External attack surface

External Attack Surface — Lab Sample

Lab-owned domains and a disposable VPS configured as a small SaaS perimeter (staging-like). No third-party production assets.

2026-08-26 · Public lab sample · no client data

Executive Summary · Scope · Methodology · Risk Rating · Findings · Evidence · Impact · Remediation · Retest

Executive Summary

The review mapped subdomains, listening services, TLS configuration, and technology fingerprints for a lab SaaS-style perimeter. Notable issues: an forgotten staging host with default credentials disabled but debug endpoints still reachable, outdated TLS on a mail-related name, and a development subdomain returning stack traces. This is the entry-offer report shape: inventory first, then ranked exposure — not a full pentest.

Scope

In scope: lab.artofvector.dev and listed subdomains, TCP/UDP services observed from the internet, TLS on 443, and HTTP(S) technology fingerprinting. Out of scope: authenticated application testing, cloud console review, and social engineering. Window: 26 August 2026.

Methodology

Passive OSINT (certificate transparency, public DNS) then active enumeration of names in scope. Port and service identification without exploit payloads. TLS checked against current baseline (deprecated protocols, weak ciphers). HTTP responses reviewed for debug banners and default pages. No attempt to chain into application-layer exploits on this engagement type.

Risk Rating

Exposure is ranked by attacker usefulness: unexpected hosts, weak transport, information leaks, then hygiene. Full CVSS is applied only where a concrete vulnerability class is confirmed; otherwise Informational/Low for inventory items.

Findings

Evidence, impact, and remediation sit under each finding — the same order used in client PDFs.

EXT-01MediumCVSS 5.3

Staging host reachable on the public internet

Evidence: DNS and certificate logs listed staging.<lab-domain>. The host answered HTTPS with a development banner and an unauthenticated health/debug path. No production customer data on this lab box; the pattern is the finding.
Impact: Staging often runs weaker auth and verbose errors. If copied to a real SaaS, this is a common path into pre-release code and extra attack surface.
Remediation: Remove public DNS, restrict by VPN or IP allow-list, or require SSO. Disable debug routes outside local development. Retest by confirming the name no longer resolves publicly.

EXT-02LowCVSS 3.7

TLS configuration below current baseline on a secondary name

Evidence: A secondary hostname still offered a deprecated protocol version and a weak cipher suite in the handshake. Primary www name was correctly configured. Handshake traces stored in lab notes; cipher names listed in the private appendix, not here.
Impact: Weaker transport on any live name undermines the rest of the perimeter and fails many enterprise questionnaires that scan all SAN names.
Remediation: Align all certificates and listeners to the same TLS policy. Disable legacy protocols. Recheck with a scanner after the load-balancer change.

EXT-03LowCVSS 3.1

Development subdomain leaks framework and version

Evidence: dev.<lab-domain> returned default error pages including framework name and version in HTML comments and headers. Fingerprinting matched a known major version.
Impact: Speeds targeting of known issues for that stack. Combined with EXT-01, it tells an attacker where to look first.
Remediation: Generic error pages, strip version headers, take unused names offline. Retest headers and 404/500 bodies.

Retest

Entry-offer retest is a short follow-up: confirm staging is gone from public DNS, TLS matches policy, and version leaks are gone. Application-layer testing is a separate Web & API pentest.

Engage

Put your controls under test.

Client reports use this structure with your hosts and evidence under NDA. Public samples omit payloads and live targets.