Penetration Test Report
Company B Technologies Pvt Ltd — company-b.example.com — Full Assessment V2
An authorized 13-module penetration test was conducted against company-b.example.com on March 11, 2026. Company B is a cybersecurity company (100+ employees, Mumbai) running a WordPress site behind Cloudflare CDN/WAF + Wordfence.
Critical findings for a cybersecurity company:
• CSRF: Zero anti-CSRF nonces in any form. WP nonces are cached/static and not validated server-side. reCAPTCHA is the sole defense.
• WAF Bypass: Wordfence XSS filtering bypassed via ?s= parameter. No CSP as fallback.
• Origin IP Exposure: 3 subdomains bypass Cloudflare entirely, exposing origin servers.
• Email Spoofing: DMARC p=none + no DKIM = anyone can send as @company-b.example.com.
• Active CVE: Astra theme v4.12.3 has CVE-2026-3534 (Stored XSS). Patch available.
• DDoS: admin-ajax.php heartbeat (1.9s, no rate limit) and REST API (2.1MB/request) are unmitigated app-layer vectors.
• Data on Disk: wp-config.php backup files, debug.log, phpMyAdmin path all exist (403).
No critical (P0) vulnerabilities found. Score: 45/100.
| Component | Technology | Detail |
|---|---|---|
| CMS | WordPress 6.x | Astra 4.12.3, Elementor Pro 3.35.1, 13 plugins |
| CDN/WAF | Cloudflare | APO, HTTP/3, email obfuscation, NEL |
| App WAF | Wordfence 8.1.4 | Blocks login/admin/xmlrpc, partial XSS filtering |
| SSL | Google Trust Services | ECDSA P-256 wildcard, TLS 1.2/1.3 |
| Mimecast EU → M365 | SPF -all, DMARC p=none, no DKIM | |
| Monitoring | Elastic APM RUM | Config leaked in page source |
| Analytics | GA4, GTM, Zoho, Hotjar | 4 tracking platforms |
| Origin IPs | 10.0.2.1/19/20 | Exposed via subdomains + SPF |
Live Subdomains (12)
| Subdomain | Target | Service | Protected? |
|---|---|---|---|
www | Cloudflare | Main site | Yes |
kb | Cloudflare | Knowledge base | Yes |
rum | Cloudflare | Elastic APM | Yes |
collector | 10.0.2.1 | Data collector | No CDN |
fleet | 10.0.2.1 | Fleet mgmt | No CDN |
lms | 10.0.2.3 | LMS | No CDN |
ps | Vercel | Unknown | Vercel |
sop | Vercel | Unknown | Vercel |
uniview | Zoho Creator | Portal | Zoho |
univiewportal | Zoho Creator | Portal | Zoho |
autodiscover | M365 | Email config | M365 |
Dead Subdomains — Takeover Candidates (9)
blog, demo, falcondr, ironhash-new, nc, ncompass, o9solutions, sentientnx, uat-uniview
| Surface | Exposure | Protection | Risk |
|---|---|---|---|
| Main Website | WordPress + 13 plugins | Cloudflare + Wordfence | Medium |
| Origin Servers | 3 IPs exposed | None (CF bypassed) | High |
| Forms (4) | No CSRF nonces | reCAPTCHA only | High |
| WP REST API | 28 namespaces | User enum blocked | High |
| Email Domain | DMARC p=none, no DKIM | SPF -all, Mimecast | High |
| DDoS Vectors | admin-ajax, REST API | No rate limiting | Medium |
| Dead Subdomains | 9 NXDOMAIN entries | None | Medium |
Wildcard CORS — Access-Control-Allow-Origin: *
Any website can read cross-origin responses. Tested with Origin: evil.com and Origin: null — both return *.
Replace * with explicit origins in Cloudflare config.Missing Content-Security-Policy
No CSP header or meta tag. 15+ external scripts loaded. XSS has zero browser-side mitigation.
