[ 0.000000] Linux version 6.12.43-amd64 (debian-kernel@lists.debian.org) (gcc-14 (Debian 14.2.0-19) 14.2.0) #1 SMP PREEMPT_DYNAMIC Debian 6.12.43-1 (2026-07-22)
[ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.12.43-amd64 root=/dev/mapper/ops--vg-root ro console=ttyS0,115200 systemd.show_status=1
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] SMBIOS 3.1.0 present.
[ 0.000000] DMI: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2
[ 0.003914] CPU0: AMD EPYC 7443P 24-Core Processor (family: 0x19, model: 0x1)
[ 0.011286] Memory: 16058548K/16777088K available (14336K kernel code, 2298K rwdata)
[ 0.019740] smpboot: Allowing 8 CPUs, 0 hotplug CPUs
[ 0.024118] Spectre V2 : Mitigation: Retpolines
[ 0.024119] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled
[ 0.038002] ACPI: Added _OSI(Module Device)
[ 0.052663] pci 0000:00:1f.2: reg 0x24: [mem 0xfebf0000-0xfebf1fff]
[ 0.061450] virtio_blk virtio2: [vda] 209715200 512-byte logical blocks (107 GB/100 GiB)
[ 0.070118] e1000e 0000:00:03.0 eth0: (PCI Express:2.5GT/s:Width x1) 52:54:00:9a:3f:1c
[ 0.078233] device-mapper: uevent: version 1.0.3
[ 0.078561] device-mapper: ioctl: 4.49.0-ioctl (2025-02-28) initialised
[ 0.094017] EXT4-fs (dm-0): mounted filesystem 8f3c1d22-4e07-4b19-9a55-c1de7f3a6b40 r/w
[ 0.101882] systemd[1]: systemd 257.4-1 running in system mode (+PAM +AUDIT +SELINUX)
[ 0.102004] systemd[1]: Detected virtualization kvm.
[ 0.102005] systemd[1]: Detected architecture x86-64.
[ 0.118440] systemd[1]: Hostname set to <naunet-ops1>.
[ OK ] Created slice Slice /system/systemd-cryptsetup.
[ OK ] Reached target Local Encrypted Volumes.
[ OK ] Started Journal Service.
[ OK ] Activated swap /dev/mapper/ops--vg-swap.
[ OK ] Mounted /boot.
[ OK ] Started Load AppArmor profiles.
[ OK ] Started nftables Firewall.
[ OK ] Started Network Time Synchronization.
[ OK ] Started systemd-networkd.service.
Starting Wait for Network to be Configured...
[ OK ] Finished Wait for Network to be Configured.
[ OK ] Started OpenBSD Secure Shell server.
[ OK ] Started Engagement evidence vault (evidence-vault.service).
[ OK ] Started Scope guard (roe-guard.service).
[ OK ] Reached target Multi-User System.
[ OK ] Reached target Graphical Interface.
Debian GNU/Linux 13 naunet-ops1 ttyS0
naunet-ops1 login: analyst
Password:
Linux naunet-ops1 6.12.43-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.43-1 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Sep 9 09:58:12 2026 from 10.60.0.14
analyst@naunet-ops1:~$ engagement shell
[roe-guard] rules of engagement NAU-1187 loaded, scope=ext-perimeter
[roe-guard] out-of-scope destinations will be refused at the proxy
10:41:57 $ uname -sr
Linux 6.12.43-amd64
10:41:59 $ ip -brief addr show eth0
eth0 UP 10.60.0.31/24 fe80::5054:ff:fe9a:3f1c/64
10:42:01 $ engagement open --scope ext-perimeter --mode read-only
engagement NAU-1187 opened by analyst at 2026-09-09T10:42:01+02:00
evidence vault ready: /srv/evidence/NAU-1187 (append-only, 0 items)
[info] scope confirmed, naunet.eu, region=eu-central, roe=NAU-1187
10:42:03 $ dig +noall +answer naunet.eu A naunet.eu AAAA
naunet.eu. 300 IN A 194.42.299.37
naunet.eu. 300 IN AAAA fd00:4f8:1c1e:5a2b::17
[ok] A 194.42.299.37, AAAA fd00:4f8:1c1e:5a2b::17, ttl=300
10:42:05 $ dig NS naunet.eu +dnssec
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
naunet.eu. 3600 IN NS ns1.naunet.eu.
naunet.eu. 3600 IN NS ns2.naunet.eu.
naunet.eu. 3600 IN RRSIG NS 13 2 3600 20260921 34505 naunet.eu. Yk3pQd8=
;; Query time: 24 msec
[info] ns1.naunet.eu, ns2.naunet.eu, dnssec=enabled
10:42:08 $ openssl s_client -connect naunet.eu:443 </dev/null | openssl x509 -noout -ext subjectAltName
X509v3 Subject Alternative Name:
DNS:naunet.eu, DNS:api.naunet.eu, DNS:portal.naunet.eu, DNS:mail.naunet.eu
notAfter=Nov 26 08:14:33 2026 GMT
[ok] api.naunet.eu, portal.naunet.eu, mail.naunet.eu
10:42:11 $ testssl --fast --protocols --headers naunet.eu
SSLv2 not offered (OK)
SSLv3 not offered (OK)
TLS 1 not offered
TLS 1.1 not offered
TLS 1.2 offered (OK)
TLS 1.3 offered with final (OK): TLS_AES_256_GCM_SHA384
HSTS max-age=31536000; includeSubDomains
Done 2026-09-09 10:42:12 [ 1s] -->> 194.42.299.37:443 (naunet.eu) <<--
[ok] TLS 1.2 and TLS 1.3, hsts=present, weak-cipher=none
10:42:13 $
10:42:13 $
10:42:14 $ curl -sSI https://naunet.eu
HTTP/2 200
server: edge-gateway/2.9.4
content-type: text/html; charset=utf-8
content-length: 8421
cache-control: private, no-store
strict-transport-security: max-age=31536000; includeSubDomains
[http] 200 OK, server=edge-gateway/2.9.4, cache=private, length=8421
[note] server banner exposes build number, raise as hygiene item
10:42:18 $ nmap -Pn -T4 -p 22,80,443,8443 194.42.299.37
Starting Nmap 7.98 ( https://nmap.org ) at 2026-09-09 10:42 CEST
Nmap scan report for naunet.eu (194.42.299.37)
Host is up (0.018s latency).
PORT STATE SERVICE
22/tcp filtered ssh
80/tcp open http
443/tcp open https
8443/tcp open https-alt
Nmap done: 1 IP address (1 host up) scanned in 1.42 seconds
[tcp] 22 filtered, 80 redirect, 443 open, 8443 open
[ok] perimeter responses recorded, evidence bundle ev-0012
10:42:19 $
10:42:19 $
10:42:22 $ curl -sSI https://naunet.eu:8443
HTTP/1.1 200 OK
server: jetty/12.0.18
x-debug-node: app-edge-03
cache-control: no-cache
[warn] alternate service returns a different header set than 443
[evidence] screenshot=ev-0017, request=tr-0021
10:42:29 $ curl -sS https://naunet.eu/status
{"status":"healthy","version":"4.9.1","region":"eu-central","uptime":"37d"}
[ok] 200 OK, status=healthy, version=4.9.1
[note] version field should be dropped from public responses
10:42:37 $ curl -sSI https://portal.naunet.eu/login
HTTP/2 200
set-cookie: nau_sess=<redacted>; Path=/; Secure; HttpOnly; SameSite=Lax
content-security-policy: default-src 'self'; frame-ancestors 'none'
[ok] secure=present, httponly=present, samesite=lax
10:42:40 $ httpx -path-list roe-approved.txt -status-code -silent
https://naunet.eu/ [200]
https://naunet.eu/login [302]
https://naunet.eu/help [200]
https://naunet.eu/status [200]
https://naunet.eu/assets [403]
https://naunet.eu/api/v1 [401]
https://naunet.eu/portal-old [500]
[route] /, /login, /help, /status, /assets, /api/v1
[note] legacy /portal-old returns a different error template
10:42:48 $ curl -sSI https://api.naunet.eu/v1/ping
HTTP/2 200
x-ratelimit-limit: 60
x-ratelimit-remaining: 59
x-ratelimit-reset: 60
retry-after: 60
[ok] limit=60, window=60s, retry-after=present
10:42:59 $ curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' https://portal.naunet.eu/dashboard
302 https://sso.naunet.eu/authorize?client_id=portal&response_type=code
[blocked] 302 login, body=not disclosed, cache=private
10:43:07 $ curl -sS https://sso.naunet.eu/.well-known/openid-configuration | jq
{
"issuer": "https://sso.naunet.eu",
"authorization_endpoint": "https://sso.naunet.eu/authorize",
"token_endpoint": "https://sso.naunet.eu/token",
"scopes_supported": [
"openid",
"profile"
]
}
[idp] issuer=sso.naunet.eu, discovery=restricted
10:43:11 $
10:43:11 $
10:43:14 $ curl -sS https://api.naunet.eu/v1/accounts
{"error":"unauthorized","message":"authentication required","request_id":"4b91f2c7"}
[blocked] anonymous request denied, principal=none
10:43:15 $
10:43:15 $
10:43:18 $ curl -sS https://api.naunet.eu/v1/orders/0
{"error":"internal_error","correlation":"ord-svc-7/eu-central-1b/txn-88412"}
[warn] route returns internal correlation detail in error body
[evidence] response=ev-0044, severity=low, owner=application
10:43:19 $
10:43:19 $
10:43:26 $ review upload policy with platform team
upload policy v3 (owner: platform, reviewed 2026-06-18)
accepted types: pdf, png, jpeg, csv max size: 25 MiB
content inspection: clamav + type sniffing storage: per-tenant bucket prefix
[ok] type allowlist, size limit, content inspection, storage isolation
10:43:34 $ curl -sSI -H 'Origin: https://naunet.eu' https://api.naunet.eu/v1/ping
access-control-allow-origin: https://naunet.eu
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
vary: Origin
[ok] allowed-origins=3, wildcard=false, credentials=restricted
10:43:42 $ curl -sS https://naunet.eu/assets/manifest.json
{"main":"main.7f31a9c4.js","vendor":"vendor.2b8e11df.js","css":"app.4c9d0e77.css"}
curl -sSI https://naunet.eu/assets/main.7f31a9c4.js.map -> 404
[asset] hashed bundles, source maps=not exposed, debug=false
10:43:50 $ probe cloud metadata boundary via app fetch parameter
request: GET /api/v1/preview?src=<metadata-endpoint>
response: 400 invalid_source (allowlist=https only, internal ranges refused)
[blocked] metadata route unreachable from application edge
10:43:51 $
10:43:51 $
10:43:58 $ curl -sSI https://naunet.eu/debug
HTTP/2 403
content-length: 0
server: edge-gateway/2.9.4
[blocked] 403 forbidden, response body minimized
10:44:01 $
10:44:01 $
10:44:02 $ review audit event shape with platform team
{
"actor": "usr_8813",
"action": "project.update",
"resource": "prj_2041",
"timestamp": "2026-09-09T08:12:44Z",
"correlation_id": "4b91f2c7"
}
[ok] actor, action, resource, timestamp, correlation-id observed
10:44:06 $ compare event timestamps across edge and application logs
edge 2026-09-09T08:12:44.118Z req=4b91f2c7
app 2026-09-09T08:12:46.522Z req=4b91f2c7
delta +2.404s
[note] edge and application clocks differ by 2.4 seconds
10:44:14 $ curl -sS https://status.naunet.eu/backup
{"backup":"scheduled","last_run":"2026-09-09T02:00:00Z","restore_test":null}
[status] backup=scheduled, restore-test=not-public, owner=platform
10:44:21 $
10:44:21 $
10:44:22 $ validate logout behaviour in portal session
POST /logout -> 204, set-cookie: nau_sess=; Max-Age=0
GET /account -> 302 https://sso.naunet.eu/authorize
GET /account (back-navigation, cached) -> 302, no body served from cache
[ok] session revoked, back-navigation returns login
10:44:30 $ curl -sS https://api.naunet.eu/v1/tenants
{"error":"tenant_required","message":"X-Tenant header missing"}
[blocked] tenant identifier required, anonymous access denied
10:44:38 $ curl -sS 'https://naunet.eu/%2e%2e%2f'
HTTP/2 400
<html><head><title>Whitelabel Error Page</title></head><body>
<div>There was an unexpected error (type=Bad Request, status=400).</div>
[warn] malformed path returns framework marker, reduce response detail
10:44:46 $ confirm denied requests reached the SIEM pipeline
query: source=edge-gateway status IN (401,403) window=15m
hits: 41 sampled request ids matched: 41/41 alert rule: EDGE-DENY-BURST (>50/5m)
[ok] denied request retained, alert threshold configured
10:44:54 $ summarize exposed surface
hostnames 4 open ports 3 authenticated surfaces 2 public endpoints 6
[ok] findings=3, high=0, medium=0, low=3, informational=7
10:45:02 $ order remediation by effort
1 reduce-banners owner=platform effort=S ev-0012, ev-0031
2 normalize-errors owner=application effort=M ev-0044
3 align-clock owner=platform effort=S ev-0061
[ok] priority=reduce-banners, normalize-errors, align-clock
10:45:06 $ engagement close --phase read-only
phase read-only closed, 42 evidence items sealed, sha256 manifest written
[complete] read-only pass closed, no state changes on client systems
[observe] holding for next window, cursor=7f2a91c0
10:57:17 $
10:57:17 $
10:58:01 $ sudo nmap -sS -Pn --top-ports 200 --max-rate 150 194.42.299.37
Starting Nmap 7.98 ( https://nmap.org ) at 2026-09-09 10:58 CEST
Nmap scan report for naunet.eu (194.42.299.37)
Host is up (0.018s latency).
Not shown: 196 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp filtered ssh
80/tcp open http
443/tcp open https
8443/tcp open https-alt
Nmap done: 1 IP address (1 host up) scanned in 6.71 seconds
[nmap] host up, latency=18ms, target=194.42.299.37, scanned=200 ports
[nmap] 22/tcp filtered, 80/tcp redirect, 443/tcp open, 8443/tcp open
[nmap] service fingerprints collected, version disclosure=partial
10:58:09 $ nmap -sV -p 443,8443 194.42.299.37
PORT STATE SERVICE VERSION
443/tcp open ssl/https edge-gateway 2.9.4
8443/tcp open ssl/https Jetty 12.0.18
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 4.03 seconds
[nmap] 443=edge-gateway, 8443=alternate-web-service, confidence=high
[note] rate capped at 150 pps for the agreed maintenance window
10:58:14 $ sudo masscan 194.42.299.32/28 -p22,80,443,8443 --rate 150
Starting masscan 1.3.2 (http://bit.ly/14GZzcT)
Scanning 16 hosts [4 ports/host]
Discovered open port 443/tcp on 194.42.299.37
Discovered open port 8443/tcp on 194.42.299.37
Discovered open port 80/tcp on 194.42.299.37
rate: 0.00-kpps, 100.00% done, waiting 3 seconds
[masscan] policy rate cap applied, results consistent with the nmap sweep
[ok] no additional public ports observed in approved scope
10:58:20 $ dig naunet.eu ANY +dnssec @ns1.naunet.eu
naunet.eu. 300 IN A 194.42.299.37
naunet.eu. 300 IN AAAA fd00:4f8:1c1e:5a2b::17
naunet.eu. 3600 IN MX 10 mail.naunet.eu.
naunet.eu. 3600 IN TXT "v=spf1 include:_spf.naunet.eu -all"
stg-portal.naunet.eu. 300 IN A 10.60.12.44
;; Query time: 21 msec
[dig] A, AAAA, CNAME and TXT records compared, dnssec=enabled
[warn] staging naming pattern visible in one non-routable record
10:58:26 $ httpx -l scope-hosts.txt -title -tech-detect -status-code
https://naunet.eu [200] [Naunet] [web-edge,HTTP/2]
https://portal.naunet.eu/login [302] [] [web-edge]
https://api.naunet.eu [401] [] [web-edge]
https://mail.naunet.eu [200] [Webmail] [web-edge]
[httpx] 200 https://naunet.eu, title=Naunet, tech=web-edge
[httpx] 302 https://portal.naunet.eu/login, auth=required
10:58:32 $ curl -sSI https://naunet.eu -o headers-0031.txt
cache-control: private, no-store
content-security-policy: default-src 'self'; frame-ancestors 'none'
referrer-policy: strict-origin-when-cross-origin
x-debug-node: app-edge-03
[curl] cache=private, csp=present, frame-ancestors=deny, referrer=origin
[note] x-debug-node header should be removed from public responses
10:58:35 $
10:58:35 $
10:58:38 $ whatweb -a 1 https://naunet.eu
https://naunet.eu [200 OK] HTTPServer[edge-gateway/2.9.4], UncommonHeaders[x-debug-node], CDN
[whatweb] framework marker=absent, CDN marker=present, confidence=medium
[ok] no source map or debug bundle discovered
10:58:44 $ testssl --fast --protocols --headers naunet.eu
TLS 1.2 offered (OK)
TLS 1.3 offered with final (OK): TLS_AES_256_GCM_SHA384
Chain of trust Ok (R11 -> ISRG Root X1, 3 certificates)
HSTS max-age=31536000; includeSubDomains
Done 2026-09-09 10:58:49 [ 5s] -->> 194.42.299.37:443 (naunet.eu) <<--
[testssl] TLS 1.3 preferred, certificate chain valid, weak protocol=none
[testssl] hsts=max-age=31536000, preload=not assessed
10:58:50 $ nuclei -l scope-hosts.txt -t exposures/ -passive
[INF] Templates loaded for current scan: 118
[INF] Targets loaded for current scan: 4
[INF] Scan completed in 5.2s. 2 matches found.
[nuclei] templates=passive-only, matches=2, severity=informational
[nuclei] active verification deferred to the authenticated phase
10:58:52 $
10:58:52 $
10:58:56 $ nikto -h https://naunet.eu -Tuning b
+ Server: edge-gateway/2.9.4
+ Retrieved x-debug-node header: app-edge-03
+ Server banner discloses a build number, which may aid version matching.
+ 1 host(s) tested
+ End Time: 2026-09-09 10:59:01 (5 seconds)
[nikto] server banner detail noted, default files=not observed
[note] result requires manual confirmation before being raised
10:59:02 $ ffuf -w roe-routes.txt -u https://naunet.eu/FUZZ -t 40 -rate 250
help [Status: 200, Size: 5124, Words: 812, Lines: 143]
status [Status: 200, Size: 74, Words: 3, Lines: 1]
assets [Status: 403, Size: 0, Words: 1, Lines: 1]
portal-old [Status: 301, Size: 0, Words: 1, Lines: 1]
:: Progress: [1200/1200] :: Job [1/1] :: 243 req/sec :: Duration: [0:00:05]
[ffuf] 1200 requests, 200=6, 301=2, 403=3, filtered=1189
[info] candidate routes kept as redacted evidence references
10:59:08 $ feroxbuster -u https://naunet.eu --depth 1 --rate-limit 250
200 GET 143l 812w 5124c https://naunet.eu/help
301 GET 0l 0w 0c https://naunet.eu/portal-old => /login
403 GET 0l 0w 0c https://naunet.eu/assets
[####################] - 5s 1200/1200 0s found:128 errors:0
[feroxbuster] 128 paths mapped, status clusters=3, redirects=2
[blocked] recursive expansion disabled outside approved scope
10:59:14 $ amass intel -passive -d naunet.eu
naunet.eu
api.naunet.eu
portal.naunet.eu
mail.naunet.eu
sso.naunet.eu
status.naunet.eu
files.naunet.eu
[amass] passive names=7, active resolution=disabled, duplicates=2
[ok] asset graph stored without contacting unapproved hosts
10:59:20 $ sslscan --no-colour naunet.eu
TLSv1.3 enabled
TLSv1.2 enabled
TLSv1.1 disabled
Preferred TLSv1.3 256 bits TLS_AES_256_GCM_SHA384
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256
[sslscan] preferred suites=modern, legacy suite=not offered
[ok] transport evidence linked to ev-0144
10:59:26 $ merge tool output into engagement dataset
reading 6 result sets from /srv/evidence/NAU-1187/raw
normalizing host, port and finding keys ... 144 records
[merge] nmap, masscan, httpx, whatweb, testssl, nuclei
[merge] consistent=11, review=3, conflict=0, confidence=high
10:59:32 $ generate scan narrative for NAU-1187
rendering report NAU-1187-ext-perimeter.md (14 sections, 3 findings, 7 notes)
manifest sha256 a91c...4e7b written to /srv/evidence/NAU-1187/manifest.txt
[report] external surface mapped, three low-risk hygiene items retained
[complete] scan phase closed, findings queued for client review
[observe] holding for next window, cursor=b41c7d09
11:12:04 $ engagement seal --all
sealing 144 evidence items, sha256 manifest signed with key ops1-2026 (ed25519)
[complete] NAU-1187 evidence sealed, vault switched to read-only
11:12:09 $ evidence sync --target vault.naunet.eu --dry-run
[roe-guard] destination vault.naunet.eu allowed by NAU-1187
144 items / 218 MiB queued, 0 conflicts, transfer window=out-of-hours
11:12:14 $ exit
[roe-guard] engagement shell closed, scope NAU-1187 released
analyst@naunet-ops1:~$ sudo systemctl poweroff
Broadcast message from root@naunet-ops1 (ttyS0) (Wed Sep 9 11:12:18 2026):
The system will power off now!
[ OK ] Stopped target Graphical Interface.
[ OK ] Stopped target Multi-User System.
Stopping Engagement evidence vault (evidence-vault.service)...
Stopping OpenBSD Secure Shell server...
Stopping Scope guard (roe-guard.service)...
[ OK ] Stopped Engagement evidence vault (evidence-vault.service).
[ OK ] Stopped Scope guard (roe-guard.service).
[ OK ] Stopped OpenBSD Secure Shell server.
[ OK ] Stopped Network Time Synchronization.
[ OK ] Stopped systemd-networkd.service.
[ OK ] Stopped nftables Firewall.
[ OK ] Stopped Load AppArmor profiles.
[ OK ] Stopped target Basic System.
[ OK ] Stopped target Slice Units.
[ OK ] Unmounted /boot.
[ OK ] Deactivated swap /dev/mapper/ops--vg-swap.
[ OK ] Reached target Unmount All Filesystems.
[ OK ] Stopped target Local Encrypted Volumes.
[ OK ] Reached target Late Shutdown Services.
[ OK ] Finished System Power Off.
[ OK ] Reached target System Power Off.
[ 1841.774218] systemd-journald[318]: Received SIGTERM from PID 1 (systemd-shutdow).
[ 1841.882104] systemd-shutdown[1]: Syncing filesystems and block devices.
[ 1841.913447] systemd-shutdown[1]: Sending SIGTERM to remaining processes...
[ 1842.021118] systemd-shutdown[1]: Sending SIGKILL to remaining processes...
[ 1842.043902] systemd-shutdown[1]: Unmounting file systems.
[ 1842.061774] systemd-shutdown[1]: Unmounting /run/credentials/systemd-journald.service.
[ 1842.078119] systemd-shutdown[1]: Remounting '/' read-only.
[ 1842.104663] systemd-shutdown[1]: All filesystems unmounted.
[ 1842.118240] systemd-shutdown[1]: Deactivating swaps.
[ 1842.126001] systemd-shutdown[1]: All swaps deactivated.
[ 1842.133918] systemd-shutdown[1]: Detaching loop devices.
[ 1842.141227] systemd-shutdown[1]: All loop devices detached.
[ 1842.148774] systemd-shutdown[1]: Stopping MD devices.
[ 1842.156119] systemd-shutdown[1]: Detaching DM devices.
[ 1842.171408] systemd-shutdown[1]: Detaching DM /dev/dm-1 (253:1).
[ 1842.196550] systemd-shutdown[1]: Not all DM devices detached, 1 left.
[ 1842.212118] systemd-shutdown[1]: Failed to finalize DM devices, ignoring.
[ 1842.226774] systemd-shutdown[1]: Powering off.
[ ***.******] watchdog: watchdog0: watchdog did not stop!
[ ***.******] ACPI: PM: Preparing to enter system sleep state S5
[ ***.******] reboot: Power down
11:19:02 $ palera1n -f -B "-v serial=3 keepsyms=1"
palera1n | version 2.1.0, mobile app assessment lab (device 04, asset NAU-LAB-04)
==> Waiting for devices
==> Found DFU Mode device (iPhone10,4)
==> Pwning device
==> Booting PongoOS 2.4.1-checkm8
==> Sending kernel patchfinder, boot-args = -v serial=3 keepsyms=1
=======================================
::
:: iBoot 8419.80.7, Copyright 2007-2024, Apple Inc.
::
:: BUILD_TAG: iBoot-8419.80.7
:: BUILD_STYLE: RELEASE
:: SECURE BOOT: production fused, personalization=local
::
=======================================
[iBoot] platform_init_display: display=D520, 750x1334
[iBoot] usb_dfu: exited, image4 payload accepted (kernelcache 41.2 MiB)
[iBoot] boot-args = -v serial=3 keepsyms=1
[ 0.000000] === Darwin/BSD ===
[ 0.000000] Darwin Kernel Version 22.6.0: xnu-8796.141.3.703.2~1/RELEASE_ARM64_T8015
[ 0.014118] PMAP: PPL enabled, kernel text lockdown complete
[ 0.019447] KTRR: region 0xfffffff007004000-0xfffffff008a3c000 locked
[ 0.024002] ASLR: kernel slot 0x00000000_0f200000
[ 0.031774] AppleARMPlatform::start: T8015 (A11 Bionic), fused=1, production=1
[ 0.038119] AppleSEPManager::start: SEPOS 4.0.0, sepfw personalized, ok
[ 0.044663] AppleKeyStore: starting (aks), keybag=system, locked
[ 0.051228] AppleANS3NVMeController: 64 GB NAND, format=APFS, ready
[ 0.058440] AppleSmartIO2: charger detached, battery=87%, temp=28.4C
[ 0.064117] AppleBCMWLANCore: firmware 4378 loaded, country=HU
[ 0.071882] AppleBasebandPCI: baseband held offline (lab profile, no SIM)
[ 0.079004] apfs_vfsop_mount: disk0s1s1 mounted read-only (System role)
[ 0.085441] apfs_vfsop_mount: disk0s1s2 mounted read/write (Data role)
[ 0.092118] AppleMobileFileIntegrity: developer mode enabled, amfi_get_out_of_my_way=0
[ 0.098774] launchd[1]: *** launchd[1] has started up. ***
[ 0.104119] com.apple.SpringBoard[54]: display awake, first unlock pending
[ 0.118002] dropbear[189]: listening on port 22 (usbmux tunnel only)
[ok] lab device booted verbose, screen unlocked, no SIM, wifi=lab-vlan-9
11:19:41 $ ideviceinfo -k ProductType -k ProductVersion -k BuildVersion
iPhone10,4
16.7.10
20H350
[info] target app=eu.naunet.portal 4.9.1 (build 2041), device=NAU-LAB-04
11:19:48 $ frida-ps -Uai | grep -i naunet
PID Name Identifier
1284 Naunet Portal eu.naunet.portal
[ok] frida-server 17.2.4 attached over usbmux, gadget not required
11:19:52 $
11:19:52 $
11:19:55 $ objection -g eu.naunet.portal explore
Using USB device `iPhone 8 (NAU-LAB-04)`
Agent injected and responds ok!
