Standard · your domain · Kelvin, after this morning's release · Today, 10:19
31 names · 21 live · 17 issues
Running · phase 5 of 7 · about 9 minutes to go
Now: Thousands of known flaws and misconfigurations. Every section below fills as its stage gets there.
Finding subdomainsDiscover
31 found
Resolving themResolve
24 resolve
Finding live hostsProbe
21 live
FingerprintingFingerprint
45 technologies
Testing live hostsTest
55% of requests
Proving what's exploitableProve
waiting
Sorting what it foundTriage
waiting
How far it reached
From every name we could find for tessellatepay.com to the ones that need you
Point at a step to see its hosts.
Everything out there under your name
31 names · 21 answer on the web · in the engine's order: live, then worst
Where your hosts answer from
7 in 4 places on the map · 9 behind edge networks · 8 on platforms
On the map
No one place
Behind an edge network the nearest of its data centres answers; on a platform we only know its address. Neither has one place to draw.
What follows from it
Countries
Cloud and edge
Platforms
What to fix first
17 issues, ranked by proof, then exploitation in the wild, then severity · changes since Mon 12 Oct · more may land
Being exploited in the wild · 1
Exploit code is public · 2
Everything else, worst first · 14
Does each page tell the browser how to protect it?
19 pages read · 7 send all six · still reading
| Host | HSTS4 without | CSP8 without | Framing2 without | No-sniff1 without | Referrerall | Permissions2 without |
|---|---|---|---|---|---|---|
1 host needs a look
Only problems are reported · 20 of 21 live hosts clean
Certificate expiring
Medium · 1 host
12 of 30 days left · valid to 30 Oct 2026 · Sectigo RSA Domain Validation Secure Server CA
Can someone send email as tessellatepay.com?
Seven checks on tessellatepay.com · 2 need a look
Not easily
SPF lists only your senders and DMARC tells receivers to quarantine anything else.
MX
Where your mail goes
2 MX record(s)
0 tessellatepay-com.mail.protection.outlook.com
SPF
Who may send as you
SPF ends in -all: only listed senders may send
v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all
DMARC
What receivers do with fakes
DMARC policy is p=quarantine
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@tessellatepay.com
DKIM
Signatures on your mail
DKIM selector selector1 found
v=DKIM1; k=rsa; p=MIIBIjANBgkqh…
CAA
Who may issue your certificates
No CAA record: any certificate authority may issue for this domain
DNSSEC
Answers can't be forged
DNSSEC is not enabled
Zone transfer
Your whole zone can't be copied
Zone transfer refused by all 2 nameservers
Read from tessellatepay.com itself · subdomains share these records
5 open ports shouldn't face the internet
14 open on 7 hosts · common TCP ports on every origin
22 · Remote shell open to anyone: one weak key or password away from a server
10443 · Firewall or VPN management, often reachable by mistake
22 · Remote shell open to anyone: one weak key or password away from a server
3000 · Common for dashboards and dev servers (Grafana, Node)
8080 · Usually a dev or admin server that wasn't meant to be public
tessellatepay.comapp.tessellatepay.comauth.tessellatepay.commerchants.tessellatepay.compartners.tessellatepay.compay.tessellatepay.comassets.tessellatepay.comcards.tessellatepay.comwww.tessellatepay.com
3 of 25 technologies run a version with a known CVE
13 with their version on show · attackers read these too
Known CVEs
Authentication
CDN
CMS
Documentation
Firewalls
Issue trackers
JavaScript frameworks
Live chat
Load balancers
Monitoring
PaaS
Programming languages
Recruitment
Tag managers
Web frameworks
Web servers
Yes, on one host: the origin's address is public
21 live hosts checked · firewalls, rate limits and origin leaks
sits behind Cloudflare, but its server answers at 18.133.42.7, found in public certificate logs. Requests sent straight there skip the firewall and its rate limits.
Seen in crt.sh:app.tessellatepay.com
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
Answering directly
2 things anyone can pick up
Exposed files, credentials in public code, takeovers and storage
Subdomain can be taken over
High
CNAME → tessellate-legacy.herokuapp.com · Heroku says “No such app”
old.tessellatepay.com points at tessellate-legacy.herokuapp.com, which no longer exists. Anyone can create an app with that name and serve pages on your domain.