Add CSP via Cloudflare Response Headers Policy with script-src whitelist.WordPress REST API Fully Exposed (28 namespaces)
/wp-json/ returns 764KB JSON with full plugin stack: Wordfence, Rank Math PRO, Elementor Pro, WP Rocket, WPML, Popup Maker, Elementor AI.
Block /wp-json/ for unauthenticated users via Wordfence or Cloudflare.wp-config.php Backup Files on Disk
.bak and .old return 403 (not 404) — files exist. If WAF bypassed via origin IP, DB credentials, auth keys, and salts are exposed.
SSH in and DELETE: rm wp-config.php.bak wp-config.php.old
Rotate all credentials in wp-config.php.DMARC Policy p=none — Email Spoofing Possible
Spoofed emails from @company-b.example.com will be delivered. Critical for a cybersecurity company.
Phase 1: p=quarantine → Phase 2: p=rejectNo DKIM Records (14+ selectors tested)
No cryptographic email signing. DMARC alignment relies solely on SPF. Forwarded emails fail auth entirely.
Configure DKIM for M365, Mimecast, SES, Brevo.Origin Server IPs Exposed — Cloudflare Bypass
collector/fleet → 10.0.2.1, lms → 10.0.2.3. SPF leaks 10.0.2.2 and 10.0.2.4. Attackers bypass WAF/DDoS.
Route all subdomains through Cloudflare. Firewall origin to CF IPs only. Rotate IPs.Elastic APM Config Leaked in Page Source
Inline JS exposes: serviceName: 'Redacted-Service', environment: 'redacted-env', serverUrl: 'rum.company-b.example.com', distributed tracing across all *.company-b.example.com.
Move APM init server-side. Remove internal names from client.WAF Bypass: XSS via Search Parameter
Wordfence blocks ?q=<script> (403) but allows ?s=<img onerror> and ?s=<svg onload> (200). Inconsistent filtering.
?q=<script>alert(1)</script> → 403 (blocked)
?s=<img src=x onerror=alert(1)> → 200 (BYPASSED)
?s=<svg/onload=alert(1)> → 200 (BYPASSED)Update Wordfence rules for ?s= parameter. Add CSP as defense-in-depth.Wordfence REST API Route Map Exposed
/wp-json/wordfence/v1/ returns full route map including scan, config, auth, firewall endpoints. Reveals security scanner blueprint.
Restrict /wp-json/wordfence/ to authenticated admins.Active CVE-2026-3534 — Astra Theme Stored XSS
Astra v4.12.3 is vulnerable. Stored XSS via post meta fields. Contributor+ auth required. Fixed in 4.12.4 (released ~Mar 10).
CVSS: 6.4
Update Astra theme to v4.12.4 immediately.No CSRF Nonces in Any HTML Form (4 forms)
Forms on contact-us, careers (with file upload), penetration-testing-services, and homepage popup contain zero anti-CSRF tokens. reCAPTCHA is the single point of failure. If bypassed, full CSRF exploitation is possible.
Pages with unprotected forms:
/contact-us/ → name, email, phone, message (0 CSRF tokens)
/careers/ → name, email, phone, resume upload (0 CSRF tokens)
/penetration-testing-services/ → contact form (0 CSRF tokens)
Homepage popup → lead capture (0 CSRF tokens)1. Add wp_nonce_field() to all Elementor forms
2. Validate nonces server-side on submission
3. Add SameSite=Strict to session cookies
4. Implement Origin/Referer validationWP Nonces Cached/Static — Not Session-Bound
JS nonces (REDACTED_NONCE, REDACTED_NONCE) are identical across sessions due to WP Rocket caching. Server does not reject invalid or absent nonces — all produce identical responses.
Session 1 nonce: REDACTED_NONCE (from cached page)
Session 2 nonce: REDACTED_NONCE (identical - from cache)
POST with nonce=INVALID → 200 OK (accepted)
POST with nonce=ABSENT → 200 OK (accepted)Exclude form pages from WP Rocket cache, OR use AJAX-based dynamic nonce refresh.
Implement proper server-side nonce rejection.| ID | Finding | Detail | Fix |
|---|---|---|---|
| M1 | PUT/DELETE/PATCH return 200 | Only TRACE blocked (405). Dangerous methods accepted. | Block in Apache/Cloudflare |
| M2 | debug.log exists (403) | WP debug logs may contain PHP errors, stack traces, credentials. | Delete file, disable WP_DEBUG_LOG |
| M3 | xmlrpc.php exists (403) | Known brute force/DDoS vector. Should be deleted, not just blocked. | rm xmlrpc.php |
| M4 | phpMyAdmin path exists (403) | DB admin interface present on production server. | Remove or move to VPN-only path |
| M5 | 9 dead subdomains | CT log entries with NXDOMAIN. Subdomain takeover candidates. | Remove dangling DNS records |
| M6 | No CAA DNS record | Any CA can issue certs for company-b.example.com. | Add CAA restricting to pki.goog |
| M7 | Missing Referrer-Policy | Full URLs leak to 15+ third-party services. | strict-origin-when-cross-origin |
| M8 | Missing Permissions-Policy | Camera, mic, geolocation unrestricted for third-party scripts. | camera=(), microphone=(), geolocation=() |
| M9 | wp-cron.php accessible | 200 OK, triggers tasks (0.47s). Potential DoS vector. | Disable WP_CRON, use server cron |
| M10 | 13 plugin versions exposed | Elementor 3.35.6, Astra 4.12.3, WPML 4.8.6, etc. in HTML. | Strip versions via Perfmatters |
| M11 | No Referer/Origin validation | Form submissions from evil.com processed identically. | Validate Origin header server-side |
| M12 | admin-ajax.php DDoS vector | Heartbeat: 1.9s/request, bypasses CF cache, no rate limit. | Rate-limit or disable for logged-out users |
| M13 | REST API bandwidth amplification | per_page=100 returns 2.1 MB in 4s. No rate limiting. | Limit per_page to 10; add CF rate rules |
| ID | Finding | Detail |
|---|---|---|
| L1 | SPF overly broad | include:amazonses.com authorizes ALL SES customers |
| L2 | No SRI on scripts | No integrity hashes on external JS/CSS |
| L3 | M365 tenant exposed | redacted.onmicrosoft.com |
| L4 | Cert expires ~70 days | May 20, 2026. Verify auto-renewal. |
| L5 | Dual jQuery versions | 3.7.1 (WP) + 3.6.0 (CDN) both loaded |
| L6 | reCAPTCHA site key exposed | REDACTED_RECAPTCHA_KEY...2A7H visible in source |
| L7 | Analytics IDs exposed | GA4, GTM, Zoho PageSense IDs in source |
| L8 | Plugin readme.txt accessible | Wordfence 8.1.4, Elementor, Astra versions confirmed |
| L9 | Author IDs in posts API | author:5 and author:7 in JSON responses |
| ID | Finding | Note |
|---|---|---|
| I1 | WP generator meta stripped | Good practice |
| I2 | User enum blocked (REST API) | /wp-json/wp/v2/users returns 401 |
| I3 | Admin panels blocked (403) | wp-login, wp-admin, xmlrpc, readme.html |
| I4 | Public GitHub "site" repo | Review for leaked credentials |
| I5 | Contact info exposed | sales@, secops@, 4 co-founders identified |
Cloudflare (Edge) + Wordfence (Application)
| Test | Payload | Status | Blocked By |
|---|---|---|---|
| XSS (?q=) | <script>alert(1)</script> | 403 | Wordfence |
| XSS (?s=) | <img onerror=alert(1)> | 200 | BYPASSED |
