Altros Teknologi
CONFIDENTIAL

Pentest Mobile Pentest

Comprehensive Report

Client: Altros Teknologi

Target: https://api.apps.v2.altros-tech.com

Date: 06 April 2026

Author: BabaYaga Security

Report ID: RPT-F1E31285 | Generated by BabaYaga Security Platform
Standards: ISO 27001 | NIST SP 800-115 | OWASP Top 10 | CVSS v3.1 | MITRE ATT&CK | PTES

Table of Contents

1. Executive Summary
2. Risk Overview & Scoring
3. Infrastructure & Reconnaissance
4. Technology Stack
5. Findings Summary
6. Detailed Findings
7. Attack Narrative
8. Attack Chain Analysis
9. Recommendations
10. Methodology & Standards
11. Appendix

1. Executive Summary

A penetration test was conducted against https://api.apps.v2.altros-tech.com. The assessment identified 84 vulnerabilities: 22 Critical, 2 High, 33 Medium, 19 Low. The overall risk score is 315, indicating immediate action required. Remediation should follow ISO 27001 Annex A.14 and NIST SP 800-53 guidelines.

2. Risk Overview & Scoring

315
Critical Risk
SeverityCountWeightScore
Critical22×10220
High2×510
Medium33×266
Low19×119
Info8——
Total84315
The target has a significant attack surface. Identified vulnerabilities could potentially lead to unauthorized access, data exfiltration, or service disruption if exploited by threat actors.
C:22
H:2
M:33
L:19
I:8

AI Validation Summary

All findings have been independently reviewed by AI for accuracy validation.

22
TRUE POSITIVE
45
FALSE POSITIVE
7
NEEDS VERIFICATION
74
TOTAL VALIDATED

3. Infrastructure & Reconnaissance

IDSeverityFindingPortTarget
FINDING-001 MEDIUM [Mobile DAST] Dangerous permissions: android.permission.ACCESS_FINE_LOCATION, android.permission.READ_EXTERNAL_STORAGE, android.permission.WRITE_EXTERNAL_STORAGE, android.permission.ACCESS_COARSE_LOCATION https://api.apps.v2.altros-tech.com
FINDING-002 MEDIUM [Mobile DAST] No Network Security Config — certificate pinning absent https://api.apps.v2.altros-tech.com
FINDING-003 INFO [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy... https://docs.swmansion.com
FINDING-004 INFO [Mobile DAST] Missing security headers (1): Permissions-Policy https://view.officeapps.live.com
FINDING-005 INFO [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy... https://redux-toolkit.js.org
FINDING-008 INFO [Mobile DAST] Sitemap (recon): https://redux-toolkit.js.org/sitemap.xml (HTTP 200) https://redux-toolkit.js.org/sitemap.xml
FINDING-009 LOW [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy... https://api.apps.v2.altros-tech.com
FINDING-010 LOW [Mobile DAST] Environment config (credentials, DB passwords): https://api.apps.v2.altros-tech.com/.env (HTTP 403) https://api.apps.v2.altros-tech.com/.env
FINDING-011 MEDIUM [Mobile DAST] Git repository exposed: https://api.apps.v2.altros-tech.com/.git/config (HTTP 403) https://api.apps.v2.altros-tech.com/.git/config
FINDING-012 LOW [Mobile DAST] Laravel Horizon queue dashboard: https://api.apps.v2.altros-tech.com/horizon (HTTP 401) https://api.apps.v2.altros-tech.com/horizon
FINDING-015 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_certificate_file/ (39 files) https://api.apps.v2.altros-tech.com/storage/altros_certifica
FINDING-016 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_certificate_image/ (39 files) https://api.apps.v2.altros-tech.com/storage/altros_certifica
FINDING-017 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_document_pipeline/ (5024 files) https://api.apps.v2.altros-tech.com/storage/altros_document_
FINDING-018 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/backup_unit/ (110 files) https://api.apps.v2.altros-tech.com/storage/backup_unit/
FINDING-019 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/claims/ (7290 files) https://api.apps.v2.altros-tech.com/storage/claims/
FINDING-020 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/customer/ (519 files) https://api.apps.v2.altros-tech.com/storage/customer/
FINDING-021 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/customer_document_pipeline/ (249 files) https://api.apps.v2.altros-tech.com/storage/customer_documen
FINDING-022 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/delivery_order_file/ (1106 files) https://api.apps.v2.altros-tech.com/storage/delivery_order_f
FINDING-023 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/distribute_document_pipeline/ (150 files) https://api.apps.v2.altros-tech.com/storage/distribute_docum
FINDING-024 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/draf_claim/ (247 files) https://api.apps.v2.altros-tech.com/storage/draf_claim/
FINDING-025 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/draft_claim/ (3572 files) https://api.apps.v2.altros-tech.com/storage/draft_claim/
FINDING-026 MEDIUM [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/exports/ (0 files) https://api.apps.v2.altros-tech.com/storage/exports/
FINDING-027 HIGH [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/installation_document/ (2 files) https://api.apps.v2.altros-tech.com/storage/installation_doc
FINDING-028 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/invoice_file/ (2 files) https://api.apps.v2.altros-tech.com/storage/invoice_file/
FINDING-029 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/pnl_document/ (20 files) https://api.apps.v2.altros-tech.com/storage/pnl_document/
FINDING-030 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/profile/ (23 files) https://api.apps.v2.altros-tech.com/storage/profile/
FINDING-031 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/purchase_order_file/ (7 files) https://api.apps.v2.altros-tech.com/storage/purchase_order_f
FINDING-032 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/report_activity/ (4705 files) https://api.apps.v2.altros-tech.com/storage/report_activity/
FINDING-033 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/report_activty/ (2326 files) https://api.apps.v2.altros-tech.com/storage/report_activty/
FINDING-035 CRITICAL [Mobile DAST] Credentials in logcat-discovered path: https://api.apps.v2.altros-tech.com/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt https://api.apps.v2.altros-tech.com/storage/profile/2025-09-
FINDING-040 LOW [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy... https://staging-chat.altros-tech.com
FINDING-041 LOW [Mobile DAST] Environment config (credentials, DB passwords): https://staging-chat.altros-tech.com/.env (HTTP 403) https://staging-chat.altros-tech.com/.env
FINDING-042 LOW [Mobile DAST] Git repository exposed: https://staging-chat.altros-tech.com/.git/config (HTTP 403) https://staging-chat.altros-tech.com/.git/config
FINDING-045 INFO [Mobile DAST] Sitemap (recon): https://socket.io/sitemap.xml (HTTP 200) https://socket.io/sitemap.xml
FINDING-047 INFO [Mobile DAST] Sitemap (recon): https://redux.js.org/sitemap.xml (HTTP 200) https://redux.js.org/sitemap.xml
FINDING-048 INFO [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy... https://npms.io
FINDING-050 INFO [Mobile DAST] Apache server status: https://npms.io/server-status (HTTP 200) https://npms.io/server-status
FINDING-051 INFORMATIONAL [Mobile DAST] Apache server info: https://npms.io/server-info (HTTP 200) https://npms.io/server-info
FINDING-052 INFORMATIONAL [Mobile DAST] Adminer database manager: https://npms.io/adminer.php (HTTP 200) https://npms.io/adminer.php
FINDING-053 INFORMATIONAL [Mobile DAST] phpMyAdmin exposed: https://npms.io/phpmyadmin/ (HTTP 200) https://npms.io/phpmyadmin/
FINDING-054 INFORMATIONAL [Mobile DAST] Laravel Telescope debug dashboard: https://npms.io/telescope (HTTP 200) https://npms.io/telescope
FINDING-055 INFORMATIONAL [Mobile DAST] Laravel Horizon queue dashboard: https://npms.io/horizon (HTTP 200) https://npms.io/horizon
FINDING-056 INFORMATIONAL [Mobile DAST] Laravel Debugbar: https://npms.io/_debugbar (HTTP 200) https://npms.io/_debugbar
FINDING-057 INFORMATIONAL [Mobile DAST] Laravel Nova admin panel: https://npms.io/nova (HTTP 200) https://npms.io/nova
FINDING-058 INFORMATIONAL [Mobile DAST] Laravel Filament admin panel: https://npms.io/filament (HTTP 200) https://npms.io/filament
FINDING-062 INFO [Mobile DAST] Spring Boot Actuator: https://npms.io/actuator (HTTP 200) https://npms.io/actuator
FINDING-063 INFO [Mobile DAST] Spring Boot health endpoint: https://npms.io/actuator/health (HTTP 200) https://npms.io/actuator/health
FINDING-064 INFO [Mobile DAST] WordPress login: https://npms.io/wp-login.php (HTTP 200) https://npms.io/wp-login.php
FINDING-065 INFO [Mobile DAST] WordPress admin: https://npms.io/wp-admin/ (HTTP 200) https://npms.io/wp-admin/
FINDING-072 INFO [Mobile DAST] Missing security headers (2): X-Frame-Options, Permissions-Policy https://dev.to
FINDING-073 INFO [Mobile DAST] Laravel Filament admin panel: https://dev.to/filament (HTTP 200) https://dev.to/filament
FINDING-074 INFO [Mobile DAST] Robots.txt (recon): https://dev.to/robots.txt (HTTP 200) https://dev.to/robots.txt
FINDING-076 LOW [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy... http://staging-chat.altros-tech.com
FINDING-077 MEDIUM [Mobile DAST] Environment config (credentials, DB passwords): http://staging-chat.altros-tech.com/.env (HTTP 403) http://staging-chat.altros-tech.com/.env
FINDING-078 MEDIUM [Mobile DAST] Git repository exposed: http://staging-chat.altros-tech.com/.git/config (HTTP 403) http://staging-chat.altros-tech.com/.git/config
FINDING-079 INFO [Mobile DAST] [Deep Test: auth_bypass] /storage/altros_certificate_file/ — Method override accepted via X-HTTP-Method-Override https://docs.swmansion.com/storage/altros_certificate_file/
FINDING-080 INFO [Mobile DAST] [Deep Test: auth_bypass] /storage/altros_certificate_file/ — Method override accepted via X-Method-Override https://docs.swmansion.com/storage/altros_certificate_file/
FINDING-081 INFORMATIONAL [Mobile DAST] [Deep Test: auth_bypass] /horizon — Method override accepted via X-HTTP-Method-Override https://docs.swmansion.com/horizon
FINDING-082 INFORMATIONAL [Mobile DAST] [Deep Test: auth_bypass] /horizon — Method override accepted via X-Method-Override https://docs.swmansion.com/horizon
FINDING-083 INFORMATIONAL [Mobile DAST] [Deep Test: auth_bypass] /storage/backup_unit/ — Method override accepted via X-HTTP-Method-Override https://docs.swmansion.com/storage/backup_unit/
FINDING-084 INFORMATIONAL [Mobile DAST] [Deep Test: auth_bypass] /storage/backup_unit/ — Method override accepted via X-Method-Override https://docs.swmansion.com/storage/backup_unit/