.env file open to anyone
High
https://staging.tessellatepay.com/.env · HTTP 200
Environment file is downloadable: it usually holds database and API credentials.
APP_ENV=staging APP_DEBUG=true DATABASE_URL=•••••••• PAYSTACK_SECRET_KEY=••••••••
Cloud storage
62 bucket names like yours tried across AWS, Google Cloud and Azure · 2 exist · all locked
gcp · tessellatepay-backups · locked (HTTP 403)
aws · tessellatepay-assets · locked (HTTP 403)
What can be reached, and how
1186 pages crawled · 276 API routes · 3 forms · 1 spec
An OpenAPI spec is public, describing 64 routes
https://api.tessellatepay.com/openapi.json
It’s a map of your API for anyone. Fine if it’s meant to be, worth closing if not.
| Method | Route | Params | Found by | Status |
|---|---|---|---|---|
| POST | app.tessellatepay.com/api/auth/login | email, password | XHR | 401 |
| GET | app.tessellatepay.com/api/auth/session | · | XHR | 200 |
| GET | app.tessellatepay.com/api/transactions | from, to, status, cursor | XHR | 401 |
| POST | app.tessellatepay.com/api/payouts | amount, currency, beneficiaryId | JavaScript | 401 |
| GET | app.tessellatepay.com/api/beneficiaries | · | JavaScript | 401 |
| GET | app.tessellatepay.com/api/exports/csv | range | JavaScript | 401 |
| GET | app.tessellatepay.com/sign-in | next | Crawl | 200 |
| GET | app.tessellatepay.com/forgot-password | · | Crawl | 200 |
| POST | app.tessellatepay.com/api/webhooks/test | url | Archives | 404 |
| GET | app.tessellatepay.com/_next/data/build/dashboard.json | · | Crawl | 200 |
| POST | api.tessellatepay.com/v1/charges | amount, currency, customer, metadata | API spec | · |
| GET | api.tessellatepay.com/v1/charges/{id} | id | API spec | · |
| POST | api.tessellatepay.com/v1/refunds | charge, amount | API spec | · |
| POST | api.tessellatepay.com/v1/transfers | amount, bank_code, account_number | API spec | · |
| GET | api.tessellatepay.com/v1/customers | email, limit | API spec | · |
| PUT | api.tessellatepay.com/v1/webhooks | url, events | API spec | · |
| POST | api.tessellatepay.com/v1/bvn/verify | bvn, first_name, last_name | API spec | · |
| GET | api.tessellatepay.com/internal/health | · | Archives | 200 |
Forms
Did it see everything?
18 stages · 11m 0s so far
It can close findings once it finishes, if every stage completes and the templates get most of their requests through.
Ports weren’t scanned on 9 hosts behind a CDN, on purpose: the edge would answer, not your server.
Vulnerability templates
55%of requests completed
52,742 of 96,400 requests · 6,683 templates · 1,240 errors · below half, a clean result doesn’t count
Subdomains
Certificate logs and passive DNS datasets
31s · 31
DNS records
A, AAAA and CNAME for every name found
4s · 24
Live hosts
Which names answer on the web
8s · 21
Technologies
Frameworks, servers and versions
29s · 45
TLS
Certificates, protocols and ciphers
3s · 1
Security headers
HSTS, CSP, framing and cookies
4s · 18
DNS and email
SPF, DMARC, DKIM, CAA, DNSSEC, zone transfer
12s · 7
Takeovers
Names pointing at services no one owns
15s · 1
WAF and rate limits
Firewalls, rate limiting and origin leaks
43s · 12
Known CVEs (OSV)
Detected versions against open-source advisories
5s · 2
Known CVEs (NVD)
Detected versions against NIST's database and CISA's exploited list
17s · 1
Open ports
Common TCP ports on every origin
5m 54s · 23
Secrets and files
Keys in JavaScript, exposed .git, .env and backups
2m 0s · 1
Routes
Crawled pages, API routes, forms and specs
57s · 0
Cloud storage
Buckets named like you, and whether they're open
52s · 2
Vulnerability templates
Thousands of known flaws and misconfigurations
running
Exploit intelligence
CVSS, EPSS and public exploits for each CVE
15s · 0
Services
What's listening on each open port
34s · 3
Proof
Firing each CVE's template to confirm it's exploitable
waiting
Triage
Merging duplicates, ranking by real risk, explaining each
waiting