| XSS (?s=) | <svg/onload=alert(1)> | 200 | BYPASSED |
| SQLi | 1' OR '1'='1 | 200 | Not blocked |
| UA: sqlmap | User-Agent: sqlmap/1.0 | 403 | Cloudflare |
| UA: nikto | User-Agent: nikto | 200 | Not blocked |
| Path traversal | /../../../etc/passwd | 404 | Normalized |
| wp-login | Direct access | 403 | Blocked |
| wp-admin | Direct access | 403 | Blocked |
| xmlrpc.php | Direct access | 403 | Blocked |
Forms Discovered & CSRF Posture
| Page | Form Type | CSRF Token? | reCAPTCHA? | File Upload? | Risk |
|---|---|---|---|---|---|
| /contact-us/ | Contact form | None | Yes | No | High |
| /careers/ | Job application | None | Yes | Yes (resume) | High |
| /penetration-testing-services/ | Contact form | None | Yes | No | High |
| Homepage popup | Lead capture | None | Yes | No | High |
CSRF Defense Assessment
| Defense Layer | Status | Effective? |
|---|---|---|
| Anti-CSRF nonce tokens | Absent from all forms | No |
| WP nonce validation (server-side) | Nonces not validated — invalid/absent nonces accepted | No |
| WP nonce freshness | Cached by WP Rocket — static across sessions | No |
| Origin/Referer validation | Not implemented — evil.com Referer accepted | No |
| SameSite cookie attribute | No session cookies set on public pages | N/A |
| Google reCAPTCHA v3 | Present on all forms | Partial |
| X-Frame-Options: SAMEORIGIN | Present | Yes (clickjacking) |
Conclusion: reCAPTCHA is the only effective CSRF defense. All other layers are absent or broken. If reCAPTCHA is bypassed (API solvers, score manipulation), CSRF attacks on all 4 forms are fully exploitable.
| Vector | Endpoint | Response | Mitigated? | Risk |
|---|---|---|---|---|
| admin-ajax heartbeat | /wp-admin/admin-ajax.php | 1.9s, bypasses CF cache | No | Med-High |
| REST API amplification | /wp-json/wp/v2/posts?per_page=100 | 4s, 2.1 MB | No | Medium |
| wp-cron trigger | /wp-cron.php?doing_wp_cron | 0.47s | Partial | Low-Med |
| Search ReDoS | /?s=(((.*)*)*)*)) | ~3s | Partial | Low |
| XML-RPC pingback | /xmlrpc.php | 403 | Yes | Mitigated |
| Slowloris | TCP connections | N/A | Yes (CF) | Mitigated |
| DNS amplification | DNS ANY query | RFC 8482 | Yes | Mitigated |
| Login flood | /wp-login.php | 403 | Yes | Mitigated |
No rate limiting detected on any dynamic endpoint. Network-layer DDoS is mitigated by Cloudflare, but application-layer vectors via admin-ajax and REST API are fully open.
| Component | Version | Latest | CVEs | CVSS | Status |
|---|---|---|---|---|---|
| Astra Theme | 4.12.3 | 4.12.4 | CVE-2026-3534 Stored XSS | 6.4 | VULNERABLE |
| Elementor | 3.35.6 | 3.35.6 | None | N/A | Current |
| Elementor Pro | 3.35.1 | 3.35.x | None | N/A | Current |
| WPML | 4.8.6 | 4.9.2 | Known CVEs patched | N/A | Outdated |
| Popup Maker | 1.21.5 | ~1.21.5 | Patched | N/A | Current |
| Cookie Notice | 2.5.14 | 2.5.14 | None | N/A | Current |
| Click to Chat | 4.37 | 4.37 | Patched | N/A | Current |
| Essential Addons | 6.5.13 | 6.5.13 | Patched | N/A | Current |
| Wordfence | 8.1.4 | ~8.1.x | None | N/A | OK |
| WP Rocket | Unknown | 3.20.5 | CVE-2026-28044 if <3.20 | 5.9 | Verify |
| Rank Math PRO | Unknown | 3.0.107+ | XSS if <3.0.36 | 6.6 | Verify |
| jQuery | 3.7.1 | 4.0.0 | None | N/A | Outdated (safe) |
| jQuery UI | 1.13.3 | 1.13.3 | None | N/A | Current |
User Enumeration (6 methods tested)
| Method | Result | Verdict |
|---|---|---|
?author=1 through 5 | All 404 | Blocked |
/wp-json/wp/v2/users | 401 | Blocked |
?rest_route=/wp/v2/users | 401 | Blocked |
| Posts API author field | author:5, author:7 | Partial leak |
| RSS feed dc:creator | No names | Blocked |
| oEmbed author | No data | Blocked |
Plugin API Exposure
| Endpoint | Status | Risk |
|---|---|---|
/wp-json/wordfence/v1/ | 200 (full route map) | High |
/wp-json/elementor/v1/ | 200 | Medium |
/wp-json/elementor-pro/v1/ | 200 | Medium |
/wp-json/rankmath/v1/ | 200 | Low |
/wp-json/wp/v2/settings | 401 | Blocked |
/wp-json/wp/v2/plugins | 401 | Blocked |
Login & Upload Security
| Test | Result |
|---|---|
| wp-login.php (all methods) | 403 Blocked |
| wp-admin | 403 Blocked |
| /wp-content/uploads/ listing | 403 Blocked |
| admin-ajax.php heartbeat | 200 Open (DDoS) |
| wp-cron.php | 200 Open |
| Category | Technology | Version |
|---|---|---|
| CMS | WordPress | 6.x (inferred) |
| Theme | Astra + Child | 4.12.3 / 1.0.0 |
| Page Builder | Elementor + Pro | 3.35.6 / 3.35.1 |
| Security | Wordfence | 8.1.4 |
| SEO | Rank Math PRO | Unknown |
| Caching | WP Rocket | Unknown |
| Multilingual | WPML | 4.8.6 |
| Performance | Perfmatters | Unknown |
| Popups | Popup Maker | 1.21.5 |
| Cookie | Cookie Notice | 2.5.14 |
| Chat | Click to Chat (WhatsApp) | 4.37 |
| Addons | Essential Addons | 6.5.13 |
| AI | Elementor AI | Unknown |
| Port | Service | Notes |
|---|---|---|
| 53 | DNS | Cloudflare |
| 80 | HTTP | Redirects to HTTPS |
| 443 | HTTPS | Main site |
| 2082/2083/2086/2087 | cPanel/WHM | Cloudflare defaults (no actual cPanel) |
| 8080/8443/8880 | Alt HTTP(S) | Cloudflare defaults |
SSH, FTP, databases (MySQL, PostgreSQL, MongoDB, Redis), RDP — all closed.
| Check | Result | Verdict |
|---|---|---|
| TLS 1.3 | Default (AES_256_GCM_SHA384 + X25519) | Excellent |
| TLS 1.2 | Supported | Pass |
| TLS 1.0/1.1/SSLv3 | Disabled | Pass |
| Weak ciphers (NULL/EXPORT/RC4/DES/3DES/MD5) | All rejected | Pass |
| Certificate | ECDSA P-256, Google Trust Services, wildcard | Modern |
| HSTS | max-age=31536000; includeSubDomains; preload | Excellent |
| OCSP stapling | Enabled, status: good | Pass |
| Heartbleed | Not vulnerable | Pass |
| HTTP/3 (QUIC) | Enabled | Modern |
| Cert expiry | May 20, 2026 (~70 days) | Monitor |
SSL/TLS configuration is excellent. No weaknesses.
| Check | Result | Verdict |
|---|---|---|
| MX | Mimecast EU (pri 1) + M365 (pri 3) | Good |
| SPF | -all (hard fail) + 7 includes + 2 IPs | Overly broad |
| DMARC | p=none (monitoring only) | Weak |
| DKIM | 0/14 selectors found | Missing |
| Mimecast gateway | Active | Good |
Inbound: Strong (Mimecast + M365). Outbound: Weak — no DKIM + DMARC p=none = email spoofing possible.
