scheduler | Pass | — |
| CIS-K8-2.1 | etcd Configuration | Secure etcd | Pass | — |
| CIS-K8-3.1 | Control Plane Authentication | Configure authentication | Pass | — |
| CIS-K8-3.2 | RBAC Policies | Configure RBAC authorization | Pass | — |
| CIS-K8-4.1 | Worker Node Security | Secure worker nodes | Pass | — |
| CIS-K8-4.2 | Kubelet Configuration | Secure kubelet | Pass | — |
| CIS-K8-5.1 | Network Policies | Configure network policies | Pass | — |
| CIS-K8-5.2 | Pod Security | Configure Pod Security Standards | Pass | — |
| CIS-K8-6.1 | Secrets Management | Manage Kubernetes secrets | Pass | — |
| CIS-K8-7.1 | Logging and Monitoring | Configure logging and monitoring | Pass | — |
Exploitation Timeline
| Timestamp | Action | Target | Success | Access Level |
|---|---|---|---|---|
| No exploitation timeline data. Populate assessment.exploitation.timeline | ||||
Exploitation Summary
Total Attempts
0
Successful
0
Persistence
Not Achieved
Exfiltration
Not Possible
Countermeasure Effectiveness
| Control Type | Status | Result |
|---|---|---|
| Effective |
Detection Metrics
Mean Time to Detect (MTTD)
0
minutes
Mean Time to Respond (MTTR)
0
minutes
MITRE ATT&CK Attack Paths
6 curated path(s)
WordPress Plugin → Admin Compromise → Database Access
CriticalChain plugin/version fingerprinting, user enumeration, and unthrottled login to gain WordPress admin, then pivot to the internet-exposed database.
Domain: acaciagrovehotels.example |
Entry:
VULN-019
T1592
Gather Victim Host Information
T1589
Gather Victim Identity Information
T1190
Exploit Public-Facing Application
T1110
Brute Force
T1550
Use Alternate Authentication Material
T1005
Data from Local System
T1592 — Fingerprint WordPress core and plugin versions.
T1589 — Enumerate admin usernames via REST API and author pages.
High
VULN-009 — WordPress User Enumeration via REST API and Author Pages (acaciagrovehotels.example/wp-json/wp/v2/users)
T1190 — Abuse XML-RPC multicall to amplify brute-force.
High
VULN-016 — XML-RPC Enabled with Full Method Surface Exposed (acaciagrovehotels.example/xmlrpc.php)
T1110 — Brute-force admin credentials (no rate limiting).
Critical
VULN-005 — WordPress Admin Panel Accessible Without Rate Limiting (acaciagrovehotels.example/wp-login.php)
T1550 — Pivot to the internet-exposed MySQL service.
Critical
VULN-001 — Internet-Facing MySQL Service Exposed (192.0.2.44 (savannasuites.example shared host, port 3306))
T1005 — Access backend booking data.
Critical
VULN-001 — Internet-Facing MySQL Service Exposed (192.0.2.44 (savannasuites.example shared host, port 3306))
Client-Side Secrets → Payment/Mail Abuse
CriticalHarvest secrets embedded in the public JS bundle to abuse the payment gateway and mail relay.
Domain: acaciagrovehotels.example |
Entry:
VULN-002
T1592
Gather Victim Host Information
T1552
Unsecured Credentials
T1078
Valid Accounts
T1565
Data Manipulation
T1592 — Retrieve the public JS bundle.
Critical
VULN-002 — Hardcoded API Keys and Payment Credentials in Client-Side JavaScript (www.acaciagrovehotels.example (/assets/js/app.bundle.js))
T1552 — Extract hardcoded gateway key and SMTP credential.
Critical
VULN-002 — Hardcoded API Keys and Payment Credentials in Client-Side JavaScript (www.acaciagrovehotels.example (/assets/js/app.bundle.js))
T1078 — Use the SMTP relay to send brand-spoofed phishing.
Critical
VULN-002 — Hardcoded API Keys and Payment Credentials in Client-Side JavaScript (www.acaciagrovehotels.example (/assets/js/app.bundle.js))
T1565 — Forge or manipulate payment transactions.
Critical
VULN-002 — Hardcoded API Keys and Payment Credentials in Client-Side JavaScript (www.acaciagrovehotels.example (/assets/js/app.bundle.js))
Exposed MySQL → Credential Brute Force → Data Theft
CriticalReach the internet-exposed MySQL service and attempt credential attacks against booking data.
Domain: savannasuites.example |
Entry:
VULN-001
T1046
Network Service Discovery
T1190
Exploit Public-Facing Application
T1110
Brute Force
T1041
Exfiltration Over C2 Channel
T1046 — Discover MySQL on 3306 via scan.
Critical
VULN-001 — Internet-Facing MySQL Service Exposed (192.0.2.44 (savannasuites.example shared host, port 3306))
T1190 — Connect directly to the exposed service.
Critical
VULN-001 — Internet-Facing MySQL Service Exposed (192.0.2.44 (savannasuites.example shared host, port 3306))
T1110 — Brute-force / credential-stuff database logins.
Critical
VULN-001 — Internet-Facing MySQL Service Exposed (192.0.2.44 (savannasuites.example shared host, port 3306))
T1041 — Exfiltrate booking/customer records.
Critical
VULN-001 — Internet-Facing MySQL Service Exposed (192.0.2.44 (savannasuites.example shared host, port 3306))
Guest WiFi → IoT/OT Controller → Building Systems
HighFrom the guest wireless segment, reach an unauthenticated on-site IoT controller and building systems.
Domain: acaciagrove.example |
Entry:
VULN-003
T1046
Network Service Discovery
T1190
Exploit Public-Facing Application
T1133
External Remote Services
T1496
Resource Hijacking
T1046 — Scan the guest subnet (no client isolation).
Medium
VULN-028 — Other Guest Peers Expose Windows RPC and UPnP Services (Guest Wi-Fi VLAN 192.168.80.0/24)
T1190 — Reach the unauthenticated IoT controller console.
Critical
VULN-003 — Unauthenticated Building-Energy IoT Controller Exposed on Guest WiFi (192.168.80.7 (energy IoT controller, Guest WiFi VLAN))
T1133 — Pivot toward the guest gateway management plane.
High
VULN-014 — Guest-Reachable Gateway Management Plane (SSH + DNS) on Network Edge (192.168.81.1 (guest gateway management))
T1496 — Manipulate on-site energy/building systems.