eu.naunet.portal on (iPhone: 16.7.10) [usb] # ios info binary
Name Type Encrypted PIE ARC Canary Stack Exec
NaunetPortal execute False True True True False
[ok] PIE, ARC and stack canary present, cryptid=0 on the decrypted copy
11:20:14 $ otool -l NaunetPortal | grep -A4 LC_ENCRYPTION_INFO_64
cmd LC_ENCRYPTION_INFO_64
cryptoff 16384
cryptsize 22986752
cryptid 0
[note] store binary is encrypted, decrypted copy retained as ev-ios-002
11:20:33 $ plutil -p Info.plist | grep -A6 NSAppTransportSecurity
"NSAppTransportSecurity" => {
"NSExceptionDomains" => {
"legacy-api.naunet.eu" => {
"NSExceptionAllowsInsecureHTTPLoads" => 1
"NSExceptionMinimumTLSVersion" => "TLSv1.0"
[warn] ATS exception permits cleartext and TLS 1.0 to one legacy host
[evidence] plist=ev-ios-004, severity=medium, owner=mobile
11:20:44 $
11:20:44 $
11:20:52 $ nscurl --ats-diagnostics --verbose https://legacy-api.naunet.eu
Default ATS Secure Connection
Result : FAIL
Allow Insecure HTTP Loads
Result : PASS
TLSv1.2 with exception
Result : PASS
[warn] host would still be reachable over http from the shipped app
11:21:09 $ ls /var/mobile/Containers/Data/Application/9C4A1F7E-3B21-4D0E-8A5C-77E1B2D4F630
Documents/ Library/ SystemData/ tmp/
Library/Preferences/eu.naunet.portal.plist
Library/Caches/eu.naunet.portal/Cache.db
Library/WebKit/WebsiteData/Default/
[ok] container mapped, 41 files, 18.4 MiB
11:21:22 $
11:21:22 $
11:21:31 $ plutil -p Library/Preferences/eu.naunet.portal.plist
"lastTenant" => "tenant_88"
"refreshToken" => "<redacted 214 bytes>"
"analyticsOptOut" => 0
[warn] refresh token stored in NSUserDefaults instead of the keychain
[evidence] file=ev-ios-007, severity=medium, owner=mobile
11:21:58 $ sqlite3 Cache.db 'select request_key from cfurl_cache_response limit 4'
https://api.naunet.eu/v1/projects?tenant=tenant_88
https://api.naunet.eu/v1/accounts/self
https://api.naunet.eu/v1/exports/8f2c41
https://files.naunet.eu/d/8f2c41
[note] authenticated responses cached on disk, review cache policy
11:22:26 $ objection -g eu.naunet.portal run ios keychain dump
Account Service Accessible Data
test.qa@naunet.eu eu.naunet.portal.auth WhenUnlocked <redacted>
device-id eu.naunet.portal.dev AfterFirstUnlockThisDeviceOnly <redacted>
[warn] auth item is not ThisDeviceOnly, so it migrates through backups
[scope] lab test account only, no client credential material retained
11:22:54 $ frida -U -l pinning-check.js -f eu.naunet.portal
[+] SecTrustEvaluateWithError hooked
[+] Certificate pinning active: rejected mitm chain (leaf sha256 mismatch)
[+] Pin set: 2 SPKI hashes, backup pin present
[ok] pinning implemented correctly, bypass required a jailbroken device
11:23:06 $
11:23:06 $
11:23:19 $ objection -g eu.naunet.portal run ios sslpinning disable
(agent) Custom SSL pinning bypass hooked, 4 methods patched
(agent) Proxy traffic now visible in mitmproxy on 10.60.0.31:8080
[ok] traffic captured with an on-device bypass, expected for this test class
11:23:47 $ frida -U -l jailbreak-detect.js eu.naunet.portal
[+] No calls to stat(/Applications/Cydia.app), fork() or dyld image checks
[+] No integrity, debugger or Frida detection observed
[warn] app runs unmodified on a jailbroken device, no tamper signal
[evidence] trace=ev-ios-011, severity=low, owner=mobile
11:24:12 $ plutil -p Info.plist | grep -A3 CFBundleURLSchemes
"CFBundleURLSchemes" => [
0 => "naunetportal"
]
"NSUserActivityTypes" => ["eu.naunet.portal.openProject"]
[note] deep link naunetportal://project?id= accepts unvalidated identifiers
11:24:38 $ ls -1sh Library/Caches/Snapshots/downscaled
184K UIApplicationAutomaticSnapshotDefault-Portrait.ktx
[warn] backgrounding snapshot retains the project list in cleartext
11:24:51 $
11:24:51 $
11:25:02 $ objection -g eu.naunet.portal run ios pasteboard monitor
[pasteboard] no sensitive value copied during a 90 second session
[ok] pasteboard hygiene acceptable, no clipboard leak observed
11:25:29 $ mobsf-cli scan NaunetPortal.ipa --static-only
[MobSF] binary analysis, plist review and secret scan complete
[MobSF] security score 68/100, 2 medium, 3 low, 0 high
[MobSF] hardcoded string matches=1 (analytics key, non-sensitive)
[ok] static findings match the manual review, no additional criticals
11:25:58 $ summarize mobile findings
1 refresh token in NSUserDefaults severity=medium ev-ios-007
2 ATS exception with TLS 1.0 and cleartext severity=medium ev-ios-004
3 no jailbreak or tamper detection severity=low ev-ios-011
4 backgrounding snapshot retains data severity=low ev-ios-014
[ok] findings=4, high=0, medium=2, low=2, informational=5
11:26:24 $ generate mobile narrative for NAU-1187
rendering report NAU-1187-ios-portal.md (7 sections, 4 findings, 5 notes)
manifest sha256 7d19...b402 appended to /srv/evidence/NAU-1187/manifest.txt
[complete] mobile phase closed, decrypted binary and traces sealed
11:26:51 $ objection -g eu.naunet.portal run ios sslpinning enable
(agent) pinning hooks removed, original SecTrust behaviour restored
[ok] device restored to pre-test state, mitmproxy CA profile removed
11:27:08 $ idevicediagnostics shutdown
[ 0.000000] com.apple.SpringBoard[54]: shutdown requested by lockdownd
[ 0.011882] launchd[1]: Stopping com.apple.mobile.lockdown ...
[ 0.018440] dropbear[189]: exiting on SIGTERM, 1 tunnel closed
[ 0.024117] frida-server[311]: received SIGTERM, detaching 1 session
[ 0.031004] launchd[1]: Sending SIGTERM to remaining jobs (74)
[ 0.038774] AppleKeyStore: sealing keybag, class keys evicted
[ 0.044119] apfs_vfsop_sync: disk0s1s2 flushed, 41 dirty nodes written
[ 0.051663] apfs_vfsop_unmount: disk0s1s2 (Data role) unmounted
[ 0.058228] apfs_vfsop_unmount: disk0s1s1 (System role) unmounted
[ 0.064441] AppleANS3NVMeController: shutdown complete, cache flushed
[ 0.071118] AppleSEPManager: SEPOS power gate, mailbox drained
[ 0.078002] AppleARMPlatform: platform power off requested
[ ***.******] AppleSmartIO2: PMU power down, wake reason cleared
[ ***.******] Darwin: system halted
[ok] lab device 04 powered off, jailbreak is tethered so state is clean
[observe] holding for next window, cursor=ios-lab-04
[ 0.000000] Linux version 6.19.2-kali1-amd64 (devel@kali.org) (gcc-15 (Debian 15.1.0-4) 15.1.0) #1 SMP PREEMPT_DYNAMIC Kali 6.19.2-1kali1 (2026-08-11)
[ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.19.2-kali1-amd64 root=/dev/mapper/kali--vg-root ro console=tty1 systemd.show_status=1
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ffff] usable
[ 0.000000] BIOS-e820: [mem 0x000000006f000000-0x000000007fffffff] reserved
[ 0.000000] efi: EFI v2.9 by LENOVO, secureboot=disabled, setup-mode=user
[ 0.000000] DMI: LENOVO 21F8CTO1WW/21F8CTO1WW, BIOS N3JET32W (1.16) 03/12/2026
[ 0.002114] smpboot: CPU0: AMD Ryzen 7 PRO 7840U w/ Radeon 780M Graphics (16 threads)
[ 0.008440] Memory: 32418116K/33554432K available (16384K kernel code, 2764K rwdata)
[ 0.014002] Spectre V2 : Mitigation: Enhanced / Automatic IBRS
[ 0.014003] Speculative Return Stack Overflow: Mitigation: Safe RET
[ 0.021774] x86/fpu: Supporting XSAVE feature 0x200: 'Protection Keys User registers'
[ 0.028119] ACPI: PM: Registering ACPI NVS region [mem 0x6f7fe000-0x6f7fffff]
[ 0.036663] nvme nvme0: pci function 0000:01:00.0, 8 io queues, mq
[ 0.041228] nvme0n1: p1 p2 p3
[ 0.048440] amdgpu 0000:c1:00.0: [drm] Fetched VBIOS from VFCT, kernel modesetting enabled
[ 0.055117] iwlwifi 0000:c2:00.0: loaded firmware version 92.a5cbfba2.0 be200-92.ucode
[ 0.061882] Bluetooth: hci0: AMD BT firmware revision 0x1102, patch loaded
[ 0.068004] thunderbolt 0000:c4:00.5: USB4 host router, 2 ports, DP tunnelling ok
[ 0.074441] device-mapper: ioctl: 4.51.0-ioctl (2026-05-19) initialised
[ 0.082118] EXT4-fs (dm-1): mounted filesystem 21d7c9a4-6b3e-42f8-b0a5-3ce1447fd902 r/w
[ 0.089774] systemd[1]: systemd 258.2-2 running in system mode (+PAM +AUDIT +APPARMOR)
[ 0.090004] systemd[1]: Detected architecture x86-64 on bare metal.
[ 0.096441] systemd[1]: Hostname set to <naunet-kali>.
Please unlock disk nvme0n1p3_crypt: ********
[ OK ] Finished Cryptography Setup for nvme0n1p3_crypt.
[ OK ] Reached target Local Encrypted Volumes.
[ OK ] Started Journal Service.
[ OK ] Started AppArmor initialization.
[ OK ] Mounted /boot/efi.
[ OK ] Activated swap /dev/mapper/kali--vg-swap.
[ OK ] Started TLP system startup/shutdown.
[ OK ] Started NetworkManager.service.
[ OK ] Started ModemManager.service.
[ OK ] Started Bluetooth service.
[ OK ] Started PostgreSQL 17 database server.
[ OK ] Started OpenBSD Secure Shell server.
[ OK ] Started Engagement evidence vault (evidence-vault.service).
[ OK ] Started Scope guard (roe-guard.service).
[ OK ] Reached target Multi-User System.
[ OK ] Started GNOME Display Manager.
[ OK ] Reached target Graphical Interface.
Kali GNU/Linux Rolling naunet-kali tty1
naunet-kali login: analyst
Password:
Linux naunet-kali 6.19.2-kali1-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.19.2-1kali1 x86_64
The programs included with the Kali GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Sep 9 08:41:22 2026 on tty1
┌──(analyst㉿naunet-kali)-[~]
└─$ engagement shell
[roe-guard] rules of engagement NAU-1187 loaded, scope=app-portal, ad-assessment
[roe-guard] evidence vault mounted at /srv/evidence/NAU-1187 (186 items)
11:31:04 $ engagement open --scope app-portal --mode read-only
engagement NAU-1187 resumed by analyst at 2026-09-09T11:31:04+02:00
phase app-portal opened, evidence vault /srv/evidence/NAU-1187 (186 items)
[info] target=portal.naunet.eu, source=194.42.299.80, roe=NAU-1187
11:31:06 $ dig +short portal.naunet.eu api.naunet.eu files.naunet.eu
edge.naunet.eu.
194.42.299.37
194.42.299.37
194.42.299.37
[dns] portal, api, files, status, support, ttl=300
11:31:09 $ openssl s_client -connect portal.naunet.eu:443 -servername portal.naunet.eu
subject=CN=naunet.eu
issuer=C=US, O=Let's Encrypt, CN=R11
Verify return code: 0 (ok)
DNS:naunet.eu, DNS:portal.naunet.eu, DNS:api.naunet.eu, DNS:files.naunet.eu
[ok] certificate coverage matches published hostnames
11:31:12 $ testssl --fast --protocols --alpn portal.naunet.eu
TLS 1.2 offered (OK)
TLS 1.3 offered with final (OK): TLS_AES_256_GCM_SHA384
ALPN/HTTP2 h2, http/1.1 (offered)
Session renegotiation not vulnerable (OK)
[ok] TLS 1.3 preferred, ALPN=h2, renegotiation=disabled
11:31:15 $ curl -sSI https://portal.naunet.eu
HTTP/2 200
cache-control: private, max-age=0
vary: accept-encoding, cookie
etag: W/"4c9d0e77-2f11"
[http] 200 OK, cache-control=private, vary=accept-encoding
[note] cache key review recommended for authenticated paths
11:31:19 $ whatweb -a 1 https://portal.naunet.eu
https://portal.naunet.eu [200 OK] HTTPS, Strict-Transport-Security, Cookies[nau_sess]
[info] server marker absent, powered-by marker absent
11:31:22 $ hakrawler -url https://portal.naunet.eu -depth 1
https://portal.naunet.eu/
https://portal.naunet.eu/account
https://portal.naunet.eu/projects
https://portal.naunet.eu/support
https://portal.naunet.eu/docs
https://portal.naunet.eu/logout
[route] /, /account, /projects, /support, /docs, /logout
[blocked] account routes redirect without a session
11:31:26 $ curl -sS https://portal.naunet.eu/login
<input type="hidden" name="csrf_token" value="<redacted>">
<input type="password" name="password" autocomplete="current-password">
sec-fetch-site check: enforced (cross-site POST rejected with 403)
[html] csrf-token=present, origin-check=enabled, autocomplete=password
[ok] invalid-user and invalid-password responses are uniform
11:31:30 $ measure login rate policy over 40 sequential attempts
attempts 1-30 401 unauthorized mean 214ms
attempts 31-40 429 too many requests retry-after: 12, 18, 27, 41 (progressive)
[ok] limit=30, window=60s, backoff=progressive
11:31:32 $
11:31:32 $
11:31:34 $ curl -sS -d 'email=<redacted>' https://portal.naunet.eu/recover
{"status":"sent","message":"If an account exists, a reset link has been sent."}
known-account 342ms / unknown-account 351ms / token reuse -> 410 gone
[ok] generic response, single-use token policy observed
[note] delivery timing should remain consistent across account states
11:31:38 $ review published documentation and security.txt
Contact: mailto:security@naunet.eu
Expires: 2027-01-31T23:59:00+01:00
Preferred-Languages: en, hu, de
[docs] security contact published, API reference requires authentication
11:31:41 $ curl -sS https://portal.naunet.eu/assets/manifest.json
{"main":"portal.9d41c7b2.js","vendor":"vendor.2b8e11df.js","css":"portal.71ae3f08.css"}
GET /assets/portal.9d41c7b2.js.map -> 404 not found
[asset] hashed bundles, source maps=not exposed, debug=false
11:31:45 $ compare portal build with status.naunet.eu banner
portal build=4.9.1 commit=9d41c7b deployed=2026-09-08T21:14Z
status build=4.9.0 commit=2b8e11d published=2026-08-27T09:02Z
[warn] status page trails application by one release
11:31:49 $ curl -sSI https://files.naunet.eu/d/8f2c41
HTTP/2 200
content-disposition: attachment; filename="export-2026-09-09.csv"
content-type: application/octet-stream
x-amz-meta-origin: prj_2041/tenant_88/export-worker-04
[http] content-disposition=attachment, filename=redacted, type=application/octet-stream
[note] attachment metadata should not disclose internal naming
11:31:50 $
11:31:50 $
11:31:53 $ curl -sS https://files.naunet.eu/
{"error":"access_denied","message":"listing is not enabled for this bucket"}
GET /d/8f2c41?signature=<expired> -> 403 signature expired
[ok] listing disabled, object access requires scoped signature
11:31:56 $
11:31:56 $
11:31:57 $ curl -sS https://api.naunet.eu/versions
{"current":"v1","advertised":["v1","v2"],"deprecated":["v0"],"sunset":"2026-03-31"}
GET /v0/projects -> 410 gone, link: <https://docs.naunet.eu/migrate/v1>; rel="deprecation"
[api] v1 active, v2 advertised, deprecated=v0
[ok] deprecated route returns 410, migration link present
11:32:01 $ curl -sS 'https://api.naunet.eu/v1/projects?limit=5000'
{"error":"invalid_parameter","parameter":"limit","max":200}
{"data":[],"next_cursor":"eyJvZmZzZXQiOjIwMH0","has_more":true}
[ok] cursor-based pagination, maximum page size enforced
11:32:05 $ replay signed webhook delivery against the test receiver
first delivery 202 accepted x-nau-signature=sha256=<redacted> t=1788953533
replay t+310s 401 rejected reason=timestamp_outside_window
tampered body 401 rejected reason=signature_mismatch
[hook] signed request, replay window=300s, retries=bounded
11:32:07 $
11:32:07 $
11:32:09 $ curl -sS https://api.naunet.eu/v1/projects
{"error":"tenant_required","message":"X-Tenant header missing","request_id":"c7f30a12"}
[blocked] tenant identifier required, anonymous access denied
[evidence] response=ev-0132, request=tr-0088
11:32:13 $ curl -sSI https://portal.naunet.eu/logout
HTTP/2 204
set-cookie: nau_sess=; Path=/; Max-Age=0; Secure; HttpOnly
GET /api/v1/accounts/self (old bearer) -> 401 token_revoked
[ok] browser session revoked, API token invalidated
11:32:16 $
11:32:16 $
11:32:17 $ curl -sSI https://portal.naunet.eu/debug
HTTP/2 403
content-length: 0
[blocked] 403 forbidden, response body minimized
11:32:21 $ curl -sS 'https://portal.naunet.eu/%2e%2e%2f'
HTTP/2 400
<html><head><title>Whitelabel Error Page</title></head><body>
<div>There was an unexpected error (type=Bad Request, status=400).</div>
[warn] malformed path returns framework marker, reduce response detail
11:32:25 $ correlate x-request-id across gateway and application logs
gateway 11:32:21.184 req=c7f30a12 status=400 upstream=portal-web-02
app 11:32:21.191 req=c7f30a12 status=400 handler=fallback
[ok] request id stable across gateway and application logs
11:32:29 $ confirm denied requests reached the SIEM pipeline
query: source IN (edge-gateway, portal-web) status IN (400,401,403) window=15m
hits: 63 matched by request id: 63/63 alert rule: PORTAL-DENY-BURST (>50/5m)
[ok] denied request retained, alert threshold configured
11:32:33 $ curl -sS https://naunet.eu/.well-known/security.txt
Contact: mailto:security@naunet.eu
Policy: https://naunet.eu/security/disclosure
Canonical: https://naunet.eu/.well-known/security.txt
[ok] security contact published, abuse channel monitored
11:32:37 $ curl -sS https://status.naunet.eu/backup
{"backup":"nightly","last_run":"2026-09-09T02:00:00Z","restore_test":null}
[status] restore-test=not-public, backup-owner=platform
11:32:41 $ curl -sS https://api.naunet.eu/v1/accounts/self
{"error":"unauthorized","message":"authentication required","request_id":"1d80b4ff"}
[blocked] anonymous request denied, principal=none
11:32:43 $
11:32:43 $
11:32:45 $ measure response timing variance over 200 requests
anonymous n=100 p50 198ms p95 241ms
authenticated n=100 p50 216ms p95 268ms
delta p50 +18ms (login enumeration risk: none observed)
[note] authenticated and anonymous paths differ by 18ms
11:32:49 $ score observation confidence
evidence items 42 corroborated 40 single-source 2 contradictions 0
[ok] confidence=high, evidence=42 items, unresolved=2
11:32:53 $ prepare remediation summary
1 cache-key review on authenticated paths owner=platform effort=M
2 normalize framework error fallback owner=application effort=S
3 strip attachment metadata on export owner=platform effort=S
[plan] owner=platform, target=next-release, review=security
11:32:57 $ engagement close --phase app-portal
phase app-portal closed, 207 evidence items sealed, sha256 manifest updated
[complete] portal review closed, no state changes on client systems
[observe] holding for next window, cursor=91ca44e2
11:45:53 $ engagement open --scope ad-assessment --mode audit
phase ad-assessment opened, mandate=audit (read-only directory queries)
[roe-guard] credential extraction and remote execution refused in this mode
[info] domain=corp.naunet.eu, dc=10.60.4.11, evidence mode=redacted
11:45:57 $ bloodhound-python -d corp.naunet.eu -c DCOnly --zip
INFO: Found AD domain: corp.naunet.eu
INFO: Connecting to LDAP server: dc01.corp.naunet.eu
INFO: Found 1284 objects, 41 computers, 96 groups, 812 users
INFO: Compressing output into 20260909114557_bloodhound.zip
INFO: Done in 00M 04S
[bloodhound] 1284 objects collected, groups=96, computers=41
[bloodhound] shortest privilege paths=4, verified paths=0, evidence=partial
11:46:02 $ ldapsearch -x -H ldap://10.60.4.11 -b '' -s base
namingContexts: DC=corp,DC=naunet,DC=eu
namingContexts: CN=Configuration,DC=corp,DC=naunet,DC=eu
supportedSASLMechanisms: GSSAPI, GSS-SPNEGO, NTLM
result: 0 Success
ldap_bind: Inappropriate authentication (48) - anonymous bind disabled
[ldapsearch] naming context observed, anonymous bind=blocked
[ldapsearch] groups=redacted, nested-membership review=queued
11:46:07 $ netexec smb hosts-inscope.txt --gen-relay-list relay.txt
SMB 10.60.4.11 445 DC01 [*] Windows Server 2022 (signing:True) (SMBv1:False)
SMB 10.60.4.21 445 APP01 [*] Windows Server 2022 (signing:True) (SMBv1:False)
SMB 10.60.9.117 445 WS-117 [*] Windows 11 26100 (signing:False) (SMBv1:False)
SMB 10.60.9.142 445 WS-142 [*] Windows 11 26100 (signing:False) (SMBv1:False)
[netexec] 41 hosts reachable, SMB signing=required on 39
[netexec] 2 hosts pending owner confirmation before follow-up
11:46:12 $ impacket-lookupsid auditor@corp.naunet.eu -domain-sids
[*] Brute forcing SIDs at corp.naunet.eu
[*] Domain SID is: S-1-5-21-3702018092-1447661009-2318844173
[*] 2 domain SIDs resolved, enumeration stopped at audit limit
[impacket] domain SID resolved, session validation only
[blocked] lateral movement outside the agreed audit scope
11:46:16 $
11:46:16 $
11:46:17 $ rubeus triage /nowrap
LUID UserName Service EndTime
0x3e4 APP01$@CORP.NAUNET.EU krbtgt/CORP.NAUNET.EU 09/09/2026 20:41:12
0x8a19c svc_report@CORP.NAU.. ldap/dc01.corp.naun.. 09/09/2026 20:44:03
[rubeus] ticket metadata reviewed, ticket material retained by client
[rubeus] delegation candidates=2, unconstrained delegation=not observed
11:46:18 $
11:46:18 $
11:46:22 $ certipy find -u auditor@corp.naunet.eu -dc-ip 10.60.4.11
[*] Finding certificate templates
[*] Found 11 certificate templates, 2 enabled on CORP-CA01
[!] Template 'CorpWebServerLegacy': enrollee supplies subject, manager approval disabled
[*] Saved text output to '20260909114622_Certipy.txt'
[certipy] 11 templates enumerated, enrollment rights=redacted
[warn] one template requires an owner and purpose review
11:46:27 $ credential handling checkpoint
[roe-guard] requested capability: credential extraction -> refused (mode=audit)
mandate NAU-1187 phase 3 requires written client sign-off before this step
[scope] credential extraction deferred to phase 3 with client sign-off
[scope] no hash or ticket material present in this evidence set
11:46:28 $
11:46:28 $
11:46:32 $ review token and integrity levels on audit workstation
whoami /groups Mandatory Label\Medium Mandatory Level (integrity: medium)
whoami /priv SeChangeNotifyPrivilege Enabled
SeIncreaseWorkingSetPrivilege Disabled
[token] integrity levels observed, local admin context=not provided
[token] privileged token duplication out of scope for this phase
11:46:37 $ netexec smb hosts-inscope.txt -M enum_local_admins
ENUM_LOCAL_ADMINS 10.60.4.21 APP01 CORP\Domain Admins, CORP\svc_deploy
ENUM_LOCAL_ADMINS 10.60.9.117 WS-117 CORP\Workstation Admins, CORP\j.kovacs
ENUM_LOCAL_ADMINS 10.60.9.142 WS-142 CORP\Workstation Admins, CORP\<redacted>
[ad] local administrators=redacted, stale membership candidates=3
[note] validate ownership before removing any membership
11:46:39 $
11:46:39 $
11:46:42 $ nltest /domain_trusts /all_trusts
List of domain trusts:
0: CORP corp.naunet.eu (NT 5) (Forest Tree Root) (Primary Domain) (Native)
1: LEGACY legacy.corp.naunet.eu (NT 5) (Direct Outbound) (Native)
The command completed successfully
[ad] trusts=2, directionality=redacted, external trust review=required
[blocked] trust traversal held for the client-approved follow-up
11:46:47 $ Get-GPOReport -All -ReportType Xml -Path gpo-NAU-1187.xml
Wrote report for 24 GPOs to gpo-NAU-1187.xml (1.42 MB)
Legacy reference found: \\corp.naunet.eu\SYSVOL\scripts\map-drives-2019.vbs
[gpo] policy links=redacted, privileged script paths=not collected
[warn] one legacy policy reference requires ownership confirmation
11:46:51 $
11:46:51 $
11:46:52 $ adcheck acl --object-type user,group,gpo
OBJECT PRINCIPAL RIGHT SOURCE
CN=Workstation Admins CORP\svc_report WriteMembers inherited
CN=Default Domain Policy CORP\Legacy Operators WriteDacl explicit
[acl] directory object permissions compared, write-capable paths=2
[evidence] path=ev-ad-008, severity=medium, remediation=review
11:46:57 $ persistence checkpoint
scheduled tasks created 0 services created 0 run keys touched 0
host state hash matches pre-engagement baseline (41/41 sampled hosts)
[audit] scheduled tasks, services, startup entries=not modified
[complete] audit-only mandate held, host state unchanged
11:47:02 $ lateral movement checkpoint
SMB reachable 41 sessions created 0
WinRM reachable 38 sessions created 0
RDP reachable 12 sessions created 0
[audit] SMB, WinRM and RDP paths reviewed as evidence only
[blocked] no remote sessions created, no commands executed on endpoints
11:47:07 $ privilege escalation summary
path 1 svc_report -> Workstation Admins -> WS-117 status=review
path 2 Legacy Operators -> Default Domain Policy status=review
[ad] verified escalation paths=0, review paths=6, credentials=none
[note] graph findings require domain-owner validation before remediation
11:47:12 $ generate AD narrative for NAU-1187
rendering report NAU-1187-ad-assessment.md (9 sections, 4 findings, 6 review paths)
manifest sha256 c04f...91d3 written to /srv/evidence/NAU-1187/manifest.txt
[report] directory exposure and privilege paths mapped, no exploitation
[complete] audit phase closed, findings queued for domain-owner review
[observe] holding for next window, cursor=6d3be5a1
11:47:26 $ engagement close --all
NAU-1187 closed: 4 phases, 207 evidence items, 14 findings, manifest signed
[complete] report bundle queued for client delivery, transfer=out-of-hours
11:47:33 $ exit
[roe-guard] engagement shell closed, scope NAU-1187 released
┌──(analyst㉿naunet-kali)-[~]
└─$ sudo systemctl poweroff
Broadcast message from root@naunet-kali on tty1 (Wed Sep 9 11:47:38 2026):
The system will power off now!
[ OK ] Stopped target Graphical Interface.
Stopping GNOME Display Manager...
[ OK ] Stopped GNOME Display Manager.
[ OK ] Stopped target Multi-User System.
Stopping PostgreSQL 17 database server...
Stopping Engagement evidence vault (evidence-vault.service)...
[ OK ] Stopped PostgreSQL 17 database server.
[ OK ] Stopped Engagement evidence vault (evidence-vault.service).
[ OK ] Stopped Scope guard (roe-guard.service).
[ OK ] Stopped OpenBSD Secure Shell server.
[ OK ] Stopped Bluetooth service.
[ OK ] Stopped ModemManager.service.
[ OK ] Stopped NetworkManager.service.
[ OK ] Stopped TLP system startup/shutdown.
[ OK ] Stopped target Basic System.
[ OK ] Unmounted /boot/efi.
[ OK ] Deactivated swap /dev/mapper/kali--vg-swap.
[ OK ] Reached target Unmount All Filesystems.
[ OK ] Stopped Cryptography Setup for nvme0n1p3_crypt.
[ OK ] Stopped target Local Encrypted Volumes.
[ OK ] Reached target Late Shutdown Services.
[ OK ] Finished System Power Off.
[ OK ] Reached target System Power Off.
[ 1081.114882] systemd-journald[402]: Received SIGTERM from PID 1 (systemd-shutdow).
[ 1081.208447] systemd-shutdown[1]: Syncing filesystems and block devices.
[ 1081.241118] systemd-shutdown[1]: Sending SIGTERM to remaining processes...
[ 1081.318774] systemd-shutdown[1]: Sending SIGKILL to remaining processes...
[ 1081.344002] systemd-shutdown[1]: Unmounting file systems.
[ 1081.361441] systemd-shutdown[1]: Unmounting /boot/efi.
[ 1081.378119] systemd-shutdown[1]: Remounting '/' read-only.
[ 1081.394663] systemd-shutdown[1]: All filesystems unmounted.
[ 1081.408228] systemd-shutdown[1]: Deactivating swaps.
[ 1081.416001] systemd-shutdown[1]: All swaps deactivated.
[ 1081.423918] systemd-shutdown[1]: Detaching loop devices.
[ 1081.431227] systemd-shutdown[1]: All loop devices detached.
[ 1081.438774] systemd-shutdown[1]: Stopping MD devices.
[ 1081.446119] systemd-shutdown[1]: Detaching DM devices.
[ 1081.461408] systemd-shutdown[1]: Detaching DM /dev/dm-2 (253:2).
[ 1081.486550] systemd-shutdown[1]: Not all DM devices detached, 2 left.
[ 1081.502118] systemd-shutdown[1]: Failed to finalize DM devices, ignoring.
[ 1081.518774] systemd-shutdown[1]: Powering off.
[ ***.******] amdgpu 0000:c1:00.0: amdgpu: MODE1 reset skipped on shutdown
[ ***.******] ACPI: PM: Preparing to enter system sleep state S5
[ ***.******] reboot: Power down
=== ===
******
******
******
****** ******
****** ******
****** ******
****** ****** ******
****** ****** ******
****** ****** ******
=== ===
[ 0.000000] Linux version 6.12.43-amd64 (debian-kernel@lists.debian.org) (gcc-14 (Debian 14.2.0-19) 14.2.0) #1 SMP PREEMPT_DYNAMIC Debian 6.12.43-1 (2026-07-22)
[ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.12.43-amd64 root=/dev/mapper/ops--vg-root ro console=ttyS0,115200 systemd.show_status=1
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] SMBIOS 3.1.0 present.
[ 0.000000] DMI: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2
[ 0.003914] CPU0: AMD EPYC 7443P 24-Core Processor (family: 0x19, model: 0x1)
[ 0.011286] Memory: 16058548K/16777088K available (14336K kernel code, 2298K rwdata)
[ 0.019740] smpboot: Allowing 8 CPUs, 0 hotplug CPUs
[ 0.024118] Spectre V2 : Mitigation: Retpolines
[ 0.024119] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled
[ 0.038002] ACPI: Added _OSI(Module Device)
[ 0.052663] pci 0000:00:1f.2: reg 0x24: [mem 0xfebf0000-0xfebf1fff]
[ 0.061450] virtio_blk virtio2: [vda] 209715200 512-byte logical blocks (107 GB/100 GiB)
[ 0.070118] e1000e 0000:00:03.0 eth0: (PCI Express:2.5GT/s:Width x1) 52:54:00:9a:3f:1c
[ 0.078233] device-mapper: uevent: version 1.0.3
[ 0.078561] device-mapper: ioctl: 4.49.0-ioctl (2025-02-28) initialised
[ 0.094017] EXT4-fs (dm-0): mounted filesystem 8f3c1d22-4e07-4b19-9a55-c1de7f3a6b40 r/w
[ 0.101882] systemd[1]: systemd 257.4-1 running in system mode (+PAM +AUDIT +SELINUX)
[ 0.102004] systemd[1]: Detected virtualization kvm.
[ 0.102005] systemd[1]: Detected architecture x86-64.
[ 0.118440] systemd[1]: Hostname set to <naunet-ops1>.
[ OK ] Created slice Slice /system/systemd-cryptsetup.
[ OK ] Reached target Local Encrypted Volumes.
[ OK ] Started Journal Service.
[ OK ] Activated swap /dev/mapper/ops--vg-swap.
[ OK ] Mounted /boot.
[ OK ] Started Load AppArmor profiles.
[ OK ] Started nftables Firewall.
[ OK ] Started Network Time Synchronization.
[ OK ] Started systemd-networkd.service.
Starting Wait for Network to be Configured...
[ OK ] Finished Wait for Network to be Configured.
[ OK ] Started OpenBSD Secure Shell server.
[ OK ] Started Engagement evidence vault (evidence-vault.service).
[ OK ] Started Scope guard (roe-guard.service).
[ OK ] Reached target Multi-User System.
[ OK ] Reached target Graphical Interface.
Debian GNU/Linux 13 naunet-ops1 ttyS0
naunet-ops1 login: analyst
Password:
Linux naunet-ops1 6.12.43-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.43-1 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Sep 9 09:58:12 2026 from 10.60.0.14
analyst@naunet-ops1:~$ engagement shell
[roe-guard] rules of engagement NAU-1187 loaded, scope=ext-perimeter
[roe-guard] out-of-scope destinations will be refused at the proxy
10:41:57 $ uname -sr
Linux 6.12.43-amd64
10:41:59 $ ip -brief addr show eth0
eth0 UP 10.60.0.31/24 fe80::5054:ff:fe9a:3f1c/64
10:42:01 $ engagement open --scope ext-perimeter --mode read-only
engagement NAU-1187 opened by analyst at 2026-09-09T10:42:01+02:00
evidence vault ready: /srv/evidence/NAU-1187 (append-only, 0 items)
[info] scope confirmed, naunet.eu, region=eu-central, roe=NAU-1187
10:42:03 $ dig +noall +answer naunet.eu A naunet.eu AAAA
naunet.eu. 300 IN A 194.42.299.37
naunet.eu. 300 IN AAAA fd00:4f8:1c1e:5a2b::17
[ok] A 194.42.299.37, AAAA fd00:4f8:1c1e:5a2b::17, ttl=300
10:42:05 $ dig NS naunet.eu +dnssec
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
naunet.eu. 3600 IN NS ns1.naunet.eu.
naunet.eu. 3600 IN NS ns2.naunet.eu.
naunet.eu. 3600 IN RRSIG NS 13 2 3600 20260921 34505 naunet.eu. Yk3pQd8=
;; Query time: 24 msec
[info] ns1.naunet.eu, ns2.naunet.eu, dnssec=enabled
10:42:08 $ openssl s_client -connect naunet.eu:443 </dev/null | openssl x509 -noout -ext subjectAltName
X509v3 Subject Alternative Name:
DNS:naunet.eu, DNS:api.naunet.eu, DNS:portal.naunet.eu, DNS:mail.naunet.eu
notAfter=Nov 26 08:14:33 2026 GMT
[ok] api.naunet.eu, portal.naunet.eu, mail.naunet.eu
10:42:11 $ testssl --fast --protocols --headers naunet.eu
SSLv2 not offered (OK)
SSLv3 not offered (OK)
TLS 1 not offered
TLS 1.1 not offered
TLS 1.2 offered (OK)
TLS 1.3 offered with final (OK): TLS_AES_256_GCM_SHA384
HSTS max-age=31536000; includeSubDomains
Done 2026-09-09 10:42:12 [ 1s] -->> 194.42.299.37:443 (naunet.eu) <<--
[ok] TLS 1.2 and TLS 1.3, hsts=present, weak-cipher=none
10:42:13 $
10:42:13 $
10:42:14 $ curl -sSI https://naunet.eu
HTTP/2 200
server: edge-gateway/2.9.4
content-type: text/html; charset=utf-8
content-length: 8421
cache-control: private, no-store
strict-transport-security: max-age=31536000; includeSubDomains
[http] 200 OK, server=edge-gateway/2.9.4, cache=private, length=8421
[note] server banner exposes build number, raise as hygiene item
10:42:18 $ nmap -Pn -T4 -p 22,80,443,8443 194.42.299.37
Starting Nmap 7.98 ( https://nmap.org ) at 2026-09-09 10:42 CEST
Nmap scan report for naunet.eu (194.42.299.37)
Host is up (0.018s latency).
PORT STATE SERVICE
22/tcp filtered ssh
80/tcp open http
443/tcp open https
8443/tcp open https-alt
Nmap done: 1 IP address (1 host up) scanned in 1.42 seconds
[tcp] 22 filtered, 80 redirect, 443 open, 8443 open
[ok] perimeter responses recorded, evidence bundle ev-0012
10:42:19 $
10:42:19 $
10:42:22 $ curl -sSI https://naunet.eu:8443
HTTP/1.1 200 OK
server: jetty/12.0.18
x-debug-node: app-edge-03
cache-control: no-cache
[warn] alternate service returns a different header set than 443
[evidence] screenshot=ev-0017, request=tr-0021
10:42:29 $ curl -sS https://naunet.eu/status
{"status":"healthy","version":"4.9.1","region":"eu-central","uptime":"37d"}
[ok] 200 OK, status=healthy, version=4.9.1
[note] version field should be dropped from public responses
10:42:37 $ curl -sSI https://portal.naunet.eu/login
HTTP/2 200
set-cookie: nau_sess=<redacted>; Path=/; Secure; HttpOnly; SameSite=Lax
content-security-policy: default-src 'self'; frame-ancestors 'none'
[ok] secure=present, httponly=present, samesite=lax
10:42:40 $ httpx -path-list roe-approved.txt -status-code -silent
https://naunet.eu/ [200]
https://naunet.eu/login [302]
https://naunet.eu/help [200]
https://naunet.eu/status [200]
https://naunet.eu/assets [403]
https://naunet.eu/api/v1 [401]
https://naunet.eu/portal-old [500]
[route] /, /login, /help, /status, /assets, /api/v1
[note] legacy /portal-old returns a different error template
10:42:48 $ curl -sSI https://api.naunet.eu/v1/ping
HTTP/2 200
x-ratelimit-limit: 60
x-ratelimit-remaining: 59
x-ratelimit-reset: 60
retry-after: 60
[ok] limit=60, window=60s, retry-after=present
10:42:59 $ curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' https://portal.naunet.eu/dashboard
302 https://sso.naunet.eu/authorize?client_id=portal&response_type=code
[blocked] 302 login, body=not disclosed, cache=private
10:43:07 $ curl -sS https://sso.naunet.eu/.well-known/openid-configuration | jq
{
"issuer": "https://sso.naunet.eu",
"authorization_endpoint": "https://sso.naunet.eu/authorize",
"token_endpoint": "https://sso.naunet.eu/token",
"scopes_supported": [
"openid",
"profile"
]
}
[idp] issuer=sso.naunet.eu, discovery=restricted
10:43:11 $
10:43:11 $
10:43:14 $ curl -sS https://api.naunet.eu/v1/accounts
{"error":"unauthorized","message":"authentication required","request_id":"4b91f2c7"}
[blocked] anonymous request denied, principal=none
10:43:15 $
10:43:15 $
10:43:18 $ curl -sS https://api.naunet.eu/v1/orders/0
{"error":"internal_error","correlation":"ord-svc-7/eu-central-1b/txn-88412"}
[warn] route returns internal correlation detail in error body
[evidence] response=ev-0044, severity=low, owner=application
10:43:19 $
10:43:19 $
10:43:26 $ review upload policy with platform team
upload policy v3 (owner: platform, reviewed 2026-06-18)
accepted types: pdf, png, jpeg, csv max size: 25 MiB
content inspection: clamav + type sniffing storage: per-tenant bucket prefix
[ok] type allowlist, size limit, content inspection, storage isolation
10:43:34 $ curl -sSI -H 'Origin: https://naunet.eu' https://api.naunet.eu/v1/ping
access-control-allow-origin: https://naunet.eu
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
vary: Origin
[ok] allowed-origins=3, wildcard=false, credentials=restricted
10:43:42 $ curl -sS https://naunet.eu/assets/manifest.json
{"main":"main.7f31a9c4.js","vendor":"vendor.2b8e11df.js","css":"app.4c9d0e77.css"}
curl -sSI https://naunet.eu/assets/main.7f31a9c4.js.map -> 404
[asset] hashed bundles, source maps=not exposed, debug=false
10:43:50 $ probe cloud metadata boundary via app fetch parameter
request: GET /api/v1/preview?src=<metadata-endpoint>
response: 400 invalid_source (allowlist=https only, internal ranges refused)
[blocked] metadata route unreachable from application edge
10:43:51 $
10:43:51 $
10:43:58 $ curl -sSI https://naunet.eu/debug
HTTP/2 403
content-length: 0
server: edge-gateway/2.9.4
[blocked] 403 forbidden, response body minimized
10:44:01 $
10:44:01 $
10:44:02 $ review audit event shape with platform team
{
"actor": "usr_8813",
"action": "project.update",
"resource": "prj_2041",
"timestamp": "2026-09-09T08:12:44Z",
"correlation_id": "4b91f2c7"
}
[ok] actor, action, resource, timestamp, correlation-id observed
10:44:06 $ compare event timestamps across edge and application logs
edge 2026-09-09T08:12:44.118Z req=4b91f2c7
app 2026-09-09T08:12:46.522Z req=4b91f2c7
delta +2.404s
[note] edge and application clocks differ by 2.4 seconds
10:44:14 $ curl -sS https://status.naunet.eu/backup
{"backup":"scheduled","last_run":"2026-09-09T02:00:00Z","restore_test":null}
[status] backup=scheduled, restore-test=not-public, owner=platform
10:44:21 $
10:44:21 $
10:44:22 $ validate logout behaviour in portal session
POST /logout -> 204, set-cookie: nau_sess=; Max-Age=0
GET /account -> 302 https://sso.naunet.eu/authorize
GET /account (back-navigation, cached) -> 302, no body served from cache
[ok] session revoked, back-navigation returns login
10:44:30 $ curl -sS https://api.naunet.eu/v1/tenants
{"error":"tenant_required","message":"X-Tenant header missing"}
[blocked] tenant identifier required, anonymous access denied
10:44:38 $ curl -sS 'https://naunet.eu/%2e%2e%2f'
HTTP/2 400
<html><head><title>Whitelabel Error Page</title></head><body>
<div>There was an unexpected error (type=Bad Request, status=400).</div>
[warn] malformed path returns framework marker, reduce response detail
10:44:46 $ confirm denied requests reached the SIEM pipeline
query: source=edge-gateway status IN (401,403) window=15m
hits: 41 sampled request ids matched: 41/41 alert rule: EDGE-DENY-BURST (>50/5m)
[ok] denied request retained, alert threshold configured
10:44:54 $ summarize exposed surface
hostnames 4 open ports 3 authenticated surfaces 2 public endpoints 6
[ok] findings=3, high=0, medium=0, low=3, informational=7
10:45:02 $ order remediation by effort
1 reduce-banners owner=platform effort=S ev-0012, ev-0031
2 normalize-errors owner=application effort=M ev-0044
3 align-clock owner=platform effort=S ev-0061
[ok] priority=reduce-banners, normalize-errors, align-clock
10:45:06 $ engagement close --phase read-only
phase read-only closed, 42 evidence items sealed, sha256 manifest written
[complete] read-only pass closed, no state changes on client systems
[observe] holding for next window, cursor=7f2a91c0
10:57:17 $
10:57:17 $
10:58:01 $ sudo nmap -sS -Pn --top-ports 200 --max-rate 150 194.42.299.37
Starting Nmap 7.98 ( https://nmap.org ) at 2026-09-09 10:58 CEST
Nmap scan report for naunet.eu (194.42.299.37)
Host is up (0.018s latency).
Not shown: 196 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp filtered ssh
80/tcp open http
443/tcp open https
8443/tcp open https-alt
Nmap done: 1 IP address (1 host up) scanned in 6.71 seconds
[nmap] host up, latency=18ms, target=194.42.299.37, scanned=200 ports
[nmap] 22/tcp filtered, 80/tcp redirect, 443/tcp open, 8443/tcp open
[nmap] service fingerprints collected, version disclosure=partial
10:58:09 $ nmap -sV -p 443,8443 194.42.299.37
PORT STATE SERVICE VERSION
443/tcp open ssl/https edge-gateway 2.9.4
8443/tcp open ssl/https Jetty 12.0.18
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 4.03 seconds
[nmap] 443=edge-gateway, 8443=alternate-web-service, confidence=high
[note] rate capped at 150 pps for the agreed maintenance window
10:58:14 $ sudo masscan 194.42.299.32/28 -p22,80,443,8443 --rate 150
Starting masscan 1.3.2 (http://bit.ly/14GZzcT)
Scanning 16 hosts [4 ports/host]
Discovered open port 443/tcp on 194.42.299.37
Discovered open port 8443/tcp on 194.42.299.37
Discovered open port 80/tcp on 194.42.299.37
rate: 0.00-kpps, 100.00% done, waiting 3 seconds
[masscan] policy rate cap applied, results consistent with the nmap sweep
[ok] no additional public ports observed in approved scope
10:58:20 $ dig naunet.eu ANY +dnssec @ns1.naunet.eu
naunet.eu. 300 IN A 194.42.299.37
naunet.eu. 300 IN AAAA fd00:4f8:1c1e:5a2b::17
naunet.eu. 3600 IN MX 10 mail.naunet.eu.
naunet.eu. 3600 IN TXT "v=spf1 include:_spf.naunet.eu -all"
stg-portal.naunet.eu. 300 IN A 10.60.12.44
;; Query time: 21 msec
[dig] A, AAAA, CNAME and TXT records compared, dnssec=enabled
[warn] staging naming pattern visible in one non-routable record
10:58:26 $ httpx -l scope-hosts.txt -title -tech-detect -status-code
https://naunet.eu [200] [Naunet] [web-edge,HTTP/2]
https://portal.naunet.eu/login [302] [] [web-edge]
https://api.naunet.eu [401] [] [web-edge]
https://mail.naunet.eu [200] [Webmail] [web-edge]
[httpx] 200 https://naunet.eu, title=Naunet, tech=web-edge
[httpx] 302 https://portal.naunet.eu/login, auth=required
10:58:32 $ curl -sSI https://naunet.eu -o headers-0031.txt
cache-control: private, no-store
content-security-policy: default-src 'self'; frame-ancestors 'none'
referrer-policy: strict-origin-when-cross-origin
x-debug-node: app-edge-03
[curl] cache=private, csp=present, frame-ancestors=deny, referrer=origin
[note] x-debug-node header should be removed from public responses
10:58:35 $
10:58:35 $
10:58:38 $ whatweb -a 1 https://naunet.eu
https://naunet.eu [200 OK] HTTPServer[edge-gateway/2.9.4], UncommonHeaders[x-debug-node], CDN
[whatweb] framework marker=absent, CDN marker=present, confidence=medium
[ok] no source map or debug bundle discovered
10:58:44 $ testssl --fast --protocols --headers naunet.eu
TLS 1.2 offered (OK)
TLS 1.3 offered with final (OK): TLS_AES_256_GCM_SHA384
Chain of trust Ok (R11 -> ISRG Root X1, 3 certificates)
HSTS max-age=31536000; includeSubDomains
Done 2026-09-09 10:58:49 [ 5s] -->> 194.42.299.37:443 (naunet.eu) <<--
[testssl] TLS 1.3 preferred, certificate chain valid, weak protocol=none
[testssl] hsts=max-age=31536000, preload=not assessed
10:58:50 $ nuclei -l scope-hosts.txt -t exposures/ -passive
[INF] Templates loaded for current scan: 118
[INF] Targets loaded for current scan: 4
[INF] Scan completed in 5.2s. 2 matches found.
[nuclei] templates=passive-only, matches=2, severity=informational
[nuclei] active verification deferred to the authenticated phase
10:58:52 $
10:58:52 $
10:58:56 $ nikto -h https://naunet.eu -Tuning b
+ Server: edge-gateway/2.9.4
+ Retrieved x-debug-node header: app-edge-03
+ Server banner discloses a build number, which may aid version matching.
+ 1 host(s) tested
+ End Time: 2026-09-09 10:59:01 (5 seconds)
[nikto] server banner detail noted, default files=not observed
[note] result requires manual confirmation before being raised
10:59:02 $ ffuf -w roe-routes.txt -u https://naunet.eu/FUZZ -t 40 -rate 250
help [Status: 200, Size: 5124, Words: 812, Lines: 143]
status [Status: 200, Size: 74, Words: 3, Lines: 1]
assets [Status: 403, Size: 0, Words: 1, Lines: 1]
portal-old [Status: 301, Size: 0, Words: 1, Lines: 1]
:: Progress: [1200/1200] :: Job [1/1] :: 243 req/sec :: Duration: [0:00:05]
[ffuf] 1200 requests, 200=6, 301=2, 403=3, filtered=1189
[info] candidate routes kept as redacted evidence references
10:59:08 $ feroxbuster -u https://naunet.eu --depth 1 --rate-limit 250
200 GET 143l 812w 5124c https://naunet.eu/help
301 GET 0l 0w 0c https://naunet.eu/portal-old => /login
403 GET 0l 0w 0c https://naunet.eu/assets
[####################] - 5s 1200/1200 0s found:128 errors:0
[feroxbuster] 128 paths mapped, status clusters=3, redirects=2
[blocked] recursive expansion disabled outside approved scope
10:59:14 $ amass intel -passive -d naunet.eu
naunet.eu
api.naunet.eu
portal.naunet.eu
mail.naunet.eu
sso.naunet.eu
status.naunet.eu
files.naunet.eu
[amass] passive names=7, active resolution=disabled, duplicates=2
[ok] asset graph stored without contacting unapproved hosts
10:59:20 $ sslscan --no-colour naunet.eu
TLSv1.3 enabled
TLSv1.2 enabled
TLSv1.1 disabled
Preferred TLSv1.3 256 bits TLS_AES_256_GCM_SHA384
Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256
[sslscan] preferred suites=modern, legacy suite=not offered
[ok] transport evidence linked to ev-0144
10:59:26 $ merge tool output into engagement dataset
reading 6 result sets from /srv/evidence/NAU-1187/raw
normalizing host, port and finding keys ... 144 records
[merge] nmap, masscan, httpx, whatweb, testssl, nuclei
[merge] consistent=11, review=3, conflict=0, confidence=high
10:59:32 $ generate scan narrative for NAU-1187
rendering report NAU-1187-ext-perimeter.md (14 sections, 3 findings, 7 notes)
manifest sha256 a91c...4e7b written to /srv/evidence/NAU-1187/manifest.txt
[report] external surface mapped, three low-risk hygiene items retained
[complete] scan phase closed, findings queued for client review
[observe] holding for next window, cursor=b41c7d09
11:12:04 $ engagement seal --all
sealing 144 evidence items, sha256 manifest signed with key ops1-2026 (ed25519)
[complete] NAU-1187 evidence sealed, vault switched to read-only
11:12:09 $ evidence sync --target vault.naunet.eu --dry-run
[roe-guard] destination vault.naunet.eu allowed by NAU-1187
144 items / 218 MiB queued, 0 conflicts, transfer window=out-of-hours
11:12:14 $ exit
[roe-guard] engagement shell closed, scope NAU-1187 released
analyst@naunet-ops1:~$ sudo systemctl poweroff
Broadcast message from root@naunet-ops1 (ttyS0) (Wed Sep 9 11:12:18 2026):
The system will power off now!
[ OK ] Stopped target Graphical Interface.
[ OK ] Stopped target Multi-User System.
Stopping Engagement evidence vault (evidence-vault.service)...
Stopping OpenBSD Secure Shell server...
Stopping Scope guard (roe-guard.service)...
[ OK ] Stopped Engagement evidence vault (evidence-vault.service).
[ OK ] Stopped Scope guard (roe-guard.service).
[ OK ] Stopped OpenBSD Secure Shell server.
[ OK ] Stopped Network Time Synchronization.
[ OK ] Stopped systemd-networkd.service.
[ OK ] Stopped nftables Firewall.
[ OK ] Stopped Load AppArmor profiles.
[ OK ] Stopped target Basic System.
[ OK ] Stopped target Slice Units.
[ OK ] Unmounted /boot.
[ OK ] Deactivated swap /dev/mapper/ops--vg-swap.
[ OK ] Reached target Unmount All Filesystems.
[ OK ] Stopped target Local Encrypted Volumes.
[ OK ] Reached target Late Shutdown Services.
[ OK ] Finished System Power Off.
[ OK ] Reached target System Power Off.
[ 1841.774218] systemd-journald[318]: Received SIGTERM from PID 1 (systemd-shutdow).
[ 1841.882104] systemd-shutdown[1]: Syncing filesystems and block devices.
[ 1841.913447] systemd-shutdown[1]: Sending SIGTERM to remaining processes...
[ 1842.021118] systemd-shutdown[1]: Sending SIGKILL to remaining processes...
[ 1842.043902] systemd-shutdown[1]: Unmounting file systems.
[ 1842.061774] systemd-shutdown[1]: Unmounting /run/credentials/systemd-journald.service.
[ 1842.078119] systemd-shutdown[1]: Remounting '/' read-only.
[ 1842.104663] systemd-shutdown[1]: All filesystems unmounted.
[ 1842.118240] systemd-shutdown[1]: Deactivating swaps.
[ 1842.126001] systemd-shutdown[1]: All swaps deactivated.
[ 1842.133918] systemd-shutdown[1]: Detaching loop devices.
[ 1842.141227] systemd-shutdown[1]: All loop devices detached.
[ 1842.148774] systemd-shutdown[1]: Stopping MD devices.
[ 1842.156119] systemd-shutdown[1]: Detaching DM devices.
[ 1842.171408] systemd-shutdown[1]: Detaching DM /dev/dm-1 (253:1).
[ 1842.196550] systemd-shutdown[1]: Not all DM devices detached, 1 left.
[ 1842.212118] systemd-shutdown[1]: Failed to finalize DM devices, ignoring.
[ 1842.226774] systemd-shutdown[1]: Powering off.
[ ***.******] watchdog: watchdog0: watchdog did not stop!
[ ***.******] ACPI: PM: Preparing to enter system sleep state S5
[ ***.******] reboot: Power down
11:19:02 $ palera1n -f -B "-v serial=3 keepsyms=1"
palera1n | version 2.1.0, mobile app assessment lab (device 04, asset NAU-LAB-04)
==> Waiting for devices
==> Found DFU Mode device (iPhone10,4)
==> Pwning device
==> Booting PongoOS 2.4.1-checkm8
==> Sending kernel patchfinder, boot-args = -v serial=3 keepsyms=1
=======================================
::
:: iBoot 8419.80.7, Copyright 2007-2024, Apple Inc.
