Penetration Test Report

An external black-box penetration test was conducted against company-a.example.com on March 11, 2026. The site is a pre-launch React single-page application hosted on Amazon S3 + CloudFront with DNS on AWS Route 53 and email via Google Workspace.

The overall attack surface is minimal — no backend APIs, no user input fields, and no session management were found. The primary findings relate to missing HTTP security headers and absent email authentication records (SPF, DMARC, DKIM), both of which are configuration-level fixes requiring no code changes.

No critical vulnerabilities were identified. No sensitive data exposure was found.

No CSP header is returned by the server. Without CSP, the browser places no restrictions on where scripts, styles, or other resources can be loaded from. If any XSS vector is introduced in the future (e.g., via user-generated content, URL parameter processing, or third-party script compromise), it would be fully exploitable.

Affected URL: https://www.company-a.example.com

Although HTTP redirects to HTTPS (301), the absence of an HSTS header means first-time visitors or victims of SSL-stripping attacks (e.g., on public Wi-Fi) can be intercepted on the initial plaintext request before the redirect occurs.

Affected URL: All responses from www.company-a.example.com

No SPF (Sender Policy Framework) TXT record exists for company-a.example.com. This means any mail server in the world can send email pretending to be from @company-a.example.com without failing SPF checks. This enables phishing and email spoofing attacks impersonating Company A.

_dmarc.company-a.example.com returns NXDOMAIN. Without DMARC, receiving mail servers have no policy to verify that emails from @company-a.example.com are legitimate. Combined with the missing SPF, this makes email spoofing trivial.

The site can be embedded in an <iframe> on any domain. An attacker could overlay invisible UI elements on top of the framed page, tricking users into clicking unintended actions (clickjacking).

Without nosniff, browsers may MIME-sniff response content and interpret files differently than intended, potentially treating non-executable content as scripts.

The response header Server: AmazonS3 reveals the backend storage technology. While not directly exploitable, it helps attackers narrow down the technology stack for targeted attacks.

Headers x-amz-server-side-encryption: AES256, x-amz-cf-pop, and x-amz-cf-id expose internal infrastructure details including encryption type and CDN edge node.

No Referrer-Policy or Permissions-Policy headers are set. Referrer leakage can expose URL paths to third parties. Missing Permissions-Policy allows access to browser APIs (camera, mic, geolocation) by default.

Note: All paths return HTTP 200 with the SPA index.html shell due to the S3/CloudFront catch-all routing. No actual file content is exposed — every path renders the same React application.

• ✓
  No sensitive files exposed — .env, .git, package.json, .DS_Store all return SPA shell, not actual content
• ✓
  No hardcoded secrets — JS bundle contains no API keys, tokens, or credentials
• ✓
  Zero XSS attack surface — No forms, input fields, or URL parameter processing
• ✓
  HTTPS properly enforced — HTTP 301 redirects to HTTPS via CloudFront
• ✓
  TLS 1.3 — Strong transport encryption with valid AWS ACM certificate
• ✓
  S3 encryption at rest — AES256 server-side encryption enabled
• ✓
  No backend API exposed — Pure static site with no server-side attack surface
• ✓
  No cookies set — No session hijacking risk
• ✓
  Minimal subdomain footprint — Only www resolves, reduces attack surface
• ✓
  No X-Powered-By header — Framework not disclosed

Step 1: CloudFront Response Headers Policy (fixes H1, H2, M3, M4, L1, L2, L3)

Create a single CloudFront Response Headers Policy in the AWS Console or via IaC. Attach it to the distribution. This fixes 7 of 9 findings with zero code changes.

Step 2: DNS Records in Route 53 (fixes M1, M2)

Step 3: Upload Static Files to S3 (fixes I1, I2)

Upload these as separate S3 objects so the SPA catch-all doesn't override them: