Standard · your domain · Weekly · Thu 15 Oct, 02:00 · 19m 22s
16 names · 8 live · 10 issues · partial · 1 not rechecked
Partial · 41% coverage
Cloudflare throttled our requests, so only 41% of the vulnerability templates' requests completed, and the secrets stage timed out on agents.tessellate.ng.
How far it reached
From every name we could find for tessellate.ng to the ones that need you
Point at a step to see its hosts.
Everything out there under your name
16 names · 8 answer on the web · in the engine's order: live, then worst
Where your hosts answer from
4 in 2 places on the map · 4 behind edge networks · 1 on platforms
On the map
No one place
Behind an edge network the nearest of its data centres answers; on a platform we only know its address. Neither has one place to draw.
What follows from it
Countries
Cloud and edge
Platforms
What to fix first
10 issues, ranked by proof, then exploitation in the wild, then severity · changes since Thu 8 Oct
Exploit code is public · 1
Everything else, worst first · 9
Does each page tell the browser how to protect it?
7 pages read · 3 send all six
| Host | HSTS2 without | CSP3 without | Framingall | No-sniff1 without | Referrerall | Permissionsall |
|---|---|---|---|---|---|---|
Cookies
laravel_session is set without Secure1 host needs a look
Only problems are reported · 7 of 8 live hosts clean
TLSv1 and TLSv1.1 still accepted
Medium · 1 host
Turn off TLS 1.0 and 1.1; offer TLS 1.2 and 1.3 only.
Can someone send email as tessellate.ng?
Seven checks on tessellate.ng · 3 need a look
Yes, quite easily
There's no DMARC record, so nothing tells receivers what to do with mail pretending to be from tessellate.ng.
MX
Where your mail goes
1 MX record(s)
10 mx.zoho.com
SPF
Who may send as you
SPF ends in ?all: anyone may send, and receivers are told nothing
v=spf1 include:zoho.com ?all
DMARC
What receivers do with fakes
No DMARC record: nothing tells receivers what to do with mail that fails
DKIM
Signatures on your mail
No DKIM selector found among 40 common ones
CAA
Who may issue your certificates
CAA allows letsencrypt.org, sectigo.com
0 issue "letsencrypt.org"
DNSSEC
Answers can't be forged
DNSSEC is not enabled
Zone transfer
Your whole zone can't be copied
Zone transfer refused by all 2 nameservers
Read from tessellate.ng itself · subdomains share these records
3 open ports shouldn't face the internet
8 open on 4 hosts · common TCP ports on every origin
3306 · A database answering the internet directly
8443 · Usually an admin or management interface
22 · Remote shell open to anyone: one weak key or password away from a server
tessellate.ngpos.tessellate.ngapp.tessellate.ngwww.tessellate.ng
1 of 10 technologies run a version with a known CVE
4 with their version on show · attackers read these too
Known CVEs
CDN
JavaScript frameworks
Page builders
Programming languages
Web frameworks
Web servers
Not around the firewall, but 1 endpoint has no rate limit
8 live hosts checked · firewalls, rate limits and origin leaks
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
Answering directly
Nothing left lying about
Exposed files, credentials in public code, takeovers and storage
No exposed files, no credentials in public code, no names anyone could take over
No credentials in any public JavaScript or file we readCloud storage
48 bucket names like yours tried across AWS, Google Cloud and Azure · 0 exist · all locked
What can be reached, and how
Crawled pages, API routes, forms and specs
No routes found on hosts we could crawl. Hosts behind a CDN are skipped.
Did it see everything?
19 stages · 19m 22s
So it closed nothing. Anything it didn't see stays open until a complete scan confirms it's gone.
Ports weren’t scanned on 4 hosts behind a CDN, on purpose: the edge would answer, not your server.
Vulnerability templates
41%of requests completed
36,162 of 88,200 requests · 6,683 templates · 18,604 errors · below half, a clean result doesn’t count
Subdomains
Certificate logs and passive DNS datasets
30s · 16
DNS records
A, AAAA and CNAME for every name found
4s · 9
Live hosts
Which names answer on the web
8s · 8
Technologies
Frameworks, servers and versions
28s · 14
TLS
Certificates, protocols and ciphers
3s · 1
Security headers
HSTS, CSP, framing and cookies
4s · 7
DNS and email
SPF, DMARC, DKIM, CAA, DNSSEC, zone transfer
12s · 7
Takeovers
Names pointing at services no one owns
15s · 0
WAF and rate limits
Firewalls, rate limiting and origin leaks
42s · 5
Known CVEs (OSV)
Detected versions against open-source advisories
5s · 1
Known CVEs (NVD)
Detected versions against NIST's database and CISA's exploited list
16s · 0
Open ports
Common TCP ports on every origin
5m 42s · 12
Secrets and files
Keys in JavaScript, exposed .git, .env and backups
timed out
Routes
Crawled pages, API routes, forms and specs
55s · 0
Cloud storage
Buckets named like you, and whether they're open
50s · 0
Vulnerability templates
Thousands of known flaws and misconfigurations
15m 45s · 0
Exploit intelligence
CVSS, EPSS and public exploits for each CVE
15s · 0
Services
What's listening on each open port
33s · 1
Proof
Firing each CVE's template to confirm it's exploitable
1m 37s · 0
Triage
Merging duplicates, ranking by real risk, explaining each
50s