Standard · your domain · Weekly · Thu 8 Oct, 02:00 · 21m 20s
16 names · 8 live · 11 issues · complete · 1 new since Thu 1 Oct
New since Thu 1 Oct, 02:00
Error pages show environment values and file paths to anyone who causes an error.
How far it reached
From every name we could find for tessellate.ng to the ones that need you
Point at a step to see its hosts.
Everything out there under your name
16 names · 8 answer on the web · in the engine's order: live, then worst
Where your hosts answer from
4 in 2 places on the map · 4 behind edge networks · 1 on platforms
On the map
No one place
Behind an edge network the nearest of its data centres answers; on a platform we only know its address. Neither has one place to draw.
What follows from it
Countries
Cloud and edge
Platforms
What to fix first
11 issues, ranked by proof, then exploitation in the wild, then severity · changes since Thu 1 Oct
Exploit code is public · 1
Everything else, worst first · 10
Does each page tell the browser how to protect it?
7 pages read · 2 send all six
| Host | HSTS3 without | CSP3 without | Framingall | No-sniff1 without | Referrerall | Permissionsall |
|---|---|---|---|---|---|---|
Cookies
laravel_session is set without Secure1 host needs a look
Only problems are reported · 7 of 8 live hosts clean
TLSv1 and TLSv1.1 still accepted
Medium · 1 host
Turn off TLS 1.0 and 1.1; offer TLS 1.2 and 1.3 only.
Can someone send email as tessellate.ng?
Seven checks on tessellate.ng · 3 need a look
Yes, quite easily
There's no DMARC record, so nothing tells receivers what to do with mail pretending to be from tessellate.ng.
MX
Where your mail goes
1 MX record(s)
10 mx.zoho.com
SPF
Who may send as you
SPF ends in ?all: anyone may send, and receivers are told nothing
v=spf1 include:zoho.com ?all
DMARC
What receivers do with fakes
No DMARC record: nothing tells receivers what to do with mail that fails
DKIM
Signatures on your mail
No DKIM selector found among 40 common ones
CAA
Who may issue your certificates
CAA allows letsencrypt.org, sectigo.com
0 issue "letsencrypt.org"
DNSSEC
Answers can't be forged
DNSSEC is not enabled
Zone transfer
Your whole zone can't be copied
Zone transfer refused by all 2 nameservers
Read from tessellate.ng itself · subdomains share these records
3 open ports shouldn't face the internet
8 open on 4 hosts · common TCP ports on every origin
3306 · A database answering the internet directly
8443 · Usually an admin or management interface
22 · Remote shell open to anyone: one weak key or password away from a server
tessellate.ngpos.tessellate.ngapp.tessellate.ngwww.tessellate.ng
1 of 10 technologies run a version with a known CVE
4 with their version on show · attackers read these too
Known CVEs
CDN
JavaScript frameworks
Page builders
Programming languages
Web frameworks
Web servers
Not around the firewall, but 1 endpoint has no rate limit
8 live hosts checked · firewalls, rate limits and origin leaks
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
Answering directly
Nothing left lying about
Exposed files, credentials in public code, takeovers and storage
No exposed files, no credentials in public code, no names anyone could take over
No credentials in any public JavaScript or file we readCloud storage
48 bucket names like yours tried across AWS, Google Cloud and Azure · 0 exist · all locked
What can be reached, and how
Crawled pages, API routes, forms and specs
No routes found on hosts we could crawl. Hosts behind a CDN are skipped.
Did it see everything?
19 stages · 21m 20s
So it can close anything it stops seeing. This time, nothing it had seen before was gone.
Ports weren’t scanned on 4 hosts behind a CDN, on purpose: the edge would answer, not your server.
Vulnerability templates
88%of requests completed
77,616 of 88,200 requests · 6,683 templates · 2,210 errors · below half, a clean result doesn’t count
Subdomains
Certificate logs and passive DNS datasets
33s · 16
DNS records
A, AAAA and CNAME for every name found
4s · 9
Live hosts
Which names answer on the web
9s · 8
Technologies
Frameworks, servers and versions
31s · 14
TLS
Certificates, protocols and ciphers
3s · 1
Security headers
HSTS, CSP, framing and cookies
4s · 8
DNS and email
SPF, DMARC, DKIM, CAA, DNSSEC, zone transfer
13s · 7
Takeovers
Names pointing at services no one owns
16s · 0
WAF and rate limits
Firewalls, rate limiting and origin leaks
46s · 5
Known CVEs (OSV)
Detected versions against open-source advisories
5s · 1
Known CVEs (NVD)
Detected versions against NIST's database and CISA's exploited list
18s · 0
Open ports
Common TCP ports on every origin
6m 17s · 12
Secrets and files
Keys in JavaScript, exposed .git, .env and backups
2m 8s · 0
Routes
Crawled pages, API routes, forms and specs
1m 1s · 0
Cloud storage
Buckets named like you, and whether they're open
55s · 0
Vulnerability templates
Thousands of known flaws and misconfigurations
17m 21s · 1
Exploit intelligence
CVSS, EPSS and public exploits for each CVE
16s · 0
Services
What's listening on each open port
36s · 1
Proof
Firing each CVE's template to confirm it's exploitable
1m 46s · 0
Triage
Merging duplicates, ranking by real risk, explaining each
55s