Critical
VULN-003 — Unauthenticated Building-Energy IoT Controller Exposed on Guest WiFi (192.168.80.7 (energy IoT controller, Guest WiFi VLAN))
Dev/Admin Subdomain → Hosting Panel Compromise
HighLeverage exposed non-production subdomains and hosting panels to reach an administrative foothold.
Domain: baobablodge.example |
Entry:
VULN-006
T1590
Gather Victim Network Information
T1190
Exploit Public-Facing Application
T1110
Brute Force
T1078
Valid Accounts
T1590 — Enumerate dev/admin/sandbox subdomains.
High
VULN-006 — Development / Admin Subdomains Exposed (dev.baobablodge.example, admin.dev.baobablodge.example, sandbox-internal.savannasuites.example)
T1190 — Reach exposed hosting control panels.
High
VULN-007 — Administrative / Hosting Panels Exposed (cpanel/webmail/webdisk.acaciagrovehotels.example)
T1110 — Brute-force panel credentials.
High
VULN-007 — Administrative / Hosting Panels Exposed (cpanel/webmail/webdisk.acaciagrovehotels.example)
T1078 — Use panel access to control hosting account.
High
VULN-007 — Administrative / Hosting Panels Exposed (cpanel/webmail/webdisk.acaciagrovehotels.example)
Email/SPF/DMARC Weakness → Business Email Compromise
HighExploit missing DMARC and permissive SPF to spoof the brands for phishing and BEC.
Domain: acaciagrove.example |
Entry:
VULN-008
T1589
Gather Victim Identity Information
T1566
Phishing
T1114
Email Collection
T1589 — Harvest disclosed mailboxes.
T1566 — Send spoofed phishing that passes upstream checks.
High
VULN-008 — Missing DMARC and Weak SPF (?all) Across Brand Domains (acaciagrove.example, acaciagrovehotels.example, savannasuites.example)
T1114 — Leverage breached-account reuse for access.
High
VULN-011 — AGHG Email Accounts Present in Known Third-Party Data Breaches (acaciagrove.example, acaciagrovehotels.example, savannasuites.example, baobablodge.example)
Risk Assessment Matrix (Likelihood x Impact)
| Likelihood \ Impact | Very High | High | Medium | Low | Very Low |
|---|---|---|---|---|---|
| Very High | 5 | — | — | — | — |
| High | — | 11 | — | — | — |
| Medium | — | — | 13 | — | — |
| Low | — | — | — | 5 | — |
| Very Low | — | — | — | — | 2 |
Risk Distribution
KPI Dashboard
Vulnerability Density
1.1
per asset
Avg CVSS
5.7
Remediation Rate
16.7%
False Positive Rate
0.0%
Step Completion
10.3%
Scope Coverage
100%
Total Steps
87
Completed
9
In Progress
4
Overdue
0
Finding Remediation Status
| Finding | Severity | Progress |
|---|---|---|
| VULN-001 Internet-Facing MySQL Service Exposed | Critical |
0/4
|
| VULN-002 Hardcoded API Keys and Payment Credentials in Client-Side JavaScript | Critical |
1/3
|
| VULN-003 Unauthenticated Building-Energy IoT Controller Exposed on Guest WiFi | Critical |
1/2
|
| VULN-004 Windows Server Fleet — SMB/RDP Legacy Exposure (Pending Validation) | Critical |
0/4
|
| VULN-005 WordPress Admin Panel Accessible Without Rate Limiting | Critical |
1/2
|
| VULN-006 Development / Admin Subdomains Exposed | High |
0/3
|
| VULN-007 Administrative / Hosting Panels Exposed | High |
0/3
|
| VULN-008 Missing DMARC and Weak SPF (?all) Across Brand Domains | High |
1/3
|
| VULN-009 WordPress User Enumeration via REST API and Author Pages | High |
1/2
|
| VULN-010 OpenSSH on Non-Standard Port with Legacy Algorithms | High |
0/3
|
| VULN-011 AGHG Email Accounts Present in Known Third-Party Data Breaches | High |
0/3
|
| VULN-012 Cloudflare Origin IP Exposure (reports.savannasuites.example) | High |
0/3
|
| VULN-013 Internal Web Application Stack Outdated (Apache/PHP/OpenSSL) | High |
0/3
|
| VULN-014 Guest-Reachable Gateway Management Plane (SSH + DNS) on Network Edge | High |
0/3
|
| VULN-015 Pure-FTPd Anonymous Login Enabled on Port 21 | High |
1/3
|
| VULN-016 XML-RPC Enabled with Full Method Surface Exposed | High |
0/3
|
| VULN-017 Internet-Facing DNS Server (BIND 9.16.23) | Medium |
0/3
|
| VULN-018 Missing Security Headers (CSP, X-Frame-Options, HSTS) | Medium |
0/2
|
| VULN-019 WordPress and Plugin Versions Fingerprinted | Medium |
1/2
|
| VULN-020 WooCommerce Log Directories Disclosed in robots.txt | Medium |
1/2
|
| VULN-021 Outdated IIS 8.5 on Internal Windows Server | Medium |
0/2
|
| VULN-022 Internal Wireless Networks Use WPA2-PSK Only — No WPA3 / 802.1X / PMF | Medium |
0/3
|
| VULN-023 Self-Signed TLS Certificate with Excessive Validity on IoT Controller | Medium |
0/3
|
| VULN-024 Shared Mail Hosting Across Brand Domains | Medium |
0/2
|
| VULN-025 TLS Certificate Expiring Within 30 Days | Medium |
1/2
|
| VULN-026 Exim SMTP Service Exposed on Multiple Ports | Medium |
0/3
|
| VULN-027 Hosting Control Panel Exposed on Public Subdomain | Medium |
0/3
|
| VULN-028 Other Guest Peers Expose Windows RPC and UPnP Services | Medium |
0/2
|
| VULN-029 DNSSEC Unsigned Across All Domains | Medium |
0/2
|
| VULN-030 Email Addresses Disclosed in Website Source | Low |
0/3
|
| VULN-031 WordPress readme.html and license.txt Exposed | Low |
0/1
|
| VULN-032 Missing robots.txt, sitemap.xml, and security.txt (RFC 9116) | Low |
0/1
|
| VULN-033 Missing X-Content-Type-Options and Referrer-Policy Headers | Low |
0/1
|
| VULN-034 Verbose Server Version Banner on Reverse Proxy | Low |
0/1
|
| VULN-035 Internal Management VLAN Default-Deny Posture Confirmed | Info |
0/1
|
| VULN-036 Guest Wi-Fi Subnet High Device Density and Deferred Probing | Info |
0/1
|
Remediation Checklist
87 steps across 36 findings
Compliance Status Overview
Standard-by-Standard Status
OWASP Top 10 2021
Non-Compliant
0.0%
0 / 10 controls satisfied
PCI DSS v4.0
Non-Compliant
0.0%
0 / 15 controls satisfied
NIST SP 800-53
Non-Compliant
7.0%
18 / 258 controls satisfied
NIST CSF 2.0
Non-Compliant
0.0%
0 / 22 controls satisfied
CIS Benchmarks
Non-Compliant
7.3%
11 / 150 controls satisfied
OWASP Top 10 2021 Coverage
OWASP WSTG Coverage by Category
INFO
Information Gathering
0.0%
CONF
Configuration and Deployment Management Testing
0.0%
IDNT
Identity Management Testing
0.0%
ATHN
Authentication Testing
0.0%
ATHZ
Authorization Testing
0.0%
SESS
Session Management Testing
0.0%
INPV
Input Validation Testing
0.0%
ERRH
Error Handling Testing
0.0%
CRYP
Cryptography Testing
0.0%
BUSL
Business Logic Testing
0.0%
CLNT
Client-side Testing
0.0%
APIT
API Testing
0.0%
NIST CSF 2.0 Function Coverage
PCI DSS v4.0 Control Mapping
No PCI DSS findings mapped. Set pci_refs in finding frontmatter.