::
:: BUILD_TAG: iBoot-8419.80.7
:: BUILD_STYLE: RELEASE
:: SECURE BOOT: production fused, personalization=local
::
=======================================
[iBoot] platform_init_display: display=D520, 750x1334
[iBoot] usb_dfu: exited, image4 payload accepted (kernelcache 41.2 MiB)
[iBoot] boot-args = -v serial=3 keepsyms=1
[ 0.000000] === Darwin/BSD ===
[ 0.000000] Darwin Kernel Version 22.6.0: xnu-8796.141.3.703.2~1/RELEASE_ARM64_T8015
[ 0.014118] PMAP: PPL enabled, kernel text lockdown complete
[ 0.019447] KTRR: region 0xfffffff007004000-0xfffffff008a3c000 locked
[ 0.024002] ASLR: kernel slot 0x00000000_0f200000
[ 0.031774] AppleARMPlatform::start: T8015 (A11 Bionic), fused=1, production=1
[ 0.038119] AppleSEPManager::start: SEPOS 4.0.0, sepfw personalized, ok
[ 0.044663] AppleKeyStore: starting (aks), keybag=system, locked
[ 0.051228] AppleANS3NVMeController: 64 GB NAND, format=APFS, ready
[ 0.058440] AppleSmartIO2: charger detached, battery=87%, temp=28.4C
[ 0.064117] AppleBCMWLANCore: firmware 4378 loaded, country=HU
[ 0.071882] AppleBasebandPCI: baseband held offline (lab profile, no SIM)
[ 0.079004] apfs_vfsop_mount: disk0s1s1 mounted read-only (System role)
[ 0.085441] apfs_vfsop_mount: disk0s1s2 mounted read/write (Data role)
[ 0.092118] AppleMobileFileIntegrity: developer mode enabled, amfi_get_out_of_my_way=0
[ 0.098774] launchd[1]: *** launchd[1] has started up. ***
[ 0.104119] com.apple.SpringBoard[54]: display awake, first unlock pending
[ 0.118002] dropbear[189]: listening on port 22 (usbmux tunnel only)
[ok] lab device booted verbose, screen unlocked, no SIM, wifi=lab-vlan-9
11:19:41 $ ideviceinfo -k ProductType -k ProductVersion -k BuildVersion
iPhone10,4
16.7.10
20H350
[info] target app=eu.naunet.portal 4.9.1 (build 2041), device=NAU-LAB-04
11:19:48 $ frida-ps -Uai | grep -i naunet
PID Name Identifier
1284 Naunet Portal eu.naunet.portal
[ok] frida-server 17.2.4 attached over usbmux, gadget not required
11:19:52 $
11:19:52 $
11:19:55 $ objection -g eu.naunet.portal explore
Using USB device `iPhone 8 (NAU-LAB-04)`
Agent injected and responds ok!
eu.naunet.portal on (iPhone: 16.7.10) [usb] # ios info binary
Name Type Encrypted PIE ARC Canary Stack Exec
NaunetPortal execute False True True True False
[ok] PIE, ARC and stack canary present, cryptid=0 on the decrypted copy
11:20:14 $ otool -l NaunetPortal | grep -A4 LC_ENCRYPTION_INFO_64
cmd LC_ENCRYPTION_INFO_64
cryptoff 16384
cryptsize 22986752
cryptid 0
[note] store binary is encrypted, decrypted copy retained as ev-ios-002
11:20:33 $ plutil -p Info.plist | grep -A6 NSAppTransportSecurity
"NSAppTransportSecurity" => {
"NSExceptionDomains" => {
"legacy-api.naunet.eu" => {
"NSExceptionAllowsInsecureHTTPLoads" => 1
"NSExceptionMinimumTLSVersion" => "TLSv1.0"
[warn] ATS exception permits cleartext and TLS 1.0 to one legacy host
[evidence] plist=ev-ios-004, severity=medium, owner=mobile
11:20:44 $
11:20:44 $
11:20:52 $ nscurl --ats-diagnostics --verbose https://legacy-api.naunet.eu
Default ATS Secure Connection
Result : FAIL
Allow Insecure HTTP Loads
Result : PASS
TLSv1.2 with exception
Result : PASS
[warn] host would still be reachable over http from the shipped app
11:21:09 $ ls /var/mobile/Containers/Data/Application/9C4A1F7E-3B21-4D0E-8A5C-77E1B2D4F630
Documents/ Library/ SystemData/ tmp/
Library/Preferences/eu.naunet.portal.plist
Library/Caches/eu.naunet.portal/Cache.db
Library/WebKit/WebsiteData/Default/
[ok] container mapped, 41 files, 18.4 MiB
11:21:22 $
11:21:22 $
11:21:31 $ plutil -p Library/Preferences/eu.naunet.portal.plist
"lastTenant" => "tenant_88"
"refreshToken" => "<redacted 214 bytes>"
"analyticsOptOut" => 0
[warn] refresh token stored in NSUserDefaults instead of the keychain
[evidence] file=ev-ios-007, severity=medium, owner=mobile
11:21:58 $ sqlite3 Cache.db 'select request_key from cfurl_cache_response limit 4'
https://api.naunet.eu/v1/projects?tenant=tenant_88
https://api.naunet.eu/v1/accounts/self
https://api.naunet.eu/v1/exports/8f2c41
https://files.naunet.eu/d/8f2c41
[note] authenticated responses cached on disk, review cache policy
11:22:26 $ objection -g eu.naunet.portal run ios keychain dump
Account Service Accessible Data
test.qa@naunet.eu eu.naunet.portal.auth WhenUnlocked <redacted>
device-id eu.naunet.portal.dev AfterFirstUnlockThisDeviceOnly <redacted>
[warn] auth item is not ThisDeviceOnly, so it migrates through backups
[scope] lab test account only, no client credential material retained
11:22:54 $ frida -U -l pinning-check.js -f eu.naunet.portal
[+] SecTrustEvaluateWithError hooked
[+] Certificate pinning active: rejected mitm chain (leaf sha256 mismatch)
[+] Pin set: 2 SPKI hashes, backup pin present
[ok] pinning implemented correctly, bypass required a jailbroken device
11:23:06 $
11:23:06 $
11:23:19 $ objection -g eu.naunet.portal run ios sslpinning disable
(agent) Custom SSL pinning bypass hooked, 4 methods patched
(agent) Proxy traffic now visible in mitmproxy on 10.60.0.31:8080
[ok] traffic captured with an on-device bypass, expected for this test class
11:23:47 $ frida -U -l jailbreak-detect.js eu.naunet.portal
[+] No calls to stat(/Applications/Cydia.app), fork() or dyld image checks
[+] No integrity, debugger or Frida detection observed
[warn] app runs unmodified on a jailbroken device, no tamper signal
[evidence] trace=ev-ios-011, severity=low, owner=mobile
11:24:12 $ plutil -p Info.plist | grep -A3 CFBundleURLSchemes
"CFBundleURLSchemes" => [
0 => "naunetportal"
]
"NSUserActivityTypes" => ["eu.naunet.portal.openProject"]
[note] deep link naunetportal://project?id= accepts unvalidated identifiers
11:24:38 $ ls -1sh Library/Caches/Snapshots/downscaled
184K UIApplicationAutomaticSnapshotDefault-Portrait.ktx
[warn] backgrounding snapshot retains the project list in cleartext
11:24:51 $
11:24:51 $
11:25:02 $ objection -g eu.naunet.portal run ios pasteboard monitor
[pasteboard] no sensitive value copied during a 90 second session
[ok] pasteboard hygiene acceptable, no clipboard leak observed
11:25:29 $ mobsf-cli scan NaunetPortal.ipa --static-only
[MobSF] binary analysis, plist review and secret scan complete
[MobSF] security score 68/100, 2 medium, 3 low, 0 high
[MobSF] hardcoded string matches=1 (analytics key, non-sensitive)
[ok] static findings match the manual review, no additional criticals
11:25:58 $ summarize mobile findings
1 refresh token in NSUserDefaults severity=medium ev-ios-007
2 ATS exception with TLS 1.0 and cleartext severity=medium ev-ios-004
3 no jailbreak or tamper detection severity=low ev-ios-011
4 backgrounding snapshot retains data severity=low ev-ios-014
[ok] findings=4, high=0, medium=2, low=2, informational=5
11:26:24 $ generate mobile narrative for NAU-1187
rendering report NAU-1187-ios-portal.md (7 sections, 4 findings, 5 notes)
manifest sha256 7d19...b402 appended to /srv/evidence/NAU-1187/manifest.txt
[complete] mobile phase closed, decrypted binary and traces sealed
11:26:51 $ objection -g eu.naunet.portal run ios sslpinning enable
(agent) pinning hooks removed, original SecTrust behaviour restored
[ok] device restored to pre-test state, mitmproxy CA profile removed
11:27:08 $ idevicediagnostics shutdown
[ 0.000000] com.apple.SpringBoard[54]: shutdown requested by lockdownd
[ 0.011882] launchd[1]: Stopping com.apple.mobile.lockdown ...
[ 0.018440] dropbear[189]: exiting on SIGTERM, 1 tunnel closed
[ 0.024117] frida-server[311]: received SIGTERM, detaching 1 session
[ 0.031004] launchd[1]: Sending SIGTERM to remaining jobs (74)
[ 0.038774] AppleKeyStore: sealing keybag, class keys evicted
[ 0.044119] apfs_vfsop_sync: disk0s1s2 flushed, 41 dirty nodes written
[ 0.051663] apfs_vfsop_unmount: disk0s1s2 (Data role) unmounted
[ 0.058228] apfs_vfsop_unmount: disk0s1s1 (System role) unmounted
[ 0.064441] AppleANS3NVMeController: shutdown complete, cache flushed
[ 0.071118] AppleSEPManager: SEPOS power gate, mailbox drained
[ 0.078002] AppleARMPlatform: platform power off requested
[ ***.******] AppleSmartIO2: PMU power down, wake reason cleared
[ ***.******] Darwin: system halted
[ok] lab device 04 powered off, jailbreak is tethered so state is clean
[observe] holding for next window, cursor=ios-lab-04
[ 0.000000] Linux version 6.19.2-kali1-amd64 (devel@kali.org) (gcc-15 (Debian 15.1.0-4) 15.1.0) #1 SMP PREEMPT_DYNAMIC Kali 6.19.2-1kali1 (2026-08-11)
[ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-6.19.2-kali1-amd64 root=/dev/mapper/kali--vg-root ro console=tty1 systemd.show_status=1
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ffff] usable
[ 0.000000] BIOS-e820: [mem 0x000000006f000000-0x000000007fffffff] reserved
[ 0.000000] efi: EFI v2.9 by LENOVO, secureboot=disabled, setup-mode=user
[ 0.000000] DMI: LENOVO 21F8CTO1WW/21F8CTO1WW, BIOS N3JET32W (1.16) 03/12/2026
[ 0.002114] smpboot: CPU0: AMD Ryzen 7 PRO 7840U w/ Radeon 780M Graphics (16 threads)
[ 0.008440] Memory: 32418116K/33554432K available (16384K kernel code, 2764K rwdata)
[ 0.014002] Spectre V2 : Mitigation: Enhanced / Automatic IBRS
[ 0.014003] Speculative Return Stack Overflow: Mitigation: Safe RET
[ 0.021774] x86/fpu: Supporting XSAVE feature 0x200: 'Protection Keys User registers'
[ 0.028119] ACPI: PM: Registering ACPI NVS region [mem 0x6f7fe000-0x6f7fffff]
[ 0.036663] nvme nvme0: pci function 0000:01:00.0, 8 io queues, mq
[ 0.041228] nvme0n1: p1 p2 p3
[ 0.048440] amdgpu 0000:c1:00.0: [drm] Fetched VBIOS from VFCT, kernel modesetting enabled
[ 0.055117] iwlwifi 0000:c2:00.0: loaded firmware version 92.a5cbfba2.0 be200-92.ucode
[ 0.061882] Bluetooth: hci0: AMD BT firmware revision 0x1102, patch loaded
[ 0.068004] thunderbolt 0000:c4:00.5: USB4 host router, 2 ports, DP tunnelling ok
[ 0.074441] device-mapper: ioctl: 4.51.0-ioctl (2026-05-19) initialised
[ 0.082118] EXT4-fs (dm-1): mounted filesystem 21d7c9a4-6b3e-42f8-b0a5-3ce1447fd902 r/w
[ 0.089774] systemd[1]: systemd 258.2-2 running in system mode (+PAM +AUDIT +APPARMOR)
[ 0.090004] systemd[1]: Detected architecture x86-64 on bare metal.
[ 0.096441] systemd[1]: Hostname set to <naunet-kali>.
Please unlock disk nvme0n1p3_crypt: ********
[ OK ] Finished Cryptography Setup for nvme0n1p3_crypt.
[ OK ] Reached target Local Encrypted Volumes.
[ OK ] Started Journal Service.
[ OK ] Started AppArmor initialization.
[ OK ] Mounted /boot/efi.
[ OK ] Activated swap /dev/mapper/kali--vg-swap.
[ OK ] Started TLP system startup/shutdown.
[ OK ] Started NetworkManager.service.
[ OK ] Started ModemManager.service.
[ OK ] Started Bluetooth service.
[ OK ] Started PostgreSQL 17 database server.
[ OK ] Started OpenBSD Secure Shell server.
[ OK ] Started Engagement evidence vault (evidence-vault.service).
[ OK ] Started Scope guard (roe-guard.service).
[ OK ] Reached target Multi-User System.
[ OK ] Started GNOME Display Manager.
[ OK ] Reached target Graphical Interface.
Kali GNU/Linux Rolling naunet-kali tty1
naunet-kali login: analyst
Password:
Linux naunet-kali 6.19.2-kali1-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.19.2-1kali1 x86_64
The programs included with the Kali GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Sep 9 08:41:22 2026 on tty1
┌──(analyst㉿naunet-kali)-[~]
└─$ engagement shell
[roe-guard] rules of engagement NAU-1187 loaded, scope=app-portal, ad-assessment
[roe-guard] evidence vault mounted at /srv/evidence/NAU-1187 (186 items)
11:31:04 $ engagement open --scope app-portal --mode read-only
engagement NAU-1187 resumed by analyst at 2026-09-09T11:31:04+02:00
phase app-portal opened, evidence vault /srv/evidence/NAU-1187 (186 items)
[info] target=portal.naunet.eu, source=194.42.299.80, roe=NAU-1187
11:31:06 $ dig +short portal.naunet.eu api.naunet.eu files.naunet.eu
edge.naunet.eu.