Technology Stack

ApacheLaravelSpringWordPressgonginx/1.24.0php

Attack Surface

Discovered Endpoints (50)

http://staging-chat.altros-tech.com
http://staging-chat.altros-tech.com/.env
http://staging-chat.altros-tech.com/.git/config
https://api.apps.v2.altros-tech.com
https://api.apps.v2.altros-tech.com/.env
https://api.apps.v2.altros-tech.com/.git/config
https://api.apps.v2.altros-tech.com/horizon
https://api.apps.v2.altros-tech.com/robots.txt
https://api.apps.v2.altros-tech.com/storage/
https://api.apps.v2.altros-tech.com/storage/altros_certificate_file/
https://api.apps.v2.altros-tech.com/storage/altros_certificate_image/
https://api.apps.v2.altros-tech.com/storage/altros_document_pipeline/
https://api.apps.v2.altros-tech.com/storage/backup_unit/
https://api.apps.v2.altros-tech.com/storage/claims/
https://api.apps.v2.altros-tech.com/storage/customer/
https://api.apps.v2.altros-tech.com/storage/customer_document_pipeline/
https://api.apps.v2.altros-tech.com/storage/delivery_order_file/
https://api.apps.v2.altros-tech.com/storage/distribute_document_pipeline/
https://api.apps.v2.altros-tech.com/storage/draf_claim/
https://api.apps.v2.altros-tech.com/storage/draft_claim/
https://api.apps.v2.altros-tech.com/storage/exports/
https://api.apps.v2.altros-tech.com/storage/installation_document/
https://api.apps.v2.altros-tech.com/storage/invoice_file/
https://api.apps.v2.altros-tech.com/storage/pnl_document/
https://api.apps.v2.altros-tech.com/storage/profile/
https://api.apps.v2.altros-tech.com/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt
https://api.apps.v2.altros-tech.com/storage/purchase_order_file/
https://api.apps.v2.altros-tech.com/storage/report_activity/
https://api.apps.v2.altros-tech.com/storage/report_activty/
https://dev.to
https://dev.to/filament
https://dev.to/robots.txt
https://docs.swmansion.com
https://docs.swmansion.com/horizon
https://docs.swmansion.com/storage/altros_certificate_file/
https://docs.swmansion.com/storage/backup_unit/
https://npms.io
https://npms.io/.well-known/security.txt
https://npms.io/_debugbar
https://npms.io/actuator
https://npms.io/actuator/health
https://npms.io/adminer.php
https://npms.io/api/documentation
https://npms.io/crossdomain.xml
https://npms.io/dashboard/list
https://npms.io/debug/vars
https://npms.io/filament
https://npms.io/horizon
https://npms.io/nova
https://npms.io/openapi.json