NIST CSF Category Detail
| Function | Category | Coverage |
|---|---|---|
| Govern | 0/6 categories |
0.0%
|
| Identify | 0/3 categories |
0.0%
|
| Protect | 0/5 categories |
0.0%
|
| Detect | 0/2 categories |
0.0%
|
| Respond | 0/4 categories |
0.0%
|
| Recover | 0/2 categories |
0.0%
|
Approver Sign-In
Not signed in — sign in to approve phases.
Current Engagement Status
Cycle 3 — Exploitation & Validation (HITL Gate)
Continuous assessment active — Cycle 3 validation in progress; remediation & re-test running continuously; monitoring always on. Next full sweep 2026-08-01.
Last work
2026-07-11
Cycle 3 Completion
58.3%
Completed
14
In Progress
7
Blocked
0
Pending / Not Started
3
Continuous Assessment Lifecycle
Cycle 3 · active · Monthly continuous cycles + always-on monitoring · next sweep 2026-08-01
PTES 01
Onboarding & Scoping
100%
PTES 02-03
Reconnaissance (continuous)
100%
PTES 04-05
Threat Modelling & Vuln Analysis
100%
PTES 06
Exploitation & Validation (HITL Gate)
65%
PTES 07-08
Remediation Tracking (continuous)
55%
PTES 08
Re-Test & Verify (continuous)
50%
PTES ∞
Continuous Monitoring
Active
Phase 01 — Onboarding & Scoping
Preparation & Scoping (one-time)
2026-06-10 → 2026-06-11
COMPLETED
100%
One-time setup: scope, rules of engagement, authorisation, and continuous-assessment cadence agreed with AGHG.
Kick-off with AGHG stakeholders
DONE
Scope confirmation (4 domains, on-site properties)
DONE
Signed authorisation & monthly cadence agreed
DONE
Phase 02-03 — Reconnaissance (continuous)
Intelligence Gathering — Passive & Active
2026-07-01 → 2026-07-03
COMPLETED
100%
Runs every cycle: OSINT, DNS/subdomain enumeration, breach exposure, and active port/service scanning across the attack surface. Cycle 3 sweep complete.
Cycle 3 passive recon & breach re-check
DONE
Cycle 3 active scan / new-asset discovery
DONE
Diff vs Cycle 2 surface (2 new subdomains)
DONE
Phase 04-05 — Threat Modelling & Vuln Analysis
Threat Modelling & Vulnerability Analysis
2026-07-03 → 2026-07-06
COMPLETED
100%
Runs every cycle: attack-path mapping and vulnerability identification/validation across web, network and wireless. Cycle 3 analysis complete.
Cycle 3 attack-path refresh
DONE
Web / network / email analysis
DONE
Prioritise against remediated baseline
DONE
Phase 06 — Exploitation & Validation (HITL Gate)
Exploitation — human-approved validation
2026-07-08
IN PROGRESS
65%
Cycle 3 active validation in progress. Every consequential action is human-approved; no destructive testing. On-site wireless/internal work runs in this phase.
Approved validation of MySQL/FTP exposure
DONE
Validate client-side secret exposure
ACTIVE
On-site wireless/internal (Kopje View)
ACTIVE
Approval to validate WordPress auth chain
QUEUED
Client Approval Required
This phase requires client sign-off before work proceeds.
Phase 07-08 — Remediation Tracking (continuous)
Remediation — tracked continuously
2026-06-20
IN PROGRESS
55%
Always active: AIMI tracks client remediation of confirmed findings across cycles. 6 findings resolved/mitigated to date; 4 in active remediation.
Rotate exposed secrets (VULN-002)
DONE
Email auth hardening DMARC/DKIM (VULN-008)
ACTIVE
MFA rollout on admin logins (VULN-005)
ACTIVE
IoT/OT VLAN isolation (VULN-003)
ACTIVE
Phase 08 — Re-Test & Verify (continuous)
Re-Test — closes the loop each cycle
2026-06-24
IN PROGRESS
50%
Always active: AIMI re-tests remediated items on the next pass and marks them Verified. 7 fixes re-tested and confirmed closed so far; more queued as remediation completes.
Re-test & verify FTP / readme / TLS / logs
DONE
Re-test WP enumeration & versioning
DONE
Re-test email auth once DKIM completes
ACTIVE
Re-test secrets once backend proxy ships
QUEUED
Phase ∞ — Continuous Monitoring
Always-on monitoring & next-cycle trigger
2026-06-11
ALWAYS ON
Active
Perpetual: continuous attack-surface monitoring between cycles. New exposures automatically open findings and trigger the next assessment cycle. Next scheduled sweep: 2026-08-01.
Continuous surface monitoring (active)
ACTIVE
Auto-open findings on new exposure
DONE
Trigger Cycle 4 sweep (scheduled 2026-08-01)
QUEUED
Active Blockers
2 items
Client sign-off pending before active credential-attack validation.
On-site internal assessment requires an off-peak window.
Engagement Milestones
Onboarding & cadence agreed
2026-06-11
PENDING
Cycle 1 sweep complete
2026-06-18
PENDING
First fixes re-tested & verified
2026-06-30
PENDING
Cycle 2 sweep complete
2026-07-06
PENDING
Cycle 3 validation (in progress)
TBD
PENDING
Cycle 4 sweep (scheduled)
2026-08-01
PENDING
Engagement Info
Start: 2026-06-10
Last update: 2026-07-11
Dashboard built: 2026-07-13 14:25:53
AIMI Assessment Team
Acacia Grove Hospitality Group (fictional)
Harare on-site: 2026-06-23
Total Loot Items
10
Exploitable
8
Validated
3
Critical
4
Categories
8
Loot by Category
Credentials: 1
API Keys: 2
User Enumeration: 1
Version Disclosure: 1
Infrastructure: 2
WPA2 Handshake: 1
Email Addresses: 1
Subdomains: 1
Loot Register
10 items captured
| ID | Category | Item | Target | Sev | Finding | Status | Exploit? | Evidence |
|---|---|---|---|---|---|---|---|---|
| LOOT-001 | Credentials |
Anonymous FTP Access
Anonymous FTP login accepted; empty root directory listing obtained. No files transferred.
|
192.0.2.44:21 (savannasuites.example) | High | VULN-015 | Open | demo-evidence-ftp.md | |
| LOOT-002 | API Keys |
Payment Gateway Key (client-side)
Live-looking payment gateway key present in public JS bundle (synthetic demo value).
|
acaciagrovehotels.example bundle | Critical | VULN-002 | Open | demo-evidence-jsbundle.md | |
| LOOT-003 | API Keys |
SMTP Relay Credential (client-side)
SMTP relay credential embedded in the same client bundle (synthetic demo value).
|
acaciagrovehotels.example bundle | Critical | VULN-002 | Open | demo-evidence-jsbundle.md | |
| LOOT-004 | User Enumeration |
WordPress Admin Usernames
Two administrative usernames enumerated via REST API.
|
acaciagrovehotels.example | High | VULN-009 | Open | demo-evidence-users.md | |
| LOOT-005 | Version Disclosure |
MySQL 5.7.44 Banner
MySQL handshake banner captured (banner grab only).
|
192.0.2.44:3306 | Critical | VULN-001 | Open | demo-evidence-mysql.md | |
| LOOT-006 | Infrastructure |
Cloudflare Origin IP
True origin IP discovered behind Cloudflare via passive DNS.
|
reports.savannasuites.example -> 198.51.100.77 | High | VULN-012 | Open | demo-evidence-origin.md | |
| LOOT-007 | WPA2 Handshake |
AGHG-Staff Handshake
WPA2 4-way handshake captured for offline analysis (not cracked).
|
AGHG-Staff SSID (Towers) | Medium | VULN-022 | Open | demo-evidence-handshake.md | |
| LOOT-008 | Infrastructure |
Unauthenticated IoT Console
Guest-reachable IoT controller console with no authentication.
|
192.168.80.7 (energy IoT controller) | Critical | VULN-003 | Open | demo-evidence-iot.md | |
| LOOT-009 | Email Addresses |
Disclosed Reservation Mailboxes
Reservation mailboxes disclosed in page source.
|
baobablodge.example | Low | VULN-030 | Open | demo-evidence-emails.md | |
| LOOT-010 | Subdomains |
Dev/Admin Subdomains
Publicly reachable dev/admin/sandbox subdomains enumerated.
|
baobablodge.example / savannasuites.example | High | VULN-006 | Open | demo-evidence-subdomains.md |
Generate a professional PDF report of this assessment.
VAPT Assessment Report
External + Internal VAPT — Acacia Grove Hospitality Group
Executive Summary
This DEMONSTRATION report presents fully fictional data for a sample hospitality client, Acacia Grove Hospitality Group. It illustrates how AIMI's continuous attack-simulation and reporting surface looks to a customer. No real organisation, system, or person is represented. Domains use the reserved .example namespace and IP addresses use RFC 5737 documentation ranges.
Findings Summary
5
Critical
11
High
13
Medium
5
Low
2
Info
Detailed Findings
VULN-001
Internet-Facing MySQL Service Exposed
Critical
CVSS: 9.1
Asset: 192.0.2.44 (savannasuites.example shared host, port 3306)
Status: Open
Type: Network
MITRE: T1190
NIST: SC-7 AC-3
Description: The MySQL database service (version 5.7.44) on the savannasuites.example shared host (192.0.2.44) accepts inbound connections from the internet on port 3306/tcp. A banner grab confirmed the service is reachable. No exploitation or authentication was attempted.
Impact: - Database service directly exposed to the internet, expanding attack surface
- Prime target for brute-force, version-specific exploits, and credential stuffing
- MySQL 5.7 branch nearing end-of-life
Remediation: - Restrict port 3306 to localhost or trusted application hosts only via firewall
- If remote access is required, place behind a VPN or SSH tunnel
- Upgrade off the MySQL 5.7 branch to a supported version
- Enforce strong authentication and disable remote root login
VULN-002
Hardcoded API Keys and Payment Credentials in Client-Side JavaScript
Critical
CVSS: 9.3
Asset: www.acaciagrovehotels.example (/assets/js/app.bundle.js)
Status: In Progress
Type: Web Application
MITRE: T1552 T1078
NIST: IA-5 SC-28
Description: The public JavaScript bundle for the booking front-end embeds a live payment-gateway API key and an SMTP relay credential in cleartext. These are retrievable by any anonymous visitor viewing page source.
Impact: - Full compromise of the payment-gateway integration and outbound mail relay
- Attacker can forge transactions or send phishing as the brand
- PCI-DSS scope violation
Remediation: - Rotate the exposed gateway key and SMTP credential immediately
- Move all secrets server-side; never ship secrets in client bundles
- Proxy payment calls through a backend that holds the key
- Add secret-scanning to the CI pipeline
VULN-003
Unauthenticated Building-Energy IoT Controller Exposed on Guest WiFi
Critical
CVSS: 9.4
Asset: 192.168.80.7 (energy IoT controller, Guest WiFi VLAN)
Status: In Progress
Type: Network / IoT
MITRE: T1190 T1133
NIST: AC-3 SC-7
Description: A solar/battery building-energy IoT controller at the Baobab Lodge is reachable from the guest wireless network with an unauthenticated web console and SSH exposed. Guests can reach building-energy management directly.
Impact: - Unauthenticated control of on-site energy/battery infrastructure
- Pivot point from guest network into operational technology
- Potential physical/service disruption
Remediation: - Place all OT/IoT devices on a dedicated, isolated VLAN with no guest reachability
- Enable authentication and change default credentials on the controller console
- Disable SSH or restrict to management hosts only
VULN-004
Windows Server Fleet — SMB/RDP Legacy Exposure (Pending Validation)
Critical
CVSS: 9.8
Asset: Windows servers 192.168.78.18, 192.168.78.50, 192.168.78.53
Status: Open
Type: Network
MITRE: T1190 T1021
NIST: SI-2 CM-6
Description: Three internal Windows servers expose legacy SMBv1 and RDP with network-level authentication disabled. Version banners indicate unpatched builds potentially vulnerable to well-known SMB/RDP remote code execution issues. Exploitation was not attempted (validation pending client approval).
Impact: - Potential wormable remote code execution across the server fleet
- Domain-wide compromise if a domain controller is affected
- Ransomware lateral-movement risk
Remediation: - Disable SMBv1 fleet-wide
- Enforce Network Level Authentication on all RDP endpoints
- Apply current security patches; establish a monthly patch cadence
- Segment server VLAN from user VLANs
VULN-005
WordPress Admin Panel Accessible Without Rate Limiting
Critical
CVSS: 9.0
Asset: acaciagrovehotels.example/wp-login.php
Status: In Progress
Type: Web Application
MITRE: T1110 T1190
NIST: AC-7 IA-2
Description: The WordPress administration login at acaciagrovehotels.example enforces no rate limiting, lockout, or CAPTCHA, allowing unlimited password-guessing attempts against enumerated usernames.
Impact: - Brute-force / credential-stuffing path to administrative takeover
- Full site compromise and defacement or malware injection
Remediation: - Deploy a login rate-limiter / lockout plugin or WAF rule
- Enforce MFA on all administrative accounts
- Restrict wp-login.php and wp-admin by source IP allowlist where feasible
VULN-006
Development / Admin Subdomains Exposed
High
CVSS: 7.5
Asset: dev.baobablodge.example, admin.dev.baobablodge.example, sandbox-internal.savannasuites.example
Status: Open
Type: Web Application
MITRE: T1190 T1133
NIST: AC-3 SC-7
Description: Development, admin, and sandbox subdomains are publicly resolvable and reachable across two brands. Non-production environments frequently carry weaker controls, debug features, and stale code.
Impact: - Exposure of pre-production code, debug endpoints, and test data
- Weaker-hardened foothold into the environment
Remediation: - Restrict non-production hosts to internal networks or VPN/IP allowlist
- Require authentication on all dev/admin/sandbox environments
- Remove test data and disable debug output
VULN-007
Administrative / Hosting Panels Exposed
High
CVSS: 7.3
Asset: cpanel/webmail/webdisk.acaciagrovehotels.example
Status: Open
Type: Web Application
MITRE: T1190
NIST: AC-3 SC-7
Description: Multiple hosting management panels (cpanel, webmail, webdisk, autodiscover) are publicly reachable on acaciagrovehotels.example subdomains, presenting attractive targets for credential attacks.
Impact: - Increased attack surface for brute-force and credential stuffing
- Panel compromise could lead to full hosting account takeover
Remediation: - Restrict access to management panels by source IP allowlist or VPN
- Enforce MFA on all hosting/control panel logins
- Relocate default panel endpoints where supported
VULN-008
Missing DMARC and Weak SPF (?all) Across Brand Domains
High
CVSS: 7.4
Asset: acaciagrove.example, acaciagrovehotels.example, savannasuites.example
Status: In Progress
Type: Email Security
MITRE: T1566 T1589
NIST: SC-8 SI-8
Description: None of the assessed brand domains publish a DMARC policy, and SPF records terminate in a permissive `?all`. This permits trivial email spoofing of the brands for phishing.
Impact: - High-fidelity phishing impersonating the hotel brands
- Guest and staff credential theft; fraudulent booking scams
Remediation: - Publish DMARC at p=quarantine, ramp to p=reject
- Tighten SPF to `-all` after inventorying senders
- Enable DKIM signing on all sending services
VULN-009
WordPress User Enumeration via REST API and Author Pages
High
CVSS: 7.1
Asset: acaciagrovehotels.example/wp-json/wp/v2/users
Status: Mitigated
Type: Web Application
MITRE: T1589 T1087
NIST: AC-3
Description: The WordPress REST API and author archive pages disclose valid administrative usernames to anonymous callers, enabling targeted brute-force.
Impact: - Valid usernames feed credential-stuffing and brute-force
- Combined with VULN-005 (no rate limiting) this is an account-takeover chain
Remediation: - Disable the REST users endpoint for anonymous callers
- Block ?author= enumeration at the WAF
- Use display names that differ from login names
VULN-010
OpenSSH on Non-Standard Port with Legacy Algorithms
High
CVSS: 7.0
Asset: 203.0.113.20:2022 (corporate edge)
Status: Open
Type: Network
MITRE: T1110 T1021
NIST: SC-13 AC-17
Description: An internet-facing OpenSSH service offers legacy key-exchange and MAC algorithms (diffie-hellman-group1-sha1, hmac-md5) and permits password authentication.
Impact: - Weak cryptography susceptible to downgrade attacks
- Password auth exposed to brute-force from the internet
Remediation: - Disable legacy kex/cipher/MAC algorithms
- Enforce key-based authentication; disable password auth
- Restrict SSH exposure to VPN/bastion
VULN-011
AGHG Email Accounts Present in Known Third-Party Data Breaches
High
CVSS: 7.5
Asset: acaciagrove.example, acaciagrovehotels.example, savannasuites.example, baobablodge.example
Status: Open
Type: Email Security
MITRE: T1589 T1078
NIST: IA-5 AC-2
Description: Open-source breach-aggregation lookups indicate several corporate mailboxes across the brand domains appear in historical third-party breach corpora. Specific breach names and any exposed secret material were NOT retrieved or stored during this assessment; only the fact of exposure at the domain lev...
