Deep · your domain · Monthly, in its window · Thu 1 Oct, 01:00 · 59m 45s
30 names · 20 live · 17 issues, 1 proven exploitable · complete
CVE-2024-34351 · confirmed by our own template · api.tessellatepay.com
Proven on api.tessellatepay.com: our template made your server call out to us. An attacker can use the API server to reach internal services, including the AWS metadata endpoint that hands out credentials.
How far it reached
From every name we could find for tessellatepay.com to the ones that need you
Point at a step to see its hosts.
Everything out there under your name
30 names · 20 answer on the web · in the engine's order: live, then worst
Where your hosts answer from
6 in 3 places on the map · 9 behind edge networks · 7 on platforms
On the map
No one place
Behind an edge network the nearest of its data centres answers; on a platform we only know its address. Neither has one place to draw.
What follows from it
Countries
Cloud and edge
Platforms
What to fix first
17 issues, ranked by proof, then exploitation in the wild, then severity
Proven exploitable · 2
Exploit code is public · 1
Everything else, worst first · 14
Does each page tell the browser how to protect it?
18 pages read · 5 send all six
| Host | HSTS5 without | CSP9 without | Framing3 without | No-sniff1 without | Referrerall | Permissions2 without |
|---|---|---|---|---|---|---|
1 host needs a look
Only problems are reported · 19 of 20 live hosts clean
TLSv1 and TLSv1.1 still accepted
Medium · 1 host
Turn off TLS 1.0 and 1.1; offer TLS 1.2 and 1.3 only.
Can someone send email as tessellatepay.com?
Seven checks on tessellatepay.com · 3 need a look
Yes, quite easily
DMARC is set to report only (p=none), so mail pretending to be you is still delivered. You'd hear about it afterwards.
MX
Where your mail goes
2 MX record(s)
0 tessellatepay-com.mail.protection.outlook.com
SPF
Who may send as you
SPF ends in -all: only listed senders may send
v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all
DMARC
What receivers do with fakes
DMARC policy is p=none: failures are reported, never blocked
v=DMARC1; p=none; rua=mailto:dmarc@tessellatepay.com
DKIM
Signatures on your mail
DKIM selector selector1 found
v=DKIM1; k=rsa; p=MIIBIjANBgkqh…
CAA
Who may issue your certificates
No CAA record: any certificate authority may issue for this domain
DNSSEC
Answers can't be forged
DNSSEC is not enabled
Zone transfer
Your whole zone can't be copied
Zone transfer refused by all 2 nameservers
Read from tessellatepay.com itself · subdomains share these records
3 open ports shouldn't face the internet
11 open on 6 hosts · common TCP ports on every origin
3000 · Common for dashboards and dev servers (Grafana, Node)
22 · Remote shell open to anyone: one weak key or password away from a server
8080 · Usually a dev or admin server that wasn't meant to be public
tessellatepay.comapp.tessellatepay.commerchants.tessellatepay.comauth.tessellatepay.compartners.tessellatepay.compay.tessellatepay.comassets.tessellatepay.comcards.tessellatepay.comwww.tessellatepay.com
2 of 22 technologies run a version with a known CVE
11 with their version on show · attackers read these too
Known CVEs
Authentication
CDN
CMS
Documentation
Issue trackers
JavaScript frameworks
Live chat
Load balancers
Monitoring
PaaS
Programming languages
Recruitment
Tag managers
Web frameworks
Web servers
Yes, on one host: the origin's address is public
20 live hosts checked · firewalls, rate limits and origin leaks
sits behind Cloudflare, but its server answers at 18.133.42.7, found in public certificate logs. Requests sent straight there skip the firewall and its rate limits.
Seen in crt.sh:app.tessellatepay.com
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
Answering directly
1 thing anyone can pick up
Exposed files, credentials in public code, takeovers and storage
Source maps published
Low
https://app.tessellatepay.com/_next/static/chunks/main-3f9a1c.js.map · HTTP 200
JavaScript source map is public: the original source can be read.
{"version":3,"sources":["webpack://_N_E/./src/lib/auth.ts","webpack://_N_E/./src/lib/payments/Cloud storage
62 bucket names like yours tried across AWS, Google Cloud and Azure · 2 exist · all locked
gcp · tessellatepay-backups · locked (HTTP 403)
aws · tessellatepay-assets · locked (HTTP 403)
What can be reached, and how
1186 pages crawled · 276 API routes · 3 forms · 1 spec
An OpenAPI spec is public, describing 64 routes
https://api.tessellatepay.com/openapi.json
It’s a map of your API for anyone. Fine if it’s meant to be, worth closing if not.
| Method | Route | Params | Found by | Status |
|---|---|---|---|---|
| POST | app.tessellatepay.com/api/auth/login | email, password | XHR | 401 |
| GET | app.tessellatepay.com/api/auth/session | · | XHR | 200 |
| GET | app.tessellatepay.com/api/transactions | from, to, status, cursor | XHR | 401 |
| POST | app.tessellatepay.com/api/payouts | amount, currency, beneficiaryId | JavaScript | 401 |
| GET | app.tessellatepay.com/api/beneficiaries | · | JavaScript | 401 |
| GET | app.tessellatepay.com/api/exports/csv | range | JavaScript | 401 |
| GET | app.tessellatepay.com/sign-in | next | Crawl | 200 |
| GET | app.tessellatepay.com/forgot-password | · | Crawl | 200 |
| POST | app.tessellatepay.com/api/webhooks/test | url | Archives | 404 |
| GET | app.tessellatepay.com/_next/data/build/dashboard.json | · | Crawl | 200 |
| POST | api.tessellatepay.com/v1/charges | amount, currency, customer, metadata | API spec | · |
| GET | api.tessellatepay.com/v1/charges/{id} | id | API spec | · |
| POST | api.tessellatepay.com/v1/refunds | charge, amount | API spec | · |
| POST | api.tessellatepay.com/v1/transfers | amount, bank_code, account_number | API spec | · |
| GET | api.tessellatepay.com/v1/customers | email, limit | API spec | · |
| PUT | api.tessellatepay.com/v1/webhooks | url, events | API spec | · |
| POST | api.tessellatepay.com/v1/bvn/verify | bvn, first_name, last_name | API spec | · |
| GET | api.tessellatepay.com/internal/health | · | Archives | 200 |
Forms
Did it see everything?
24 stages · 59m 45s
So it can close anything it stops seeing. This time, nothing it had seen before was gone.
Ports weren’t scanned on 9 hosts behind a CDN, on purpose: the edge would answer, not your server.
Vulnerability templates
89%of requests completed
188,680 of 212,000 requests · 6,683 templates · 6,100 errors · below half, a clean result doesn’t count
Subdomains
Certificate logs and passive DNS datasets
27s · 30
DNS records
A, AAAA and CNAME for every name found
3s · 22
Live hosts
Which names answer on the web
7s · 20
Technologies
Frameworks, servers and versions
25s · 43
TLS
Certificates, protocols and ciphers
3s · 1
Security headers
HSTS, CSP, framing and cookies
3s · 21
DNS and email
SPF, DMARC, DKIM, CAA, DNSSEC, zone transfer
10s · 7
Takeovers
Names pointing at services no one owns
13s · 0
WAF and rate limits
Firewalls, rate limiting and origin leaks
37s · 12
Known CVEs (OSV)
Detected versions against open-source advisories
4s · 3
Known CVEs (NVD)
Detected versions against NIST's database and CISA's exploited list
15s · 0
Open ports
Common TCP ports on every origin
5m 7s · 20
Secrets and files
Keys in JavaScript, exposed .git, .env and backups
1m 44s · 1
Routes
Crawled pages, API routes, forms and specs
49s · 0
Cloud storage
Buckets named like you, and whether they're open
45s · 2
Vulnerability templates
Thousands of known flaws and misconfigurations
54m 23s · 1
Exploit intelligence
CVSS, EPSS and public exploits for each CVE
13s · 0
ZAP
Passive and active web application testing
38m 58s · 0
Content discovery
Admin panels, backups and debug pages
5m 12s · 0
Services
What's listening on each open port
29s · 3
Default passwords
Vendor default logins on panels found
52s · 0
Injection probes
SQL injection, SSTI, XSS and path traversal, with proof
36m 22s · 1
DAST templates
Fuzzing parameters on discovered routes
7m 48s · 0
Proof
Firing each CVE's template to confirm it's exploitable
2m 36s · 0
Triage
Merging duplicates, ranking by real risk, explaining each
1m 44s