3. Findings Summary

IDSeverityVulnerabilityCVSSTargetOWASPMITRE ATT&CK
FINDING-001 MEDIUM [Mobile DAST] Dangerous permissions: android.permission.ACCESS_FINE_LOCATION, android.permission.READ_EXTERNAL_STORAGE, android.permission.WRITE_EXTERNAL_STORAGE, android.permission.ACCESS_COARSE_LOCATIONVERIFY 5.5 https://api.apps.v2.altros-tech.com A05:2021 Security Misconfiguration T1190
FINDING-002 MEDIUM [Mobile DAST] No Network Security Config — certificate pinning absentTP 5.5 https://api.apps.v2.altros-tech.com A02:2021 Cryptographic Failures T1557, T1040
FINDING-003 INFO [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy...FP 0.0 https://docs.swmansion.com A05:2021 Security Misconfiguration T1189
FINDING-004 INFO [Mobile DAST] Missing security headers (1): Permissions-PolicyFP 0.0 https://view.officeapps.live.com A05:2021 Security Misconfiguration T1189
FINDING-005 INFO [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy...FP 0.0 https://redux-toolkit.js.org A05:2021 Security Misconfiguration T1189
FINDING-006 INFO [Mobile DAST] Environment config (credentials, DB passwords): https://redux-toolkit.js.org/.env (HTTP 403)FP 0.0 https://redux-toolkit.js.org/.env A05:2021 Security Misconfiguration T1190
FINDING-007 INFO [Mobile DAST] Git repository exposed: https://redux-toolkit.js.org/.git/config (HTTP 403)FP 0.0 https://redux-toolkit.js.org/.git/config A05:2021 Security Misconfiguration T1190
FINDING-008 INFO [Mobile DAST] Sitemap (recon): https://redux-toolkit.js.org/sitemap.xml (HTTP 200)FP 0.0 https://redux-toolkit.js.org/sitemap.xml A05:2021 Security Misconfiguration T1190
FINDING-009 LOW [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy...TP 2.5 https://api.apps.v2.altros-tech.com A05:2021 Security Misconfiguration T1189
FINDING-010 LOW [Mobile DAST] Environment config (credentials, DB passwords): https://api.apps.v2.altros-tech.com/.env (HTTP 403)VERIFY 2.5 https://api.apps.v2.altros-tech.com/.env A05:2021 Security Misconfiguration T1190
FINDING-011 MEDIUM [Mobile DAST] Git repository exposed: https://api.apps.v2.altros-tech.com/.git/config (HTTP 403)VERIFY 5.5 https://api.apps.v2.altros-tech.com/.git/config A05:2021 Security Misconfiguration T1190
FINDING-012 LOW [Mobile DAST] Laravel Horizon queue dashboard: https://api.apps.v2.altros-tech.com/horizon (HTTP 401)FP 2.5 https://api.apps.v2.altros-tech.com/horizon A05:2021 Security Misconfiguration T1190
FINDING-013 INFO [Mobile DAST] Robots.txt (recon): https://api.apps.v2.altros-tech.com/robots.txt (HTTP 200)TP 0.0 https://api.apps.v2.altros-tech.com/robots.txt A05:2021 Security Misconfiguration T1190
FINDING-014 CRITICAL [Mobile DAST] Directory listing enabled on https://api.apps.v2.altros-tech.com/storage/ — 34 subdirs, 25719+ files exposedTP 9.5 https://api.apps.v2.altros-tech.com/storage/ A05:2021 Security Misconfiguration T1083, T1592
FINDING-015 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_certificate_file/ (39 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/altros_certifica A02:2021 Cryptographic Failures T1557, T1040
FINDING-016 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_certificate_image/ (39 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/altros_certifica A02:2021 Cryptographic Failures T1557, T1040
FINDING-017 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_document_pipeline/ (5024 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/altros_document_ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-018 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/backup_unit/ (110 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/backup_unit/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-019 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/claims/ (7290 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/claims/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-020 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/customer/ (519 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/customer/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-021 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/customer_document_pipeline/ (249 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/customer_documen A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-022 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/delivery_order_file/ (1106 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/delivery_order_f A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-023 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/distribute_document_pipeline/ (150 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/distribute_docum A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-024 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/draf_claim/ (247 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/draf_claim/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-025 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/draft_claim/ (3572 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/draft_claim/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-026 MEDIUM [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/exports/ (0 files)TP 5.5 https://api.apps.v2.altros-tech.com/storage/exports/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-027 HIGH [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/installation_document/ (2 files)TP 7.5 https://api.apps.v2.altros-tech.com/storage/installation_doc A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-028 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/invoice_file/ (2 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/invoice_file/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-029 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/pnl_document/ (20 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/pnl_document/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-030 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/profile/ (23 files)TP 9.5 https://api.apps.v2.altros-tech.com/storage/profile/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-031 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/purchase_order_file/ (7 files) 9.5 https://api.apps.v2.altros-tech.com/storage/purchase_order_f A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-032 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/report_activity/ (4705 files) 9.5 https://api.apps.v2.altros-tech.com/storage/report_activity/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-033 CRITICAL [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/report_activty/ (2326 files) 9.5 https://api.apps.v2.altros-tech.com/storage/report_activty/ A05:2021 Security Misconfiguration T1083, T1552.001
FINDING-034 CRITICAL [Mobile DAST] Credentials in logcat-discovered path: https://npms.io/storage/profile/fPFsNeAawNZHy1vK9rcND4CUgHlC0JAIdxd8ZvWt.jpg 9.5 https://npms.io/storage/profile/fPFsNeAawNZHy1vK9rcND4CUgHlC A05:2021 Security Misconfiguration T1190
FINDING-035 CRITICAL [Mobile DAST] Credentials in logcat-discovered path: https://api.apps.v2.altros-tech.com/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt 9.5 https://api.apps.v2.altros-tech.com/storage/profile/2025-09- A05:2021 Security Misconfiguration T1190
FINDING-036 CRITICAL [Mobile DAST] Credentials in logcat-discovered path: https://npms.io/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt 9.5 https://npms.io/storage/profile/2025-09-30/KvX5X9AIQQTiffdaa A05:2021 Security Misconfiguration T1190
FINDING-037 MEDIUM [Mobile DAST] CORS wildcard (*) on https://ocpp-local.altros-tech.com 5.5 https://ocpp-local.altros-tech.com A05:2021 Security Misconfiguration T1189, T1557
FINDING-038 LOW [Mobile DAST] Missing security headers (5): HSTS (Strict-Transport-Security), X-Frame-Options, X-XSS-Protection, Referrer-Policy... 2.5 https://ocpp-local.altros-tech.com A03:2021 Injection T1189, T1185
FINDING-039 MEDIUM [Mobile DAST] CORS wildcard (*) on https://staging-chat.altros-tech.com 5.5 https://staging-chat.altros-tech.com A05:2021 Security Misconfiguration T1189, T1557
FINDING-040 LOW [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy... 2.5 https://staging-chat.altros-tech.com A05:2021 Security Misconfiguration T1189
FINDING-041 LOW [Mobile DAST] Environment config (credentials, DB passwords): https://staging-chat.altros-tech.com/.env (HTTP 403)VERIFY 2.5 https://staging-chat.altros-tech.com/.env A05:2021 Security Misconfiguration T1190
FINDING-042 LOW [Mobile DAST] Git repository exposed: https://staging-chat.altros-tech.com/.git/config (HTTP 403)VERIFY 2.5 https://staging-chat.altros-tech.com/.git/config A05:2021 Security Misconfiguration T1190
FINDING-043 INFO [Mobile DAST] CORS wildcard (*) on https://socket.ioFP 0.0 https://socket.io A05:2021 Security Misconfiguration T1189, T1557
FINDING-044 INFO [Mobile DAST] Missing security headers (6): X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, X-XSS-Protection...FP 0.0 https://socket.io A03:2021 Injection T1189, T1185
FINDING-045 INFO [Mobile DAST] Sitemap (recon): https://socket.io/sitemap.xml (HTTP 200)FP 0.0 https://socket.io/sitemap.xml A05:2021 Security Misconfiguration T1190
FINDING-046 INFO [Mobile DAST] Missing security headers (6): X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, X-XSS-Protection...FP 0.0 https://redux.js.org A03:2021 Injection T1189, T1185
FINDING-047 INFO [Mobile DAST] Sitemap (recon): https://redux.js.org/sitemap.xml (HTTP 200)FP 0.0 https://redux.js.org/sitemap.xml A05:2021 Security Misconfiguration T1190
FINDING-048 INFO [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy...FP 0.0 https://npms.io A05:2021 Security Misconfiguration T1189
FINDING-049 INFO [Mobile DAST] Debug variables exposed: https://npms.io/debug/vars (HTTP 200)FP 0.0 https://npms.io/debug/vars A05:2021 Security Misconfiguration T1190
FINDING-050 INFO [Mobile DAST] Apache server status: https://npms.io/server-status (HTTP 200)FP 0.0 https://npms.io/server-status A05:2021 Security Misconfiguration T1190
FINDING-051 INFORMATIONAL [Mobile DAST] Apache server info: https://npms.io/server-info (HTTP 200)FP 0.0 https://npms.io/server-info A05:2021 Security Misconfiguration T1190
FINDING-052 INFORMATIONAL [Mobile DAST] Adminer database manager: https://npms.io/adminer.php (HTTP 200)FP 0.0 https://npms.io/adminer.php A05:2021 Security Misconfiguration T1190
FINDING-053 INFORMATIONAL [Mobile DAST] phpMyAdmin exposed: https://npms.io/phpmyadmin/ (HTTP 200)FP 0.0 https://npms.io/phpmyadmin/ A05:2021 Security Misconfiguration T1190
FINDING-054 INFORMATIONAL [Mobile DAST] Laravel Telescope debug dashboard: https://npms.io/telescope (HTTP 200)FP 0.0 https://npms.io/telescope A05:2021 Security Misconfiguration T1190
FINDING-055 INFORMATIONAL [Mobile DAST] Laravel Horizon queue dashboard: https://npms.io/horizon (HTTP 200)FP 0.0 https://npms.io/horizon A05:2021 Security Misconfiguration T1190
FINDING-056 INFORMATIONAL [Mobile DAST] Laravel Debugbar: https://npms.io/_debugbar (HTTP 200)FP 0.0 https://npms.io/_debugbar A05:2021 Security Misconfiguration T1190
FINDING-057 INFORMATIONAL [Mobile DAST] Laravel Nova admin panel: https://npms.io/nova (HTTP 200)FP 0.0 https://npms.io/nova A05:2021 Security Misconfiguration T1190
FINDING-058 INFORMATIONAL [Mobile DAST] Laravel Filament admin panel: https://npms.io/filament (HTTP 200)FP 0.0 https://npms.io/filament A05:2021 Security Misconfiguration T1190
FINDING-059 INFORMATIONAL [Mobile DAST] API documentation exposed: https://npms.io/api/documentation (HTTP 200)FP 0.0 https://npms.io/api/documentation A05:2021 Security Misconfiguration T1190
FINDING-060 INFORMATIONAL [Mobile DAST] Swagger API spec exposed: https://npms.io/swagger.json (HTTP 200)FP 0.0 https://npms.io/swagger.json A05:2021 Security Misconfiguration T1190
FINDING-061 INFO [Mobile DAST] OpenAPI spec exposed: https://npms.io/openapi.json (HTTP 200)FP 0.0 https://npms.io/openapi.json A05:2021 Security Misconfiguration T1190
FINDING-062 INFO [Mobile DAST] Spring Boot Actuator: https://npms.io/actuator (HTTP 200)FP 0.0 https://npms.io/actuator A05:2021 Security Misconfiguration T1190
FINDING-063 INFO [Mobile DAST] Spring Boot health endpoint: https://npms.io/actuator/health (HTTP 200)FP 0.0 https://npms.io/actuator/health A05:2021 Security Misconfiguration T1190
FINDING-064 INFO [Mobile DAST] WordPress login: https://npms.io/wp-login.php (HTTP 200)FP 0.0 https://npms.io/wp-login.php A05:2021 Security Misconfiguration T1190
FINDING-065 INFO [Mobile DAST] WordPress admin: https://npms.io/wp-admin/ (HTTP 200)FP 0.0 https://npms.io/wp-admin/ A05:2021 Security Misconfiguration T1190
FINDING-066 INFO [Mobile DAST] Robots.txt (recon): https://npms.io/robots.txt (HTTP 200)FP 0.0 https://npms.io/robots.txt A05:2021 Security Misconfiguration T1190
FINDING-067 INFO [Mobile DAST] Sitemap (recon): https://npms.io/sitemap.xml (HTTP 200)FP 0.0 https://npms.io/sitemap.xml A05:2021 Security Misconfiguration T1190
FINDING-068 INFO [Mobile DAST] Flash crossdomain policy: https://npms.io/crossdomain.xml (HTTP 200)FP 0.0 https://npms.io/crossdomain.xml A05:2021 Security Misconfiguration T1190
FINDING-069 INFO [Mobile DAST] Security.txt: https://npms.io/.well-known/security.txt (HTTP 200)FP 0.0 https://npms.io/.well-known/security.txt A05:2021 Security Misconfiguration T1190
FINDING-070 INFO [Mobile DAST] 26 API endpoints accessible without authFP 0.0 https://npms.io/dashboard/list A05:2021 Security Misconfiguration T1190
FINDING-071 INFO [Mobile DAST] CORS wildcard (*) on https://dev.toFP 0.0 https://dev.to A05:2021 Security Misconfiguration T1189, T1557
FINDING-072 INFO [Mobile DAST] Missing security headers (2): X-Frame-Options, Permissions-PolicyFP 0.0 https://dev.to A05:2021 Security Misconfiguration T1189
FINDING-073 INFO [Mobile DAST] Laravel Filament admin panel: https://dev.to/filament (HTTP 200)FP 0.0 https://dev.to/filament A05:2021 Security Misconfiguration T1190
FINDING-074 INFO [Mobile DAST] Robots.txt (recon): https://dev.to/robots.txt (HTTP 200)FP 0.0 https://dev.to/robots.txt A05:2021 Security Misconfiguration T1190
FINDING-075 MEDIUM [Mobile DAST] CORS wildcard (*) on http://staging-chat.altros-tech.comTP 5.5 http://staging-chat.altros-tech.com A05:2021 Security Misconfiguration T1189, T1557
FINDING-076 LOW [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy...TP 2.5 http://staging-chat.altros-tech.com A05:2021 Security Misconfiguration T1189
FINDING-077 MEDIUM [Mobile DAST] Environment config (credentials, DB passwords): http://staging-chat.altros-tech.com/.env (HTTP 403)VERIFY 5.5 http://staging-chat.altros-tech.com/.env A05:2021 Security Misconfiguration T1190
FINDING-078 MEDIUM [Mobile DAST] Git repository exposed: http://staging-chat.altros-tech.com/.git/config (HTTP 403)VERIFY 5.5 http://staging-chat.altros-tech.com/.git/config A05:2021 Security Misconfiguration T1190
FINDING-079 INFO [Mobile DAST] [Deep Test: auth_bypass] /storage/altros_certificate_file/ — Method override accepted via X-HTTP-Method-OverrideFP 0.0 https://docs.swmansion.com/storage/altros_certificate_file/ A07:2021 Auth Failures T1078, T1548
FINDING-080 INFO [Mobile DAST] [Deep Test: auth_bypass] /storage/altros_certificate_file/ — Method override accepted via X-Method-OverrideFP 0.0 https://docs.swmansion.com/storage/altros_certificate_file/ A07:2021 Auth Failures T1078, T1548
FINDING-081 INFORMATIONAL [Mobile DAST] [Deep Test: auth_bypass] /horizon — Method override accepted via X-HTTP-Method-OverrideFP 0.0 https://docs.swmansion.com/horizon A07:2021 Auth Failures T1078, T1548
FINDING-082 INFORMATIONAL [Mobile DAST] [Deep Test: auth_bypass] /horizon — Method override accepted via X-Method-OverrideFP 0.0 https://docs.swmansion.com/horizon A07:2021 Auth Failures T1078, T1548
FINDING-083 INFORMATIONAL [Mobile DAST] [Deep Test: auth_bypass] /storage/backup_unit/ — Method override accepted via X-HTTP-Method-OverrideFP 0.0 https://docs.swmansion.com/storage/backup_unit/ A07:2021 Auth Failures T1078, T1548
FINDING-084 INFORMATIONAL [Mobile DAST] [Deep Test: auth_bypass] /storage/backup_unit/ — Method override accepted via X-Method-OverrideFP 0.0 https://docs.swmansion.com/storage/backup_unit/ A07:2021 Auth Failures T1078, T1548

4. Detailed Findings

FINDING-001 — [Mobile DAST] Dangerous permissions: android.permission.ACCESS_FINE_LOCATION, android.permission.READ_EXTERNAL_STORAGE, android.permission.WRITE_EXTERNAL_STORAGE, android.permission.ACCESS_COARSE_LOCATION

MEDIUM | CVSS 5.5
URLhttps://api.apps.v2.altros-tech.com
ValidationNEEDS VERIFICATION confidence: 70%
AI AnalysisThese permissions ARE declared (scanner is reading the manifest correctly), but whether they are excessive depends on the app's feature set. Location permissions and broad storage access are legitimately flagged as dangerous by Android itself. Needs verification because we cannot determine from the scan alone whether the app has a valid business reason for each permission. If the app does not use GPS or file access, this is a true positive; if it does, severity drops to informational. WRITE_EXTERNAL_STORAGE is deprecated regardless and should be migrated.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
android.permission.READ_EXTERNAL_STORAGE; android.permission.WRITE_EXTERNAL_STORAGE; android.permission.ACCESS_FINE_LOCATION; android.permission.ACCESS_COARSE_LOCATION
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Audit AndroidManifest.xml and confirm each permission is required by actual app functionality. Remove any unused permissions. For ACCESS_FINE_LOCATION, downgrade to ACCESS_COARSE_LOCATION if precise GPS is not needed. Replace READ/WRITE_EXTERNAL_STORAGE with scoped storage APIs (MediaStore or SAF) as these are deprecated since API 30. Add <uses-permission> with android:maxSdkVersion where applicable.

FINDING-002 — [Mobile DAST] No Network Security Config — certificate pinning absent

MEDIUM | CVSS 5.5
URLhttps://api.apps.v2.altros-tech.com
ValidationTRUE POSITIVE confidence: 90%
AI AnalysisAbsence of a NetworkSecurityConfig is straightforward to confirm from the APK — either the manifest references one or it does not. Without certificate pinning, the app is vulnerable to MitM attacks via rogue CA certificates installed on the device (common in corporate MDM or compromised environments). Medium severity is accurate: exploitation requires a privileged network position plus a trusted CA, but the impact (credential theft, session hijack) is high.
CWECWE-326
OWASPA02:2021 Cryptographic Failures
ISO 27001A.10.1.1
NISTSC-8, SC-13
MITRE ATT&CKT1557Adversary-in-the-Middle (Credential Access) T1040Network Sniffing (Credential Access)
PCI-DSS4.1, 4.2.1
SOC 2CC6.1, CC6.7
OJKSEOJK 38/2016 Bab V
Evidence:
issue=NetworkSecurityConfig not specified
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Add a network_security_config.xml in res/xml and reference it in AndroidManifest.xml via android:networkSecurityConfig. Configure certificate pinning for all first-party API domains (at minimum api.apps.v2.altros-tech.com) with pin-set including a backup pin. Set cleartextTrafficPermitted=false. Example: <domain-config cleartextTrafficPermitted="false"><domain includeSubdomains="true">api.apps.v2.altros-tech.com</domain><pin-set><pin digest="SHA-256">BASE64_HASH</pin><pin digest="SHA-256">BACKUP_PIN</pin></pin-set></domain-config>.

FINDING-009 — [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy...

LOW | CVSS 2.5
URLhttps://api.apps.v2.altros-tech.com
ValidationTRUE POSITIVE confidence: 85%
AI AnalysisThis IS the actual target domain and missing security headers is a legitimate finding. Low severity is appropriate for an API endpoint — these headers primarily protect browser-rendered content, and API responses are typically consumed by the mobile app, not rendered in a browser. However, HSTS is still valuable to prevent protocol downgrade attacks, and the headers are trivial to add. If the API also serves any browser-facing content (docs, admin panel), consider bumping to medium.
CWECWE-693
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1189Drive-by Compromise (Initial Access)
PCI-DSS6.5.6, 2.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
url=https://api.apps.v2.altros-tech.com
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Configure nginx (or upstream reverse proxy) to add the following response headers on api.apps.v2.altros-tech.com: (1) Strict-Transport-Security: max-age=31536000; includeSubDomains — enforce HTTPS. (2) X-Content-Type-Options: nosniff — prevent MIME sniffing. (3) X-Frame-Options: DENY — prevent clickjacking (unless API responses are intentionally framed). (4) Content-Security-Policy: default-src 'none' — restrictive CSP appropriate for a JSON API. (5) Permissions-Policy: geolocation=(), camera=(), microphone=() — restrict browser features. (6) Referrer-Policy: strict-origin-when-cross-origin. (7) Cache-Control: no-store — for sensitive API responses. Add these in the nginx server block: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

FINDING-010 — [Mobile DAST] Environment config (credentials, DB passwords): https://api.apps.v2.altros-tech.com/.env (HTTP 403)

LOW | CVSS 2.5
URLhttps://api.apps.v2.altros-tech.com/.env
ValidationNEEDS VERIFICATION confidence: 60%
AI AnalysisThis IS the target domain. The 403 response is from nginx/1.24.0 (Ubuntu) — a real application server, not a CDN/WAF. The key question is whether the 403 indicates the file EXISTS but is blocked by nginx config (meaning credentials are on disk and one misconfiguration away from exposure), or whether nginx returns 403 generically for dot-files. The response is a default nginx 403 page, not a custom application error, which slightly favors a blanket dot-file block rule. However, unlike the CDN 403s in findings [5-6], this warrants manual verification: check the server filesystem for .env, and compare the response to a definitively nonexistent dot-file path (e.g., /.env_nonexistent) — if that also returns 403, it is a blanket rule and lower risk; if it returns 404, the .env file likely exists on disk.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/.env; status=403; preview=<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
<!-- a padding to disable MSIE and Chr; url=https://api.apps.v2.altros-tech.com/.env
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/.env"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Immediate: Verify whether a .env file exists on disk at the web root. If it does, move it outside the web root or delete it from the server entirely (credentials should be in environment variables or a secrets manager, not in deployed files). Configure nginx to return 404 for all dot-files: location ~ /\. { return 404; }. This eliminates the information leak from 403-vs-404 differentiation. Long term: Audit deployment pipeline to ensure .env files are never copied to production web roots.

FINDING-011 — [Mobile DAST] Git repository exposed: https://api.apps.v2.altros-tech.com/.git/config (HTTP 403)

MEDIUM | CVSS 5.5
URLhttps://api.apps.v2.altros-tech.com/.git/config
ValidationNEEDS VERIFICATION confidence: 70%
AI AnalysisHTTP 403 confirms the .git directory exists on the server but access is currently blocked. This is NOT a clean false positive — a 403 (vs 404) leaks that the path is real, which aids reconnaissance. Additionally, the block may only cover .git/config; other paths (.git/HEAD, .git/refs/, .git/objects/) may still be reachable and could allow full repo reconstruction via tools like git-dumper. Manual verification is needed to test alternate .git sub-paths and common 403-bypass techniques (path traversal, URL encoding, HTTP verb tampering). Upgraded to MEDIUM because the confirmed existence of .git on a production server is a deployment hygiene failure that warrants attention beyond informational.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/.git/config; status=403; preview=<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
<!-- a padding to disable MSIE and Chr; url=https://api.apps.v2.altros-tech.com/.git/config
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/.git/config"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Remove the .git directory entirely from the web root, or if that is not feasible, add a blanket deny rule in nginx: `location ~ /\.git { deny all; return 404; }`. Returning 404 instead of 403 avoids confirming the path exists. Verify no other dotfiles/.env are similarly exposed.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-012 — [Mobile DAST] Laravel Horizon queue dashboard: https://api.apps.v2.altros-tech.com/horizon (HTTP 401)

LOW | CVSS 2.5
URLhttps://api.apps.v2.altros-tech.com/horizon
ValidationFALSE POSITIVE confidence: 85%
AI AnalysisThe 401 response confirms that Laravel Horizon's authentication gate is functioning correctly — the dashboard is not publicly accessible. The scanner flagged the endpoint's existence, but a properly auth-gated admin panel is expected behavior, not a vulnerability. The only residual risk is technology stack fingerprinting (confirms Laravel + Horizon + nginx/1.24.0) and potential brute-force attack surface against the auth mechanism. Downgraded to LOW because the control is working as designed; this is informational disclosure of a protected endpoint, not an exposed dashboard.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/horizon; status=401; preview=<html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
<!-- a paddi; url=https://api.apps.v2.altros-tech.com/horizon
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/horizon"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No immediate action required — authentication is enforced. As hardening measures: (1) restrict /horizon access by IP (e.g., allow only internal/VPN ranges in nginx), (2) ensure Horizon's HorizonServiceProvider gate() method restricts to authorized users only, (3) consider returning 404 instead of 401 to avoid endpoint discovery. Verify that Horizon auth cannot be brute-forced (rate limiting, strong credentials).

FINDING-014 — [Mobile DAST] Directory listing enabled on https://api.apps.v2.altros-tech.com/storage/ — 34 subdirs, 25719+ files exposed

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/
ValidationTRUE POSITIVE confidence: 98%
AI AnalysisThis is a confirmed, high-impact finding. Directory listing is enabled on /storage/ exposing 34 subdirectories and 25,719+ files to any unauthenticated user. This is the root cause for findings 4-9. Upgraded from HIGH to CRITICAL because: (a) the sheer volume of exposed files (25K+), (b) the subdirectory names alone reveal sensitive business data categories (certificates, claims, customer data, backups), and (c) this is a Laravel application where /storage should never be publicly browsable. This represents a significant data breach risk — likely already indexable by search engines given the permissive robots.txt in finding 2.
CWECWE-548
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1592Gather Victim Host Information (Reconnaissance)
PCI-DSS6.5.6, 2.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/storage/; url=https://api.apps.v2.altros-tech.com/storage/; subdirs=34; total_files=25719
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

IMMEDIATE ACTION REQUIRED: (1) Disable directory listing in nginx: remove `autoindex on;` or add `autoindex off;` in the location block for /storage/. (2) Block direct public access to the storage directory entirely: `location /storage/ { deny all; return 404; }` or restrict to authenticated requests only. (3) Move sensitive files out of the web root to a non-publicly-accessible path and serve them through an application-level controller with proper authorization checks. (4) Audit access logs for the /storage/ path to determine if data has already been exfiltrated. (5) Consider moving file storage to a private S3 bucket or equivalent with pre-signed URL access.

FINDING-015 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_certificate_file/ (39 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/altros_certificate_file/
ValidationTRUE POSITIVE confidence: 97%
AI AnalysisSub-finding of finding 3. The directory name 'altros_certificate_file' strongly implies these are business-critical certificate documents — possibly TLS/SSL certificates with private keys, or customer identity/compliance certificates. Either scenario is critical: exposed private keys compromise transport security; exposed customer certificates are a data breach. CRITICAL severity is accurate. The 39-file count is small but the sensitivity per-file is extremely high.
CWECWE-326
OWASPA02:2021 Cryptographic Failures
ISO 27001A.10.1.1
NISTSC-8, SC-13
MITRE ATT&CKT1557Adversary-in-the-Middle (Credential Access) T1040Network Sniffing (Credential Access)
PCI-DSS4.1, 4.2.1
SOC 2CC6.1, CC6.7
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/altros_certificate_file/; file_count=39; url=https://api.apps.v2.altros-tech.com/storage/altros_certificate_file/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/altros_certificate_file/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Same remediation as finding 3 (root cause). Additionally: (1) Identify what certificate files are exposed — if they contain private keys, TLS certs, or customer identity documents, initiate incident response. (2) Rotate or revoke any exposed cryptographic certificates. (3) Notify affected parties if these are customer-facing certificates or identity documents. (4) Restrict this path immediately: `location /storage/altros_certificate_file/ { deny all; }` as a stopgap while the broader /storage/ fix is deployed.