Impact: - Reused passwords could enable account takeover of booking, VPN, or admin systems
- Targeted phishing against known-valid addresses
Remediation: - Force password resets for any potentially affected corporate accounts
- Enforce MFA everywhere; block password reuse via a breached-password check
- Deliver phishing-awareness training to staff
VULN-012
Cloudflare Origin IP Exposure (reports.savannasuites.example)
High
CVSS: 6.8
Asset: reports.savannasuites.example -> 198.51.100.77
Status: Open
Type: Network
MITRE: T1590 T1595
NIST: SC-7
Description: The true origin server IP (198.51.100.77) behind the Cloudflare-proxied reporting subdomain is discoverable via historical DNS and a mail subdomain, allowing attackers to bypass the WAF/DDoS protection.
Impact: - WAF and DDoS protections bypassed by hitting origin directly
- Direct exposure of application to volumetric and exploit traffic
Remediation: - Rotate the origin IP after locking it down
- Restrict origin firewall to Cloudflare IP ranges only
- Avoid leaking origin via non-proxied subdomains (mail, ftp)
VULN-013
Internal Web Application Stack Outdated (Apache/PHP/OpenSSL)
High
CVSS: 7.5
Asset: 192.168.77.63 (XAMPP), 192.168.77.36 (IIS)
Status: Open
Type: Web Application
MITRE: T1190
NIST: SI-2 CM-6
Description: Internal web hosts run end-of-life Apache/PHP/OpenSSL builds with multiple known CVEs in the deployed versions.
Impact: - Multiple known-CVE exploitation paths on internal services
- Foothold for lateral movement
Remediation: - Upgrade to supported Apache/PHP/OpenSSL releases
- Decommission XAMPP from production use
- Establish a patch-management cadence
VULN-014
Guest-Reachable Gateway Management Plane (SSH + DNS) on Network Edge
High
CVSS: 7.2
Asset: 192.168.81.1 (guest gateway management)
Status: Open
Type: Network Architecture
MITRE: T1046 T1133
NIST: AC-4 SC-7
Description: The guest Wi-Fi gateway exposes its SSH and DNS management services to guest clients, allowing reconnaissance and potential management-plane attacks from an untrusted segment.
Impact: - Management plane reachable from untrusted guests
- Reconnaissance and brute-force against network infrastructure
Remediation: - Restrict management interfaces to a dedicated management VLAN
- Deny guest-to-infrastructure traffic by default
- Enforce ACLs on the gateway
VULN-015
Pure-FTPd Anonymous Login Enabled on Port 21
High
CVSS: 7.0
Asset: 192.0.2.44:21 (savannasuites.example shared host)
Status: Resolved
Type: Network Service Exposure
MITRE: T1078 T1133
NIST: AC-3 IA-2
Description: The FTP service permits anonymous login. A directory listing was obtained; no files were uploaded or downloaded during testing.
Impact: - Unauthenticated access to the FTP root
- Potential file disclosure or upload of malicious content
Remediation: - Disable anonymous FTP
- Replace FTP with SFTP/FTPS and enforce authentication
- Restrict access by source IP
VULN-016
XML-RPC Enabled with Full Method Surface Exposed
High
CVSS: 6.9
Asset: acaciagrovehotels.example/xmlrpc.php
Status: Open
Type: Web Application
MITRE: T1110 T1190
NIST: AC-7
Description: The WordPress xmlrpc.php endpoint is enabled and exposes system.multicall, enabling amplified brute-force and potential pingback-based DDoS reflection.
Impact: - Amplified credential brute-force via multicall
- Pingback DDoS reflection abuse
Remediation: - Disable xmlrpc.php if unused
- Block at the WAF; disable pingback
- Restrict to required integrations only
VULN-017
Internet-Facing DNS Server (BIND 9.16.23)
Medium
CVSS: 5.3
Asset: 192.0.2.44 (port 53)
Status: Open
Type: Network
MITRE: T1590
NIST: SC-7
Description: An ISC BIND 9.16.23 DNS server is exposed on port 53/tcp. Internet-facing DNS can be abused for reconnaissance, zone-transfer attempts, and amplification if misconfigured.
Impact: - Information disclosure and reconnaissance vector
- DNS amplification abuse risk if recursion is open
Remediation: - Confirm recursion is disabled for external clients
- Restrict AXFR to authorized secondaries
- Keep BIND patched
VULN-018
Missing Security Headers (CSP, X-Frame-Options, HSTS)
Medium
CVSS: 5.4
Asset: www.acaciagrovehotels.example
Status: Open
Type: Web Application
MITRE: T1189
NIST: SC-8
Description: The booking site omits Content-Security-Policy, X-Frame-Options, and HTTP Strict-Transport-Security response headers.
Impact: - Clickjacking and injected-content risk
- SSL-stripping exposure without HSTS
Remediation: - Add CSP, X-Frame-Options: SAMEORIGIN (or frame-ancestors), and HSTS
- Add X-Content-Type-Options and Referrer-Policy
VULN-019
WordPress and Plugin Versions Fingerprinted
Medium
CVSS: 5.0
Asset: acaciagrovehotels.example
Status: Mitigated
Type: Web Application
MITRE: T1592
NIST: CM-6
Description: Core WordPress and plugin versions (Elementor, WooCommerce, Download Manager) are disclosed in HTML source and asset query strings, aiding version-specific exploitation.
Impact: - Attackers can target known CVEs matching disclosed versions
Remediation: - Suppress version query strings and generator meta
- Keep core and plugins updated
- Remove readme.html/license.txt
VULN-020
WooCommerce Log Directories Disclosed in robots.txt
Medium
CVSS: 5.3
Asset: acaciagrovehotels.example/robots.txt
Status: Resolved
Type: Web Application
MITRE: T1592
NIST: CM-6
Description: robots.txt discloses paths to WooCommerce log directories which may contain order-processing diagnostics.
Impact: - Path disclosure aiding targeted retrieval of log data
Remediation: - Move logs outside the web root
- Deny direct access to log directories
- Avoid disclosing sensitive paths in robots.txt
VULN-021
Outdated IIS 8.5 on Internal Windows Server
Medium
CVSS: 5.3
Asset: 192.168.78.18 / internal IIS server
Status: Open
Type: Web Application
MITRE: T1190
NIST: SI-2
Description: An internal application server runs IIS 8.5 on an out-of-support Windows Server build.
Impact: - Known-CVE exposure on an unsupported platform
Remediation: - Migrate to a supported Windows Server / IIS release
- Apply current patches
VULN-022
Internal Wireless Networks Use WPA2-PSK Only — No WPA3 / 802.1X / PMF
Medium
CVSS: 5.3
Asset: Wi-Fi SSIDs AGHG-Staff, AGHG-IT, Towers-Guest
Status: Open
Type: Wireless
MITRE: T1040
NIST: SC-8 IA-2
Description: Internal wireless relies on WPA2-PSK with a shared passphrase and no 802.1X, WPA3, or Protected Management Frames, enabling handshake capture and deauthentication attacks.
Impact: - Offline passphrase cracking of the shared key
- Deauth-driven denial of service
Remediation: - Migrate to WPA3-Enterprise (802.1X) or at minimum enable PMF
- Move to per-user credentials over a shared PSK
- Rotate PSKs and segment SSIDs
VULN-023
Self-Signed TLS Certificate with Excessive Validity on IoT Controller
Medium
CVSS: 4.8
Asset: 192.168.80.7 (energy IoT controller)
Status: Open
Type: Network / IoT
Description: The IoT controller presents a self-signed TLS certificate with a multi-decade validity period and a mismatched common name.
Impact: - Trust-on-first-use weakness enabling MITM
- No revocation path
Remediation: - Issue certificates from an internal CA with sane lifetimes
- Correct the certificate CN/SAN
- Automate renewal
VULN-024
Shared Mail Hosting Across Brand Domains
Medium
CVSS: 5.0
Asset: mail.acaciagrovehotels.example, mail.savannasuites.example
Status: Open
Type: DNS / Email
MITRE: T1590
NIST: SC-7
Description: Multiple brand domains share a single mail host, so a compromise of one domain's mail impacts all co-hosted brands.
Impact: - Blast radius: one mail compromise affects all brands
- Cross-brand spoofing and interception
Remediation: - Segregate mail per brand or enforce strict per-domain auth
- Apply DKIM/DMARC per domain (see VULN-008)
VULN-025
TLS Certificate Expiring Within 30 Days
Medium
CVSS: 4.0
Asset: www.acaciagrovehotels.example
Status: Resolved
Type: Web Application
NIST: SC-12
Description: The production TLS certificate for the booking site expires within 30 days with no evidence of automated renewal.
Impact: - Imminent outage / browser trust errors on expiry
- Guest bookings interrupted
Remediation: - Enable automated certificate renewal (ACME)
- Add expiry monitoring/alerting
VULN-026
Exim SMTP Service Exposed on Multiple Ports
Medium
CVSS: 5.3
Asset: mail.savannasuites.example (25, 465, 587)
Status: Open
Type: Network
MITRE: T1590
NIST: SC-7
Description: An Exim SMTP service advertises its version across multiple listener ports, aiding version-specific targeting.
Impact: - Version disclosure narrows exploit selection
Remediation: - Suppress version banners
- Keep Exim patched
- Restrict submission ports appropriately
VULN-027
Hosting Control Panel Exposed on Public Subdomain
Medium
CVSS: 5.3
Asset: panel.acaciagrovehotels.example
Status: Open
Type: Web Application
MITRE: T1190
NIST: AC-3
Description: A hosting control panel login is publicly reachable, presenting a credential-attack target.
Impact: - Brute-force target; compromise yields hosting control
Remediation: - Restrict by IP allowlist/VPN
- Enforce MFA
- Relocate default endpoint
VULN-028
Other Guest Peers Expose Windows RPC and UPnP Services
Medium
CVSS: 5.0
Asset: Guest Wi-Fi VLAN 192.168.80.0/24
Status: Open
Type: Wireless
MITRE: T1046 T1040
NIST: SC-7 AC-4
Description: Guest devices on the shared guest subnet expose Windows RPC and UPnP services to peer guests due to a lack of client isolation.
Impact: - Guest-to-guest attacks and data exposure
- Reconnaissance within the guest segment
Remediation: - Enable client (peer) isolation on guest SSIDs
- Block guest-to-guest traffic at the controller
VULN-029
DNSSEC Unsigned Across All Domains
Medium
CVSS: 4.3
Asset: acaciagrove.example, acaciagrovehotels.example, savannasuites.example, baobablodge.example
Status: Open
Type: DNS / Email
MITRE: T1565
NIST: SC-20 SC-21
Description: None of the brand domains are DNSSEC-signed, leaving DNS responses unauthenticated and open to spoofing/cache-poisoning.
Impact: - DNS spoofing / cache poisoning risk
- Traffic redirection to attacker infrastructure
Remediation: - Enable DNSSEC signing and publish DS records at the registrar
- Monitor for validation failures
VULN-030
Email Addresses Disclosed in Website Source
Low
CVSS: 3.7
Asset: baobablodge.example
Status: Open
Type: Web Application
MITRE: T1589
NIST: SC-7
Description: Reservation email addresses ([email protected], [email protected]) are disclosed in the public HTML source, aiding targeted phishing and spam.
Impact: - Facilitates targeted phishing and spam
- Enumerates valid mailboxes
Remediation: - Use contact forms instead of raw addresses
- Obfuscate or load addresses via JS
- Staff phishing-awareness training
VULN-031
WordPress readme.html and license.txt Exposed
Low
CVSS: 3.1
Asset: acaciagrovehotels.example/readme.html
Status: Resolved
Type: Web Application
MITRE: T1592
NIST: CM-6
Description: Default WordPress readme.html and license.txt files are accessible, disclosing the core version.
Impact: - Version disclosure aids targeted exploitation
Remediation: - Remove or deny access to readme.html and license.txt
VULN-032
Missing robots.txt, sitemap.xml, and security.txt (RFC 9116)
Low
CVSS: 2.0
Asset: savannasuites.example
Status: Open
Type: Web Application
NIST: IR-6
Description: The site does not publish /.well-known/security.txt, so there is no standardized channel for responsible vulnerability disclosure.
Impact: - No standardized security-contact channel
Remediation: - Publish /.well-known/security.txt per RFC 9116 with a monitored contact
VULN-033
Missing X-Content-Type-Options and Referrer-Policy Headers
Low
CVSS: 3.1
Asset: www.baobablodge.example
Status: Open
Type: Web Application
MITRE: T1189
Description: The lodge site omits X-Content-Type-Options: nosniff and Referrer-Policy headers.
Impact: - MIME-sniffing and referrer-leakage risk (low impact)
Remediation: - Add X-Content-Type-Options: nosniff and a strict Referrer-Policy
VULN-034
Verbose Server Version Banner on Reverse Proxy
Low
CVSS: 2.6
Asset: www.acaciagrovehotels.example
Status: Open
Type: Web Application
MITRE: T1592
NIST: CM-6
Description: The reverse proxy returns a detailed Server header disclosing product and version.