- ✓HSTS preload — max-age=31536000, includeSubDomains
- ✓TLS 1.2/1.3 only — strong ciphers, SSLv3/1.0/1.1 disabled
- ✓X-Frame-Options: SAMEORIGIN
- ✓X-Content-Type-Options: nosniff
- ✓Cloudflare WAF + APO + DDoS protection
- ✓Wordfence WAF (partially effective)
- ✓Admin panels blocked — wp-login, wp-admin, xmlrpc, readme.html
- ✓User enumeration blocked (REST API + author param)
- ✓SPF hard fail (-all)
- ✓Mimecast inbound gateway
- ✓WP generator meta stripped
- ✓OCSP stapling enabled
- ✓HTTP/3 (QUIC) enabled
- ✓Upload directory listing disabled
- ✓Cloudflare email obfuscation active
Update Astra theme to v4.12.4 (CVE-2026-3534)
Active stored XSS vulnerability. Patch available.
Delete wp-config.php.bak and .old
Rotate all credentials after deletion.
Delete debug.log from web root
Disable WP_DEBUG_LOG or redirect to non-web path.
Fix CORS — replace * with explicit origins
Only allow company-b.example.com origins.
Fix WAF bypass on ?s= parameter
Update Wordfence rules. Add CSP header.
Add CSRF nonces to all forms
Implement wp_nonce_field, validate server-side, exclude form pages from cache.
Add Content-Security-Policy header
Via Cloudflare Response Headers Policy.
Enforce DMARC & configure DKIM
p=quarantine → p=reject. DKIM for M365/Mimecast/SES/Brevo.
Protect origin servers
Route collector/fleet/lms through Cloudflare. Firewall origin. Rotate IPs.
Restrict WP REST API & Wordfence endpoints
Block /wp-json/ for unauthenticated users.
Rate-limit admin-ajax.php & REST API
Cloudflare rate rules on dynamic endpoints.
Add CAA record & remove APM config from source
Restrict cert issuance. Move APM init server-side.
Update WPML, verify WP Rocket & Rank Math
WPML 4.8.6 → 4.9.2. Check versions against known CVEs.
Security headers & hardening
Referrer-Policy, Permissions-Policy, SRI, block readme.txt, strip versions, disable wp-cron, delete xmlrpc/phpMyAdmin, audit dead subdomains.
| Parameter | Detail |
|---|---|
| Type | External black-box penetration test |
| Scope | company-b.example.com, all subdomains, email domain |
| Authorization | Written authorization from Company B co-founder |
| Standards | OWASP Testing Guide v4.2, PTES, NIST SP 800-115 |
| Approach | Non-destructive. No exploitation. No DoS. No brute-force. |
| Modules | 13 test modules, 500+ individual checks |
| Duration | Single session, March 11, 2026 |
| Tester | Redacted Tester |
Test Modules
| # | Module | Tools | Checks |
|---|---|---|---|
| 01 | DNS & Infrastructure | host, openssl, curl, nc | 22 DNS queries, cert analysis, ports |
| 02 | Subdomain Enumeration | sublist3r, dnsrecon, host | 130+ subdomains, CT logs |
| 03 | HTTP Security Headers | curl, WebFetch | 18 headers, CORS, methods, cookies |
| 04 | Sensitive File Discovery | curl | 130+ paths checked |
| 05 | Tech Stack & WAF | curl, WebFetch | CMS fingerprint, 13 plugins, WAF bypass |
| 06 | Email Security & OSINT | host, WebSearch | SPF/DMARC/DKIM, breach check, OSINT |
| 07 | SSL/TLS Audit | openssl, curl | Protocols, ciphers, OCSP, Heartbleed |
| 08 | Web App Vulnerabilities | curl, WebFetch | SQLi, XSS, traversal, injection, forms |
| 09 | Port Scan | bash /dev/tcp, nc | 72 ports, banner grab |
| 10 | WordPress Attacks | curl, WebFetch | User enum, REST API, plugins, cron |
| 11 | CSRF & Forms | curl, WebFetch | 4 forms, nonce validation, referer bypass |
| 12 | DDoS Vectors | curl, bash | 8 vectors tested |
| 13 | Known CVE Check | WebSearch | 13 components vs NVD/WPScan/Patchstack |