FINDING-016 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_certificate_image/ (39 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/altros_certificate_image/
ValidationTRUE POSITIVE confidence: 97%
AI AnalysisSub-finding of finding 3. The directory name 'altros_certificate_image' paired with the 39-file count (matching finding 4 exactly) suggests these are image/scan versions of the same certificates in finding 4 — likely scanned documents, photos of physical certificates, or rendered certificate images. If these contain customer identity information, this constitutes PII exposure. CRITICAL severity is accurate.
CWECWE-326
OWASPA02:2021 Cryptographic Failures
ISO 27001A.10.1.1
NISTSC-8, SC-13
MITRE ATT&CKT1557Adversary-in-the-Middle (Credential Access) T1040Network Sniffing (Credential Access)
PCI-DSS4.1, 4.2.1
SOC 2CC6.1, CC6.7
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/altros_certificate_image/; file_count=39; url=https://api.apps.v2.altros-tech.com/storage/altros_certificate_image/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/altros_certificate_image/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Same remediation as finding 3 (root cause). Additionally: (1) Determine if certificate images contain PII (scanned IDs, notarized documents, etc.). (2) If customer PII is involved, assess data breach notification obligations under applicable regulations (GDPR, local data protection laws). (3) Apply immediate deny rule for this path as a stopgap.

FINDING-017 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/altros_document_pipeline/ (5024 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/altros_document_pipeline/
ValidationTRUE POSITIVE confidence: 98%
AI AnalysisSub-finding of finding 3. 'altros_document_pipeline' with 5,024 files is a massive exposure. The name implies a document processing workflow — these are likely business documents being ingested, processed, or staged. Pipeline documents are particularly dangerous because they may contain raw, unredacted content (pre-processing). The volume alone makes this a critical data exposure. CRITICAL severity is accurate and arguably the second-highest-priority finding after finding 8 (claims) due to volume and likely sensitivity.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/altros_document_pipeline/; file_count=5024; url=https://api.apps.v2.altros-tech.com/storage/altros_document_pipeline/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/altros_document_pipeline/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Same remediation as finding 3 (root cause). Additionally: (1) Audit what document types exist in the pipeline directory — contracts, invoices, internal reports, customer submissions. (2) With 5024 files, automated exfiltration is trivial; check access logs for bulk download patterns. (3) If these are in-process documents, they may contain unredacted sensitive data that would normally go through review before external sharing.

FINDING-018 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/backup_unit/ (110 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/backup_unit/
ValidationTRUE POSITIVE confidence: 98%
AI AnalysisSub-finding of finding 3. 'backup_unit' is an extremely sensitive directory name. Backup files routinely contain database dumps, configuration files with credentials, API keys, and complete application state. Even 110 files in a backup directory can represent the entire application's data and secrets. This may be the highest actual-risk finding in the set despite having fewer files than others, because a single backup archive could contain everything. CRITICAL severity is accurate — arguably the most dangerous individual directory exposed.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/backup_unit/; file_count=110; url=https://api.apps.v2.altros-tech.com/storage/backup_unit/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/backup_unit/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Same remediation as finding 3 (root cause). HIGHEST URGENCY AMONG ALL FINDINGS for incident response: (1) Determine what is being backed up — if these are database dumps, application backups, or configuration backups, they likely contain credentials, API keys, and full data exports. (2) Rotate ALL credentials, API keys, and secrets that could be contained in any backup file. (3) Check if backup files contain database exports (.sql, .dump) which would expose the entire application dataset. (4) Apply immediate deny rule as stopgap.

FINDING-019 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/claims/ (7290 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/claims/
ValidationTRUE POSITIVE confidence: 98%
AI AnalysisSub-finding of finding 3. 'claims' with 7,290 files is the largest sensitive directory by file count. In the context of an application named 'altros' (which appears to be insurance/business-related based on the directory taxonomy — certificates, claims, customers), these are almost certainly insurance or financial claim documents containing highly sensitive customer PII, financial data, and potentially health information. This is the highest-volume sensitive data exposure in the scan and likely constitutes a reportable data breach if any unauthorized access has occurred. CRITICAL severity is accurate.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/claims/; file_count=7290; url=https://api.apps.v2.altros-tech.com/storage/claims/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/claims/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Same remediation as finding 3 (root cause). Additionally: (1) Claims data is almost certainly protected under insurance/financial regulations — engage legal and compliance teams immediately. (2) With 7,290 files, this is the largest sensitive data exposure by count. (3) Determine if any claim documents contain health information (HIPAA), financial records, or PII, which would trigger specific breach notification requirements. (4) Preserve access logs for forensic analysis and potential regulatory reporting.

FINDING-020 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/customer/ (519 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/customer/
ValidationTRUE POSITIVE confidence: 98%
AI AnalysisSub-finding of finding 3. 'customer' with 519 files directly exposes customer-specific data. The directory name leaves no ambiguity about the sensitivity — these are customer records, documents, or uploads. In conjunction with the claims and certificate directories, this paints a picture of a comprehensive customer data breach via directory listing. CRITICAL severity is accurate.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/customer/; file_count=519; url=https://api.apps.v2.altros-tech.com/storage/customer/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/customer/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Same remediation as finding 3 (root cause). Additionally: (1) Customer data exposure is a direct PII breach — identify what customer information is in these files (IDs, contracts, personal documents). (2) Assess breach notification obligations under GDPR, CCPA, or applicable local regulations. (3) Prepare customer notification if required. (4) Apply immediate deny rule as stopgap.

FINDING-021 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/customer_document_pipeline/ (249 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/customer_document_pipeline/
ValidationTRUE POSITIVE confidence: 90%
AI AnalysisCustomer document pipeline strongly implies PII/sensitive customer data. 249 files exposed. The directory name pattern is consistent with a Laravel or similar PHP framework storage symlink misconfiguration. Severity CRITICAL is accurate — unauthenticated access to customer documents is a direct data breach vector and likely a regulatory violation (GDPR, PDPA, etc.).
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/customer_document_pipeline/; file_count=249; url=https://api.apps.v2.altros-tech.com/storage/customer_document_pipeline/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/customer_document_pipeline/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Disable directory listing on the web server (Apache: `Options -Indexes`; Nginx: `autoindex off;`). 2) Move the `/storage/` directory outside the web root or block access via server config (`deny all` / `return 403`). 3) Serve files only through an authenticated application route that enforces authorization checks (e.g., a controller that validates the user owns the document before streaming it). 4) Audit access logs for bulk enumeration or exfiltration of these 249 files. 5) If this is a Laravel app, ensure `php artisan storage:link` only exposes the `public` disk, not sensitive subdirectories.

FINDING-022 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/delivery_order_file/ (1106 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/delivery_order_file/
ValidationTRUE POSITIVE confidence: 92%
AI AnalysisLargest exposure after draft_claim — 1106 delivery order files. Delivery orders typically contain customer names, addresses, order details, and potentially payment info. High file count increases impact significantly. The DAST scanner successfully enumerated the directory and reported a specific file count, indicating directory listing is enabled and the path is reachable. CRITICAL severity is accurate.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/delivery_order_file/; file_count=1106; url=https://api.apps.v2.altros-tech.com/storage/delivery_order_file/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/delivery_order_file/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Immediately block public access to `/storage/delivery_order_file/` at the web server level. 2) Disable directory listing server-wide. 3) Route all file access through an authenticated, authorized application endpoint. 4) Audit access logs — 1106 files is a large dataset; check for signs of prior bulk download. 5) Rotate or regenerate any files that contain sensitive order data, customer addresses, or financial information.

FINDING-023 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/distribute_document_pipeline/ (150 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/distribute_document_pipeline/
ValidationTRUE POSITIVE confidence: 90%
AI Analysis150 files in a distribution document pipeline. The 'pipeline' suffix suggests this may be a staging or processing directory for documents being distributed to customers or partners — these are likely not intended for public consumption. Similar root cause as Finding 0 (parallel pipeline directories). CRITICAL is appropriate given the business-document nature.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/distribute_document_pipeline/; file_count=150; url=https://api.apps.v2.altros-tech.com/storage/distribute_document_pipeline/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/distribute_document_pipeline/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Block public access to `/storage/distribute_document_pipeline/` via web server config. 2) Disable directory indexing. 3) Gate all document access behind authenticated application logic with per-document authorization. 4) Review the document distribution pipeline to ensure generated/staged files are not placed in publicly accessible paths.

FINDING-024 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/draf_claim/ (247 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/draf_claim/
ValidationTRUE POSITIVE confidence: 92%
AI AnalysisThe misspelling ('draf' instead of 'draft') is a strong indicator this is organic/real — not a honeypot or scanner artifact. It suggests ad-hoc directory creation during development without naming governance. 247 claim documents are exposed. Claims data typically contains PII, financial details, and policy information. CRITICAL severity is accurate. This directory likely represents the same data class as Finding 4.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/draf_claim/; file_count=247; url=https://api.apps.v2.altros-tech.com/storage/draf_claim/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/draf_claim/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Block access to `/storage/draf_claim/` immediately. 2) After remediation, consider consolidating contents into `/storage/draft_claim/` (Finding 4) and removing the misspelled directory to reduce attack surface. 3) Apply the same server-level access controls as all other `/storage/` subdirectories.

FINDING-025 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/draft_claim/ (3572 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/draft_claim/
ValidationTRUE POSITIVE confidence: 95%
AI AnalysisThis is the highest-impact finding in the batch — 3572 draft claim files exposed. Draft claims likely contain unsubmitted or in-progress insurance/warranty/financial claims with full PII, supporting documents, and financial data. The large file count and sensitive data class make this the top remediation priority. Confidence is highest here due to the volume and specificity of evidence.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/draft_claim/; file_count=3572; url=https://api.apps.v2.altros-tech.com/storage/draft_claim/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/draft_claim/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Highest priority — block access to `/storage/draft_claim/` immediately; this is the largest single exposure (3572 files). 2) Disable directory listing server-wide. 3) Audit access logs for evidence of bulk scraping or enumeration against this path. 4) Implement application-level access control so only the claim owner/handler can access their draft. 5) Consider moving draft storage to a non-web-accessible backend (e.g., S3 with signed URLs, or a path outside the document root).

FINDING-026 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/exports/ (0 files)

MEDIUM | CVSS 5.5
URLhttps://api.apps.v2.altros-tech.com/storage/exports/
ValidationTRUE POSITIVE confidence: 75%
AI AnalysisDirectory exists and is listable, but contains 0 files. Downgrading from CRITICAL to MEDIUM: no data is currently exposed, but the misconfiguration is real and the directory name 'exports' suggests it could be populated with bulk data exports at any time (race condition risk). The finding confirms the systemic directory listing issue. Still a true positive for the misconfiguration itself, but lower immediate impact.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/exports/; file_count=0; url=https://api.apps.v2.altros-tech.com/storage/exports/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/exports/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Block public access to `/storage/exports/` — even though currently empty, exports are often generated on-demand and could contain bulk data dumps (CSV/Excel reports, user lists, financial summaries). 2) Disable directory listing. 3) Ensure export files are written to a non-web-accessible path or are auto-purged after download.