Impact: - Minor information disclosure aiding fingerprinting
Remediation: - Suppress or genericize the Server header
VULN-035
Internal Management VLAN Default-Deny Posture Confirmed
Info
CVSS: 0.0
Asset: 192.168.79.9-11, AGHG-DC-01/02/03
Status: Open
Type: Network
MITRE: T1046
Description: Positive finding: the internal management VLAN correctly enforces a default-deny posture from the user segments during testing. Recorded for completeness.
Impact: - No negative impact; documents an effective control
Remediation: - Maintain the default-deny posture and review ACLs periodically
VULN-036
Guest Wi-Fi Subnet High Device Density and Deferred Probing
Info
CVSS: 0.0
Asset: Guest Wi-Fi VLAN 192.168.80.0/24
Status: Open
Type: Wireless
MITRE: T1040
Description: The guest subnet showed high device density; deeper probing was deferred to avoid impacting guests. Recorded for scoping of a future engagement.
Impact: - No direct impact; scoping note
Remediation: - Schedule an off-peak window for deeper guest-network assessment
Framework Mappings
MITRE ATT&CK Coverage
16 techniques mapped across 14 tactics.
NIST SP 800-53 Coverage
18 controls affected across 6 families.
CIS Benchmark Coverage
11 benchmarks affected across 5 categories.
Report generated by VAPT Dashboard on 2026-07-13 14:25:53
Document Control
Version History
| Version | Date | Author | Changes |
|---|---|---|---|
| 0.1 | 2026-07-11 | Lead Tester | Initial draft for review |
| 0.2 | 2026-07-11 | QA Reviewer | QA review and edits |
| 1.0 | 2026-07-13 | Lead Tester | Final version for client delivery |
Assessment Team
| Role | Name | Certifications | |
|---|---|---|---|
| Lead Penetration Tester | AIMI Assessment Team | OSCP, OSWE, CREST | [email protected] |
| QA Reviewer | AIMI QA | CISSP, CISM | [email protected] |
| Client Contact | Grace Mutasa — AGHG (fictional) | — | [email protected] |
Legal Disclaimer
IMPORTANT NOTICE: This report contains confidential and proprietary information intended solely for Acacia Grove Hospitality Group. This document may not be reproduced, distributed, or disclosed to any third party without prior written consent.
Point-in-Time Assessment: This assessment represents the security posture of the tested systems at the specific point in time the testing was conducted. Systems, configurations, and threat landscapes change over time. Regular assessments are recommended to maintain an accurate understanding of security posture.
Scope Limitations: Testing was limited to the systems, applications, and networks explicitly defined in the scope section. Any systems not included in the scope were not assessed. The absence of findings does not guarantee the absence of vulnerabilities.
Legal Authorization: This assessment was conducted with explicit written authorization from Grace Mutasa — AGHG (fictional) of Acacia Grove Hospitality Group.
Appendix A: Severity & Risk Definitions
| Severity | CVSS Range | Definition | Response Time |
|---|---|---|---|
| Critical | 9.0 - 10.0 | Exploitation causes complete compromise with minimal effort | 24 hours |
| High | 7.0 - 8.9 | Significant impact with moderate exploitation difficulty | 7 days |
| Medium | 4.0 - 6.9 | Moderate risk with specific conditions required for exploitation | 30 days |
| Low | 0.1 - 3.9 | Limited impact or difficult exploitation conditions | 90 days |
| Info | 0.0 | Informational observation, no direct security risk | Best effort |
Appendix B: Risk Scoring Methodology
Findings are scored using the CVSS v3.1 scoring system (0-10 scale). The overall risk is derived from a weighted composite of all findings, accounting for severity, volume, and business context. The OWASP Risk Rating Methodology is used for qualitative assessment of threat agent factors, vulnerability factors, technical impact, and business impact. Risk = Likelihood x Impact, where likelihood considers skill level, motive, opportunity, ease of discovery, ease of exploit, awareness, and intrusion detection. Impact considers confidentiality, integrity, availability, accountability, financial damage, reputation damage, non-compliance, and privacy violation.
Appendix C: Glossary
| Term | Definition |
|---|---|
| CVSS | Common Vulnerability Scoring System - standardized scoring for vulnerabilities (0-10) |
| CWE | Common Weakness Enumeration - classification of software weakness types |
| CVE | Common Vulnerabilities and Exposures - publicly known security vulnerabilities |
| MITRE ATT&CK | Knowledge base of adversary tactics and techniques based on real-world observations |
| NIST SP 800-53 | Security and Privacy Controls for Information Systems and Organizations |
| OWASP | Open Web Application Security Project - community-driven application security resources |
| PCI DSS | Payment Card Industry Data Security Standard |
| CSF 2.0 | NIST Cybersecurity Framework 2.0 - framework for improving critical infrastructure cybersecurity |
| PoC | Proof of Concept - demonstration that a vulnerability can be exploited |
| MTTD | Mean Time to Detect - average time to identify a security event |
| MTTR | Mean Time to Respond - average time to respond to a security event |
| XSS | Cross-Site Scripting - injection attack that executes scripts in user's browser |
| SQLi | SQL Injection - injection attack that manipulates database queries |
| SSTI | Server-Side Template Injection - injection attack on template engines |
| IDOR | Insecure Direct Object Reference - access control vulnerability allowing unauthorized access |
Letter of Attestation
PENETRATION TESTING LETTER OF ATTESTATION
To whom it may concern,
This letter confirms that VAPT Assessment Team performed a comprehensive penetration test for Acacia Grove Hospitality Group.
Client: Acacia Grove Hospitality Group
Assessment Name: External + Internal VAPT — Acacia Grove Hospitality Group
Target Scope: acaciagrove.example, acaciagrovehotels.example, savannasuites.example, baobablodge.example + on-site networks
Date Performed: 2026-06-10 to 2026-07-11
Methodology: PTES + OWASP WSTG + NIST SP 800-115 (continuous, HITL-gated)
Total Findings: 36
Critical: 5
High: 11
Medium: 13
Low: 5
Info: 2
Overall Risk Level: Critical
This assessment was conducted in accordance with industry-accepted penetration testing methodologies and standards.
_________________________________
Lead Penetration Tester
Date: 2026-07-13
_________________________________
QA Reviewer
Date: 2026-07-13