FINDING-027 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/installation_document/ (2 files)

HIGH | CVSS 7.5
URLhttps://api.apps.v2.altros-tech.com/storage/installation_document/
ValidationTRUE POSITIVE confidence: 85%
AI AnalysisOnly 2 files, but 'installation_document' could range from product installation guides (lower sensitivity) to system/infrastructure installation documentation (higher sensitivity, potentially containing credentials or architecture details). Downgrading to HIGH pending content verification. The low file count slightly reduces impact but the directory is still publicly enumerable. The misconfiguration is consistent with the systemic `/storage/` exposure.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/installation_document/; file_count=2; url=https://api.apps.v2.altros-tech.com/storage/installation_document/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/installation_document/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Block public access to `/storage/installation_document/`. 2) Determine the sensitivity of the 2 exposed files — if they contain infrastructure details, credentials, or deployment configs, treat as a critical incident. 3) Apply consistent access controls across all `/storage/` subdirectories.

FINDING-028 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/invoice_file/ (2 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/invoice_file/
ValidationTRUE POSITIVE confidence: 92%
AI AnalysisDespite only 2 files, invoices are inherently sensitive financial documents containing company names, tax identifiers, billing addresses, amounts, and banking details. Maintaining CRITICAL severity — file count is low but data sensitivity is high and regulatory exposure (PII, financial data) is significant. A single exposed invoice can constitute a reportable data breach in many jurisdictions.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/invoice_file/; file_count=2; url=https://api.apps.v2.altros-tech.com/storage/invoice_file/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/invoice_file/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Block access to `/storage/invoice_file/` immediately. 2) Even with only 2 files, invoices contain financial data, company details, tax IDs, and potentially payment terms — assess breach notification requirements. 3) Ensure all invoice generation/storage uses non-web-accessible paths with authenticated download endpoints.

FINDING-029 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/pnl_document/ (20 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/pnl_document/
ValidationTRUE POSITIVE confidence: 93%
AI AnalysisP&L (Profit & Loss) documents are confidential financial statements. Exposure of 20 such files could constitute disclosure of material non-public financial information. If this is a company handling client financials, this may trigger regulatory notification obligations. CRITICAL severity is accurate and arguably understated given the financial/legal implications. This finding, along with invoice_file, suggests the application handles sensitive financial workflows.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/pnl_document/; file_count=20; url=https://api.apps.v2.altros-tech.com/storage/pnl_document/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/pnl_document/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Block access to `/storage/pnl_document/` immediately. 2) P&L documents are highly confidential financial records — assess whether any exposed documents relate to non-public financial data that could create legal/regulatory liability. 3) Notify finance/legal teams of the exposure. 4) Audit access logs for unauthorized downloads of these 20 files.

FINDING-030 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/profile/ (23 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/profile/
ValidationTRUE POSITIVE confidence: 90%
AI Analysis23 profile files exposed. 'Profile' strongly implies user PII — photos, identity documents, personal details. Direct PII exposure of user profiles is a clear privacy violation and regulatory concern (GDPR Art. 5/32, PDPA, etc.). CRITICAL severity is accurate. Combined with the customer_document and claim findings, this confirms the application stores and exposes multiple categories of user PII through the same systemic misconfiguration.
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/profile/; file_count=23; url=https://api.apps.v2.altros-tech.com/storage/profile/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/profile/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1) Block access to `/storage/profile/` immediately. 2) Profile data likely contains user photos, identity documents, or personal information — assess PII exposure scope. 3) Implement authenticated, per-user access controls so profiles are only accessible to the owning user and authorized admins. 4) If profile images/documents are needed publicly, serve them through a CDN with signed, expiring URLs rather than direct filesystem access.

FINDING-031 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/purchase_order_file/ (7 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/purchase_order_file/
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/purchase_order_file/; file_count=7; url=https://api.apps.v2.altros-tech.com/storage/purchase_order_file/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/purchase_order_file/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-032 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/report_activity/ (4705 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/report_activity/
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/report_activity/; file_count=4705; url=https://api.apps.v2.altros-tech.com/storage/report_activity/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/report_activity/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-033 — [Mobile DAST] Sensitive directory exposed: https://api.apps.v2.altros-tech.com/storage/report_activty/ (2326 files)

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/report_activty/
CWECWE-538
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1083File and Directory Discovery (Discovery) T1552.001Credentials In Files (Credential Access)
PCI-DSS6.5.6, 3.4
SOC 2CC6.5
OJKSEOJK 38/2016 Bab V
Evidence:
path=/storage/report_activty/; file_count=2326; url=https://api.apps.v2.altros-tech.com/storage/report_activty/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/report_activty/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-034 — [Mobile DAST] Credentials in logcat-discovered path: https://npms.io/storage/profile/fPFsNeAawNZHy1vK9rcND4CUgHlC0JAIdxd8ZvWt.jpg

CRITICAL | CVSS 9.5
URLhttps://npms.io/storage/profile/fPFsNeAawNZHy1vK9rcND4CUgHlC0JAIdxd8ZvWt.jpg
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/storage/profile/fPFsNeAawNZHy1vK9rcND4CUgHlC0JAIdxd8ZvWt.jpg; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/storage/profile/fPFsNeAawNZHy1vK9rcND4CUgHlC0JAIdxd8ZvWt.jpg
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/storage/profile/fPFsNeAawNZHy1vK9rcND4CUgHlC0JAIdxd8ZvWt.jpg"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-035 — [Mobile DAST] Credentials in logcat-discovered path: https://api.apps.v2.altros-tech.com/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt

CRITICAL | CVSS 9.5
URLhttps://api.apps.v2.altros-tech.com/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt; preview=https://idsmtp6.idcloudhosting.com/interface/root

https://cms.altros-tech.com/calender-activity

VMWare Esxi
10.1.1.220
root
P@ssword@123

vpn kantor zero tier
token : 856127940cae3bc3

J; url=https://api.apps.v2.altros-tech.com/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://api.apps.v2.altros-tech.com/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-036 — [Mobile DAST] Credentials in logcat-discovered path: https://npms.io/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt

CRITICAL | CVSS 9.5
URLhttps://npms.io/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/storage/profile/2025-09-30/KvX5X9AIQQTiffdaayJr9qGR39zOjuGWyOo0OgjI.txt"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-037 — [Mobile DAST] CORS wildcard (*) on https://ocpp-local.altros-tech.com

MEDIUM | CVSS 5.5
URLhttps://ocpp-local.altros-tech.com
CWECWE-942
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1189Drive-by Compromise (Initial Access) T1557Adversary-in-the-Middle (Credential Access)
PCI-DSS6.5.6
SOC 2CC6.1, CC6.6
OJKSEOJK 38/2016 Bab IV
Evidence:
header=Access-Control-Allow-Origin: *; url=https://ocpp-local.altros-tech.com
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://ocpp-local.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-038 — [Mobile DAST] Missing security headers (5): HSTS (Strict-Transport-Security), X-Frame-Options, X-XSS-Protection, Referrer-Policy...

LOW | CVSS 2.5
URLhttps://ocpp-local.altros-tech.com
CWECWE-79
OWASPA03:2021 Injection
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1189Drive-by Compromise (Initial Access) T1185Browser Session Hijacking (Collection) T1539Steal Web Session Cookie (Credential Access)
PCI-DSS6.2.4, 6.5.7
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
url=https://ocpp-local.altros-tech.com
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://ocpp-local.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-039 — [Mobile DAST] CORS wildcard (*) on https://staging-chat.altros-tech.com

MEDIUM | CVSS 5.5
URLhttps://staging-chat.altros-tech.com
CWECWE-942
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1189Drive-by Compromise (Initial Access) T1557Adversary-in-the-Middle (Credential Access)
PCI-DSS6.5.6
SOC 2CC6.1, CC6.6
OJKSEOJK 38/2016 Bab IV
Evidence:
header=Access-Control-Allow-Origin: *; url=https://staging-chat.altros-tech.com
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://staging-chat.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-040 — [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy...

LOW | CVSS 2.5
URLhttps://staging-chat.altros-tech.com
CWECWE-693
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1189Drive-by Compromise (Initial Access)
PCI-DSS6.5.6, 2.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
url=https://staging-chat.altros-tech.com
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://staging-chat.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

FINDING-041 — [Mobile DAST] Environment config (credentials, DB passwords): https://staging-chat.altros-tech.com/.env (HTTP 403)

LOW | CVSS 2.5
URLhttps://staging-chat.altros-tech.com/.env
ValidationNEEDS VERIFICATION confidence: 70%
AI AnalysisThe 403 response confirms the path exists (or at least matches a deny rule), which is a minor information disclosure. However, the actual file contents are NOT exposed — nginx is blocking access. This is on staging-chat.altros-tech.com, not the in-scope target api.apps.v2.altros-tech.com, but it is within the same organization. Manual verification needed: attempt bypass techniques (path traversal, encoding tricks like /.%65nv, HTTP method switching) to confirm the 403 is robust. Severity stays LOW because content is not leaked, but the file's existence is confirmed.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/.env; status=403; preview=<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
<!-- a padding to disable MSIE and Chr; url=https://staging-chat.altros-tech.com/.env
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://staging-chat.altros-tech.com/.env"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Return HTTP 404 instead of 403 for sensitive paths like /.env to avoid confirming file existence. Add a blanket deny rule in nginx: `location ~ /\. { return 404; }`. Verify the .env file is not present in the web root at all; if it is, remove it and manage secrets via environment variables or a vault.

FINDING-042 — [Mobile DAST] Git repository exposed: https://staging-chat.altros-tech.com/.git/config (HTTP 403)

LOW | CVSS 2.5
URLhttps://staging-chat.altros-tech.com/.git/config
ValidationNEEDS VERIFICATION confidence: 70%
AI AnalysisSame pattern as finding [0] — the 403 confirms the path matches a deny rule but does not expose contents. A 403 on /.git/config is a common scanner finding that indicates the server admin was aware of the risk and blocked it, but a 404 would be better to avoid confirming existence. On staging-chat.altros-tech.com (same org, different subdomain from target). Manual verification needed: try accessing other .git paths (.git/HEAD, .git/objects/, .git/refs/) and bypass techniques to confirm the block is comprehensive.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/.git/config; status=403; preview=<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
<!-- a padding to disable MSIE and Chr; url=https://staging-chat.altros-tech.com/.git/config
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://staging-chat.altros-tech.com/.git/config"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Return HTTP 404 instead of 403 for .git paths. Add nginx rule: `location ~ /\.git { return 404; }`. Ensure .git directories are not deployed to web-accessible locations. If using CI/CD, confirm the build/deploy pipeline strips .git before deploying.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-051 — [Mobile DAST] Apache server info: https://npms.io/server-info (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/server-info
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. The target is api.apps.v2.altros-tech.com but this finding is against npms.io (wrong domain — out of scope). More critically, the response body is the generic npms.io SPA shell HTML (<title>npms</title>), NOT an Apache server-info page. SPAs return HTTP 200 for every path and handle routing client-side, producing soft 404s. The scanner only checked for HTTP 200 without validating that the body contains Apache server-status tables, module listings, or any server-info-specific content.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/server-info; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/server-info
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/server-info"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Tune the scanner to validate response body content, not just HTTP status codes. Also investigate why the scanner targeted npms.io instead of the in-scope target api.apps.v2.altros-tech.com.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-052 — [Mobile DAST] Adminer database manager: https://npms.io/adminer.php (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/adminer.php
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io, not the in-scope target). The response body is the identical npms.io SPA index.html shell — no Adminer login form, no database management interface, no PHP content whatsoever. Every path on npms.io returns this same 200 response because the SPA's client-side router handles all routes.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/adminer.php; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/adminer.php
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/adminer.php"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner must validate response body for Adminer-specific markers (e.g., Adminer login form, 'adminer.css', database selector elements) rather than relying solely on HTTP 200 status.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-053 — [Mobile DAST] phpMyAdmin exposed: https://npms.io/phpmyadmin/ (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/phpmyadmin/
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io). Response body is the generic npms.io SPA shell, not a phpMyAdmin interface. No phpMyAdmin HTML, no login form, no PMA JavaScript or CSS references. Same soft-404 pattern as all other findings in this batch.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/phpmyadmin/; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/phpmyadmin/
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/phpmyadmin/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner should check for phpMyAdmin-specific indicators in the response (e.g., 'phpMyAdmin', PMA_commonParams, pmahomme theme CSS) before flagging.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-054 — [Mobile DAST] Laravel Telescope debug dashboard: https://npms.io/telescope (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/telescope
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io). The response is the identical npms.io SPA shell HTML returned for every path. No Laravel Telescope dashboard, no Vue.js Telescope app, no Telescope API responses. npms.io is a Node.js-based npm search tool, not a Laravel application.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/telescope; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/telescope
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/telescope"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner should validate for Telescope-specific content (e.g., 'Laravel Telescope', telescope-app Vue components, /telescope/api/* endpoints).

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-055 — [Mobile DAST] Laravel Horizon queue dashboard: https://npms.io/horizon (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/horizon
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io). Same generic npms.io HTML shell as every other finding. No Laravel Horizon queue dashboard content, no Redis metrics, no job/queue data. The site is not a Laravel application.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/horizon; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/horizon
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/horizon"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner should look for Horizon-specific markers (e.g., 'Laravel Horizon', horizon dashboard CSS/JS, Redis queue metrics).

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-056 — [Mobile DAST] Laravel Debugbar: https://npms.io/_debugbar (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/_debugbar
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io). Response body is the same npms.io SPA index.html. No Laravel Debugbar JSON payload, no debug toolbar markup, no query/route/session debug data. npms.io is not a PHP/Laravel application.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/_debugbar; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/_debugbar
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/_debugbar"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner should validate for Debugbar-specific JSON output or the Debugbar widget HTML/JS before flagging.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-057 — [Mobile DAST] Laravel Nova admin panel: https://npms.io/nova (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/nova
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io). Identical npms.io SPA shell HTML. No Laravel Nova admin panel, no Nova login page, no Inertia.js payload. The word 'nova' in a URL path returning 200 does not constitute evidence of Laravel Nova.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/nova; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/nova
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/nova"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner should check for Nova-specific indicators (e.g., 'Laravel Nova', Nova login form, inertia.js Nova app shell).

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-058 — [Mobile DAST] Laravel Filament admin panel: https://npms.io/filament (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/filament
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io). Same npms.io SPA HTML shell. No Laravel Filament admin panel, no Livewire/Alpine.js Filament components, no Filament login page. The site is JavaScript-based, not PHP/Laravel.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/filament; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/filament
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/filament"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner should validate for Filament-specific content (e.g., 'Filament', Livewire components, Filament admin login form).

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-059 — [Mobile DAST] API documentation exposed: https://npms.io/api/documentation (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/api/documentation
ValidationFALSE POSITIVE confidence: 98%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io). Response is the generic npms.io SPA shell, not API documentation. No Swagger UI, no ReDoc renderer, no API endpoint listings. The path /api/documentation simply gets caught by the SPA's client-side router like every other path.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/api/documentation; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/api/documentation
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/api/documentation"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner should verify the response contains actual API documentation content (Swagger UI HTML, ReDoc, or structured API reference markup) rather than just a 200 on the path.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-060 — [Mobile DAST] Swagger API spec exposed: https://npms.io/swagger.json (HTTP 200)

INFORMATIONAL | CVSS 0.0
URLhttps://npms.io/swagger.json
ValidationFALSE POSITIVE confidence: 99%
AI AnalysisFALSE POSITIVE — SPA catch-all routing. Wrong domain (npms.io). This is the strongest false positive indicator in the batch: the scanner claims to find swagger.json but the response preview is clearly HTML (<!DOCTYPE html>), not JSON. A real swagger.json would have Content-Type: application/json and begin with '{"swagger":' or '{"openapi":'. The scanner did not perform even basic content-type or body validation.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/swagger.json; status=200; preview=<!DOCTYPE html> <html lang=""> <head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>npms</title> <meta name="description" content="npms was built to empower the j; url=https://npms.io/swagger.json
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://npms.io/swagger.json"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation needed. Scanner should validate Content-Type is application/json and that the body parses as valid Swagger/OpenAPI JSON before flagging.

FINDING-075 — [Mobile DAST] CORS wildcard (*) on http://staging-chat.altros-tech.com

MEDIUM | CVSS 5.5
URLhttp://staging-chat.altros-tech.com
ValidationTRUE POSITIVE confidence: 90%
AI AnalysisIn-scope finding — staging-chat.altros-tech.com is an altros-tech.com subdomain. CORS wildcard on a chat service is concerning because chat services typically handle authenticated sessions and private messages. If credentials are sent cross-origin, any domain could read responses. The HTTP (non-TLS) access compounds this. Severity MEDIUM is appropriate: exploitability depends on whether Access-Control-Allow-Credentials is also set (browsers enforce mutual exclusion with wildcard, but the scanner didn't report that header). Staging environments often mirror production config, so this may indicate a production issue as well.
CWECWE-942
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1189Drive-by Compromise (Initial Access) T1557Adversary-in-the-Middle (Credential Access)
PCI-DSS6.5.6
SOC 2CC6.1, CC6.6
OJKSEOJK 38/2016 Bab IV
Evidence:
header=Access-Control-Allow-Origin: *; url=http://staging-chat.altros-tech.com
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "http://staging-chat.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1. Replace the wildcard CORS header with an explicit allowlist of trusted origins (e.g., your frontend domains). 2. Implement origin validation server-side — reflect only whitelisted origins in Access-Control-Allow-Origin. 3. Ensure Access-Control-Allow-Credentials is NOT set alongside the wildcard (browsers block this, but misconfiguration here signals deeper issues). 4. Enforce HTTPS — the service is responding on plain HTTP, so also add a redirect to HTTPS and set HSTS.

FINDING-076 — [Mobile DAST] Missing security headers (7): HSTS (Strict-Transport-Security), X-Content-Type-Options, X-Frame-Options, Content-Security-Policy...

LOW | CVSS 2.5
URLhttp://staging-chat.altros-tech.com
ValidationTRUE POSITIVE confidence: 88%
AI AnalysisIn-scope finding on altros-tech.com subdomain. Missing 7 security headers on a staging chat service is a legitimate defense-in-depth gap. Most critical is the missing HSTS given the service is accessible over plain HTTP (finding 4). LOW severity is accurate — missing headers alone are rarely directly exploitable but they remove layers of browser-side protection against XSS, clickjacking, and MIME-sniffing attacks. The nginx/1.24.0 (Ubuntu) server banner visible in other findings (6, 7) suggests these headers can be added centrally in the nginx config.
CWECWE-693
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.1.2
NISTSC-8
MITRE ATT&CKT1189Drive-by Compromise (Initial Access)
PCI-DSS6.5.6, 2.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
url=http://staging-chat.altros-tech.com
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "http://staging-chat.altros-tech.com"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

Add the following headers in the nginx configuration for staging-chat.altros-tech.com: 1. Strict-Transport-Security: max-age=31536000; includeSubDomains (and enforce HTTPS redirect first). 2. X-Content-Type-Options: nosniff. 3. X-Frame-Options: DENY (or SAMEORIGIN if framing is needed). 4. Content-Security-Policy: default-src 'self' (tune as needed). 5. Permissions-Policy: camera=(), microphone=(), geolocation=() (restrict as appropriate). 6. Referrer-Policy: strict-origin-when-cross-origin. 7. Apply the same header set to production if not already present.

FINDING-077 — [Mobile DAST] Environment config (credentials, DB passwords): http://staging-chat.altros-tech.com/.env (HTTP 403)

MEDIUM | CVSS 5.5
URLhttp://staging-chat.altros-tech.com/.env
ValidationNEEDS VERIFICATION confidence: 70%
AI AnalysisThe .env file returns 403 Forbidden, meaning nginx is blocking access — the file content is NOT exposed. However, the 403 (rather than 404) confirms the file exists on the server, which is an information disclosure. An attacker now knows: (a) a .env file exists, (b) the server runs nginx/1.24.0 on Ubuntu, (c) the application likely uses a framework that stores credentials in .env (Laravel, Node, etc.). Upgrading to MEDIUM because: the file likely contains database passwords, API keys, and secrets; if any nginx misconfiguration or bypass is found in the future, those secrets are one step away from exposure. Needs verification to confirm the file isn't partially readable via path traversal, encoding tricks, or backup files (.env.bak, .env.old, .env.swp).
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/.env; status=403; preview=<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
<!-- a padding to disable MSIE and Chr; url=http://staging-chat.altros-tech.com/.env
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "http://staging-chat.altros-tech.com/.env"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1. Verify manually: curl -v http://staging-chat.altros-tech.com/.env and confirm 403 (not 200). 2. Even though blocked, delete .env from the web root or move it outside the document root entirely. 3. Add a blanket deny rule in nginx for dotfiles: location ~ /\. { deny all; return 404; } — return 404 instead of 403 to avoid confirming file existence. 4. Remove the nginx server version from the error page (server_tokens off;). 5. Check that the .env file is not in a publicly accessible backup or VCS snapshot.

FINDING-078 — [Mobile DAST] Git repository exposed: http://staging-chat.altros-tech.com/.git/config (HTTP 403)

MEDIUM | CVSS 5.5
URLhttp://staging-chat.altros-tech.com/.git/config
ValidationNEEDS VERIFICATION confidence: 72%
AI AnalysisSame pattern as finding 6 — the .git/config path returns 403, confirming a .git directory exists on the server. This is more serious than the .env finding because .git repositories contain the full source code history, potentially including secrets committed and later removed. The 403 on /config does NOT mean the entire .git tree is blocked — nginx location blocks may only match specific paths. Needs manual verification to test whether other .git sub-paths (HEAD, index, objects/, refs/) are accessible. If any are, full source code recovery is possible. Upgrading to MEDIUM due to the potential impact if partial access is confirmed.
CWECWE-16
OWASPA05:2021 Security Misconfiguration
ISO 27001A.14.2.5
NISTSI-10
MITRE ATT&CKT1190Exploit Public-Facing Application (Initial Access)
PCI-DSS6.2.4
SOC 2CC6.1
OJKSEOJK 38/2016 Bab IV
Evidence:
path=/.git/config; status=403; preview=<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.24.0 (Ubuntu)</center>
</body>
</html>
<!-- a padding to disable MSIE and Chr; url=http://staging-chat.altros-tech.com/.git/config
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "http://staging-chat.altros-tech.com/.git/config"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

1. Verify manually: test for common bypasses — curl http://staging-chat.altros-tech.com/.git/HEAD, /.git/index, /.git/COMMIT_EDITMSG, /.git/packed-refs, /.git/refs/heads/main. Some nginx configs block /.git/config specifically but not the entire .git/ directory tree. 2. If any .git sub-path returns 200, the full repository can be reconstructed using tools like git-dumper. 3. Remove the .git directory from the web root entirely, or add a blanket nginx rule: location ~ /\.git { deny all; return 404; }. 4. Return 404 instead of 403 to avoid confirming existence.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-081 — [Mobile DAST] [Deep Test: auth_bypass] /horizon — Method override accepted via X-HTTP-Method-Override

INFORMATIONAL | CVSS 0.0
URLhttps://docs.swmansion.com/horizon
ValidationFALSE POSITIVE confidence: 95%
AI AnalysisThree independent indicators of FP: (1) The URL points to docs.swmansion.com, which is an entirely different domain from the stated target api.apps.v2.altros-tech.com — the scanner likely followed a link or misconfigured scope. (2) The endpoint returned HTTP 404 (Not Found), which does not demonstrate that a method override was 'accepted'; a true auth bypass would show a status change from 401/403 to 200/2xx. (3) response_size is empty, indicating no meaningful response body. The scanner appears to have fired the X-HTTP-Method-Override header, received a generic 404, and flagged it without baseline comparison.
CWECWE-287
OWASPA07:2021 Auth Failures
ISO 27001A.9.4.2
NISTIA-2, AC-3
MITRE ATT&CKT1078Valid Accounts (Initial Access) T1548Abuse Elevation Control Mechanism (Privilege Escalation)
PCI-DSS6.5.10, 8.3
SOC 2CC6.1, CC6.2
OJKSEOJK 38/2016 Bab III
Evidence:
url=https://docs.swmansion.com/horizon; test_type=auth_bypass; status=404; response_size=
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://docs.swmansion.com/horizon"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation required. Tune the DAST scanner to exclude off-target domains and require a meaningful status-code delta (e.g., 401→200) before flagging method-override bypass.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-082 — [Mobile DAST] [Deep Test: auth_bypass] /horizon — Method override accepted via X-Method-Override

INFORMATIONAL | CVSS 0.0
URLhttps://docs.swmansion.com/horizon
ValidationFALSE POSITIVE confidence: 95%
AI AnalysisSame FP reasoning as finding [0]: wrong domain (docs.swmansion.com, not the target), HTTP 404 response, and empty response_size. This is simply the scanner's second header variant (X-Method-Override vs X-HTTP-Method-Override) against the same /horizon path. No evidence of auth bypass — a 404 is not a successful override.
CWECWE-287
OWASPA07:2021 Auth Failures
ISO 27001A.9.4.2
NISTIA-2, AC-3
MITRE ATT&CKT1078Valid Accounts (Initial Access) T1548Abuse Elevation Control Mechanism (Privilege Escalation)
PCI-DSS6.5.10, 8.3
SOC 2CC6.1, CC6.2
OJKSEOJK 38/2016 Bab III
Evidence:
url=https://docs.swmansion.com/horizon; test_type=auth_bypass; status=404; response_size=
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://docs.swmansion.com/horizon"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation required. This is a duplicate of finding [0] using the X-Method-Override header variant against the same off-target endpoint. Deduplicate in the scanner by grouping method-override header variants per endpoint.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-083 — [Mobile DAST] [Deep Test: auth_bypass] /storage/backup_unit/ — Method override accepted via X-HTTP-Method-Override

INFORMATIONAL | CVSS 0.0
URLhttps://docs.swmansion.com/storage/backup_unit/
ValidationFALSE POSITIVE confidence: 95%
AI AnalysisSame pattern as findings [0] and [1]: (1) URL is on docs.swmansion.com, outside the target scope. (2) HTTP 404 — the /storage/backup_unit/ path does not exist on this host, so no auth decision was made. (3) Empty response_size confirms a generic error page. The scanner did not demonstrate that the override header changed the server's behavior in any way.
CWECWE-287
OWASPA07:2021 Auth Failures
ISO 27001A.9.4.2
NISTIA-2, AC-3
MITRE ATT&CKT1078Valid Accounts (Initial Access) T1548Abuse Elevation Control Mechanism (Privilege Escalation)
PCI-DSS6.5.10, 8.3
SOC 2CC6.1, CC6.2
OJKSEOJK 38/2016 Bab III
Evidence:
url=https://docs.swmansion.com/storage/backup_unit/; test_type=auth_bypass; status=404; response_size=
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://docs.swmansion.com/storage/backup_unit/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation required. Restrict DAST scan scope to the target domain (api.apps.v2.altros-tech.com) and add validation rules requiring a status-code differential between baseline and override requests before raising method-override findings.

MARKED AS FALSE POSITIVE BY AI VALIDATION

FINDING-084 — [Mobile DAST] [Deep Test: auth_bypass] /storage/backup_unit/ — Method override accepted via X-Method-Override

INFORMATIONAL | CVSS 0.0
URLhttps://docs.swmansion.com/storage/backup_unit/
ValidationFALSE POSITIVE confidence: 95%
AI AnalysisDuplicate of finding [2] using the alternate header name. All four findings in this batch share the same root cause: the scanner tested method-override headers against an out-of-scope domain (docs.swmansion.com) that returned 404 for both paths, and flagged the 404 responses as successful bypasses without any evidence of changed authorization behavior. This is a well-known DAST false-positive pattern when scope controls and response-validation logic are not configured.
CWECWE-287
OWASPA07:2021 Auth Failures
ISO 27001A.9.4.2
NISTIA-2, AC-3
MITRE ATT&CKT1078Valid Accounts (Initial Access) T1548Abuse Elevation Control Mechanism (Privilege Escalation)
PCI-DSS6.5.10, 8.3
SOC 2CC6.1, CC6.2
OJKSEOJK 38/2016 Bab III
Evidence:
url=https://docs.swmansion.com/storage/backup_unit/; test_type=auth_bypass; status=404; response_size=
▶ Validation Script

Run this command to independently verify this finding:

curl -sS -k -v \
  "https://docs.swmansion.com/storage/backup_unit/"
Impact:

Potential unauthorized access or data exposure.

Remediation:

AI Remediation:

No remediation required. Duplicate of finding [2] with X-Method-Override header variant. Recommend scanner tuning: (a) enforce target-scope validation, (b) require baseline vs. override response comparison, (c) deduplicate across header variants per endpoint.

5. Attack Chain Analysis

No exploitable attack chains were identified.

6. Recommendations

[IMMEDIATE] Remediate all Critical severity vulnerabilities within 24-48 hours

Critical vulnerabilities pose immediate risk of system compromise

Standard: ISO 27001 A.14.2.5, NIST SI-10
[IMMEDIATE] Address all High severity vulnerabilities within 7 days

High severity findings can lead to significant data breach

Standard: ISO 27001 A.14.2.5
[SHORT_TERM] Remediate Medium severity findings within 30 days

Medium findings increase overall attack surface

Standard: NIST SP 800-53 SI-10
[LONG_TERM] Implement continuous vulnerability assessment program

Regular testing prevents vulnerability accumulation

Standard: ISO 27001 A.14.2.8, NIST SP 800-115

7. Methodology & Standards

Testing Standards

  • OWASP Testing Guide v4.2 — Web application security
  • PTES — Penetration Testing Execution Standard
  • NIST SP 800-115 — Technical Guide to Information Security Testing
  • ISO 27001:2022 — Information Security Management

Scoring & Classification

  • CVSS v3.1 — Common Vulnerability Scoring System
  • CWE — Common Weakness Enumeration
  • OWASP Top 10:2021 — Web Application Risks
  • MITRE ATT&CK v15 — Adversarial Tactics, Techniques & Common Knowledge. All findings mapped to ATT&CK techniques for threat intelligence correlation.

Tools Used

CategoryTools
ReconnaissanceNmap, Subfinder, WhatWeb, SSL scan, DNS enumeration
Web ScanningBabaYaga Scanner, Nuclei, Nikto, Feroxbuster
Vulnerability TestingSQLi, XSS, LFI, SSRF, CMDi, SSTI, XXE modules
Auto-ExploitationBabaYaga Auto-Exploit (SQLi dump, LFI extract, SSRF metadata, XSS PoC, CMDi shell)
AI AnalysisShannon AI MoE Router, AI Report Analysis

8. Appendix

A. CVSS v3.1 Severity Scale

RatingScore RangeDescription
Critical9.0 — 10.0Immediate exploitation possible with severe business impact
High7.0 — 8.9Significant vulnerability requiring urgent remediation
Medium4.0 — 6.9Moderate risk requiring planned remediation
Low0.1 — 3.9Minor risk with limited exploitation potential
Informational0.0No direct security impact

B. Compliance Framework References

StandardDescription
ISO 27001:2022International standard for information security management systems (ISMS)
NIST SP 800-53Security and Privacy Controls for Information Systems
NIST SP 800-115Technical Guide to Information Security Testing and Assessment
OWASP Top 10:2021Top 10 Web Application Security Risks
PCI DSS v4.0Payment Card Industry Data Security Standard

C. Disclaimer

This report is provided "as is" and is intended solely for the use of Altros Teknologi. The assessment was conducted within the agreed scope and timeframe. Findings represent the security posture at the time of testing and may not reflect the current state of the systems.

The penetration test was performed using authorized testing methods in accordance with the rules of engagement agreed upon before the assessment. No destructive or denial-of-service attacks were performed during the assessment.

Report generated on 06 April 2026 at 22:20 | Report ID: RPT-F1E31285

BabaYaga Security Platform — Automated Penetration Testing

CONFIDENTIAL — For authorized recipients only