194.42.299.37
194.42.299.37
194.42.299.37
[dns] portal, api, files, status, support, ttl=300
11:31:09 $ openssl s_client -connect portal.naunet.eu:443 -servername portal.naunet.eu
subject=CN=naunet.eu
issuer=C=US, O=Let's Encrypt, CN=R11
Verify return code: 0 (ok)
DNS:naunet.eu, DNS:portal.naunet.eu, DNS:api.naunet.eu, DNS:files.naunet.eu
[ok] certificate coverage matches published hostnames
11:31:12 $ testssl --fast --protocols --alpn portal.naunet.eu
TLS 1.2 offered (OK)
TLS 1.3 offered with final (OK): TLS_AES_256_GCM_SHA384
ALPN/HTTP2 h2, http/1.1 (offered)
Session renegotiation not vulnerable (OK)
[ok] TLS 1.3 preferred, ALPN=h2, renegotiation=disabled
11:31:15 $ curl -sSI https://portal.naunet.eu
HTTP/2 200
cache-control: private, max-age=0
vary: accept-encoding, cookie
etag: W/"4c9d0e77-2f11"
[http] 200 OK, cache-control=private, vary=accept-encoding
[note] cache key review recommended for authenticated paths
11:31:19 $ whatweb -a 1 https://portal.naunet.eu
https://portal.naunet.eu [200 OK] HTTPS, Strict-Transport-Security, Cookies[nau_sess]
[info] server marker absent, powered-by marker absent
11:31:22 $ hakrawler -url https://portal.naunet.eu -depth 1
https://portal.naunet.eu/
https://portal.naunet.eu/account
https://portal.naunet.eu/projects
https://portal.naunet.eu/support
https://portal.naunet.eu/docs
https://portal.naunet.eu/logout
[route] /, /account, /projects, /support, /docs, /logout
[blocked] account routes redirect without a session
11:31:26 $ curl -sS https://portal.naunet.eu/login
<input type="hidden" name="csrf_token" value="<redacted>">
<input type="password" name="password" autocomplete="current-password">
sec-fetch-site check: enforced (cross-site POST rejected with 403)
[html] csrf-token=present, origin-check=enabled, autocomplete=password
[ok] invalid-user and invalid-password responses are uniform
11:31:30 $ measure login rate policy over 40 sequential attempts
attempts 1-30 401 unauthorized mean 214ms
attempts 31-40 429 too many requests retry-after: 12, 18, 27, 41 (progressive)
[ok] limit=30, window=60s, backoff=progressive
11:31:32 $
11:31:32 $
11:31:34 $ curl -sS -d 'email=<redacted>' https://portal.naunet.eu/recover
{"status":"sent","message":"If an account exists, a reset link has been sent."}
known-account 342ms / unknown-account 351ms / token reuse -> 410 gone
[ok] generic response, single-use token policy observed
[note] delivery timing should remain consistent across account states
11:31:38 $ review published documentation and security.txt
Contact: mailto:security@naunet.eu
Expires: 2027-01-31T23:59:00+01:00
Preferred-Languages: en, hu, de
[docs] security contact published, API reference requires authentication
11:31:41 $ curl -sS https://portal.naunet.eu/assets/manifest.json
{"main":"portal.9d41c7b2.js","vendor":"vendor.2b8e11df.js","css":"portal.71ae3f08.css"}
GET /assets/portal.9d41c7b2.js.map -> 404 not found
[asset] hashed bundles, source maps=not exposed, debug=false
11:31:45 $ compare portal build with status.naunet.eu banner
portal build=4.9.1 commit=9d41c7b deployed=2026-09-08T21:14Z
status build=4.9.0 commit=2b8e11d published=2026-08-27T09:02Z
[warn] status page trails application by one release
11:31:49 $ curl -sSI https://files.naunet.eu/d/8f2c41
HTTP/2 200
content-disposition: attachment; filename="export-2026-09-09.csv"
content-type: application/octet-stream
x-amz-meta-origin: prj_2041/tenant_88/export-worker-04
[http] content-disposition=attachment, filename=redacted, type=application/octet-stream
[note] attachment metadata should not disclose internal naming
11:31:50 $
11:31:50 $
11:31:53 $ curl -sS https://files.naunet.eu/
{"error":"access_denied","message":"listing is not enabled for this bucket"}
GET /d/8f2c41?signature=<expired> -> 403 signature expired
[ok] listing disabled, object access requires scoped signature
11:31:56 $
11:31:56 $
11:31:57 $ curl -sS https://api.naunet.eu/versions
{"current":"v1","advertised":["v1","v2"],"deprecated":["v0"],"sunset":"2026-03-31"}
GET /v0/projects -> 410 gone, link: <https://docs.naunet.eu/migrate/v1>; rel="deprecation"
[api] v1 active, v2 advertised, deprecated=v0
[ok] deprecated route returns 410, migration link present
11:32:01 $ curl -sS 'https://api.naunet.eu/v1/projects?limit=5000'
{"error":"invalid_parameter","parameter":"limit","max":200}
{"data":[],"next_cursor":"eyJvZmZzZXQiOjIwMH0","has_more":true}
[ok] cursor-based pagination, maximum page size enforced
11:32:05 $ replay signed webhook delivery against the test receiver
first delivery 202 accepted x-nau-signature=sha256=<redacted> t=1788953533
replay t+310s 401 rejected reason=timestamp_outside_window
tampered body 401 rejected reason=signature_mismatch
[hook] signed request, replay window=300s, retries=bounded
11:32:07 $
11:32:07 $
11:32:09 $ curl -sS https://api.naunet.eu/v1/projects
{"error":"tenant_required","message":"X-Tenant header missing","request_id":"c7f30a12"}
[blocked] tenant identifier required, anonymous access denied
[evidence] response=ev-0132, request=tr-0088
11:32:13 $ curl -sSI https://portal.naunet.eu/logout
HTTP/2 204
set-cookie: nau_sess=; Path=/; Max-Age=0; Secure; HttpOnly
GET /api/v1/accounts/self (old bearer) -> 401 token_revoked
[ok] browser session revoked, API token invalidated
11:32:16 $
11:32:16 $
11:32:17 $ curl -sSI https://portal.naunet.eu/debug
HTTP/2 403
content-length: 0
[blocked] 403 forbidden, response body minimized
11:32:21 $ curl -sS 'https://portal.naunet.eu/%2e%2e%2f'
HTTP/2 400
<html><head><title>Whitelabel Error Page</title></head><body>
<div>There was an unexpected error (type=Bad Request, status=400).</div>
[warn] malformed path returns framework marker, reduce response detail
11:32:25 $ correlate x-request-id across gateway and application logs
gateway 11:32:21.184 req=c7f30a12 status=400 upstream=portal-web-02
app 11:32:21.191 req=c7f30a12 status=400 handler=fallback
[ok] request id stable across gateway and application logs
11:32:29 $ confirm denied requests reached the SIEM pipeline
query: source IN (edge-gateway, portal-web) status IN (400,401,403) window=15m
hits: 63 matched by request id: 63/63 alert rule: PORTAL-DENY-BURST (>50/5m)
[ok] denied request retained, alert threshold configured
11:32:33 $ curl -sS https://naunet.eu/.well-known/security.txt
Contact: mailto:security@naunet.eu
Policy: https://naunet.eu/security/disclosure
Canonical: https://naunet.eu/.well-known/security.txt
[ok] security contact published, abuse channel monitored
11:32:37 $ curl -sS https://status.naunet.eu/backup
{"backup":"nightly","last_run":"2026-09-09T02:00:00Z","restore_test":null}
[status] restore-test=not-public, backup-owner=platform
11:32:41 $ curl -sS https://api.naunet.eu/v1/accounts/self
{"error":"unauthorized","message":"authentication required","request_id":"1d80b4ff"}
[blocked] anonymous request denied, principal=none
11:32:43 $
11:32:43 $
11:32:45 $ measure response timing variance over 200 requests
anonymous n=100 p50 198ms p95 241ms
authenticated n=100 p50 216ms p95 268ms
delta p50 +18ms (login enumeration risk: none observed)
[note] authenticated and anonymous paths differ by 18ms
11:32:49 $ score observation confidence
evidence items 42 corroborated 40 single-source 2 contradictions 0
[ok] confidence=high, evidence=42 items, unresolved=2
11:32:53 $ prepare remediation summary
1 cache-key review on authenticated paths owner=platform effort=M
2 normalize framework error fallback owner=application effort=S
3 strip attachment metadata on export owner=platform effort=S
[plan] owner=platform, target=next-release, review=security
11:32:57 $ engagement close --phase app-portal
phase app-portal closed, 207 evidence items sealed, sha256 manifest updated
[complete] portal review closed, no state changes on client systems
[observe] holding for next window, cursor=91ca44e2
11:45:53 $ engagement open --scope ad-assessment --mode audit
phase ad-assessment opened, mandate=audit (read-only directory queries)
[roe-guard] credential extraction and remote execution refused in this mode
[info] domain=corp.naunet.eu, dc=10.60.4.11, evidence mode=redacted
11:45:57 $ bloodhound-python -d corp.naunet.eu -c DCOnly --zip
INFO: Found AD domain: corp.naunet.eu
INFO: Connecting to LDAP server: dc01.corp.naunet.eu
INFO: Found 1284 objects, 41 computers, 96 groups, 812 users
INFO: Compressing output into 20260909114557_bloodhound.zip
INFO: Done in 00M 04S
[bloodhound] 1284 objects collected, groups=96, computers=41
[bloodhound] shortest privilege paths=4, verified paths=0, evidence=partial
11:46:02 $ ldapsearch -x -H ldap://10.60.4.11 -b '' -s base
namingContexts: DC=corp,DC=naunet,DC=eu
namingContexts: CN=Configuration,DC=corp,DC=naunet,DC=eu
supportedSASLMechanisms: GSSAPI, GSS-SPNEGO, NTLM
result: 0 Success
ldap_bind: Inappropriate authentication (48) - anonymous bind disabled
[ldapsearch] naming context observed, anonymous bind=blocked
[ldapsearch] groups=redacted, nested-membership review=queued
11:46:07 $ netexec smb hosts-inscope.txt --gen-relay-list relay.txt
SMB 10.60.4.11 445 DC01 [*] Windows Server 2022 (signing:True) (SMBv1:False)
SMB 10.60.4.21 445 APP01 [*] Windows Server 2022 (signing:True) (SMBv1:False)
SMB 10.60.9.117 445 WS-117 [*] Windows 11 26100 (signing:False) (SMBv1:False)
SMB 10.60.9.142 445 WS-142 [*] Windows 11 26100 (signing:False) (SMBv1:False)
[netexec] 41 hosts reachable, SMB signing=required on 39
[netexec] 2 hosts pending owner confirmation before follow-up
11:46:12 $ impacket-lookupsid auditor@corp.naunet.eu -domain-sids
[*] Brute forcing SIDs at corp.naunet.eu
[*] Domain SID is: S-1-5-21-3702018092-1447661009-2318844173
[*] 2 domain SIDs resolved, enumeration stopped at audit limit
[impacket] domain SID resolved, session validation only
[blocked] lateral movement outside the agreed audit scope
11:46:16 $
11:46:16 $
11:46:17 $ rubeus triage /nowrap
LUID UserName Service EndTime
0x3e4 APP01$@CORP.NAUNET.EU krbtgt/CORP.NAUNET.EU 09/09/2026 20:41:12
0x8a19c svc_report@CORP.NAU.. ldap/dc01.corp.naun.. 09/09/2026 20:44:03
[rubeus] ticket metadata reviewed, ticket material retained by client
[rubeus] delegation candidates=2, unconstrained delegation=not observed
11:46:18 $
11:46:18 $
11:46:22 $ certipy find -u auditor@corp.naunet.eu -dc-ip 10.60.4.11
[*] Finding certificate templates
[*] Found 11 certificate templates, 2 enabled on CORP-CA01
[!] Template 'CorpWebServerLegacy': enrollee supplies subject, manager approval disabled
[*] Saved text output to '20260909114622_Certipy.txt'
[certipy] 11 templates enumerated, enrollment rights=redacted
[warn] one template requires an owner and purpose review
11:46:27 $ credential handling checkpoint
[roe-guard] requested capability: credential extraction -> refused (mode=audit)
mandate NAU-1187 phase 3 requires written client sign-off before this step
[scope] credential extraction deferred to phase 3 with client sign-off
[scope] no hash or ticket material present in this evidence set
11:46:28 $
11:46:28 $
11:46:32 $ review token and integrity levels on audit workstation
whoami /groups Mandatory Label\Medium Mandatory Level (integrity: medium)
whoami /priv SeChangeNotifyPrivilege Enabled
SeIncreaseWorkingSetPrivilege Disabled
[token] integrity levels observed, local admin context=not provided
[token] privileged token duplication out of scope for this phase
11:46:37 $ netexec smb hosts-inscope.txt -M enum_local_admins
ENUM_LOCAL_ADMINS 10.60.4.21 APP01 CORP\Domain Admins, CORP\svc_deploy
ENUM_LOCAL_ADMINS 10.60.9.117 WS-117 CORP\Workstation Admins, CORP\j.kovacs
ENUM_LOCAL_ADMINS 10.60.9.142 WS-142 CORP\Workstation Admins, CORP\<redacted>
[ad] local administrators=redacted, stale membership candidates=3
[note] validate ownership before removing any membership
11:46:39 $
11:46:39 $
11:46:42 $ nltest /domain_trusts /all_trusts
List of domain trusts:
0: CORP corp.naunet.eu (NT 5) (Forest Tree Root) (Primary Domain) (Native)
1: LEGACY legacy.corp.naunet.eu (NT 5) (Direct Outbound) (Native)
The command completed successfully
[ad] trusts=2, directionality=redacted, external trust review=required
[blocked] trust traversal held for the client-approved follow-up
11:46:47 $ Get-GPOReport -All -ReportType Xml -Path gpo-NAU-1187.xml
Wrote report for 24 GPOs to gpo-NAU-1187.xml (1.42 MB)
Legacy reference found: \\corp.naunet.eu\SYSVOL\scripts\map-drives-2019.vbs
[gpo] policy links=redacted, privileged script paths=not collected
[warn] one legacy policy reference requires ownership confirmation
11:46:51 $
11:46:51 $
11:46:52 $ adcheck acl --object-type user,group,gpo
OBJECT PRINCIPAL RIGHT SOURCE
CN=Workstation Admins CORP\svc_report WriteMembers inherited
CN=Default Domain Policy CORP\Legacy Operators WriteDacl explicit
[acl] directory object permissions compared, write-capable paths=2
[evidence] path=ev-ad-008, severity=medium, remediation=review
11:46:57 $ persistence checkpoint
scheduled tasks created 0 services created 0 run keys touched 0
host state hash matches pre-engagement baseline (41/41 sampled hosts)
[audit] scheduled tasks, services, startup entries=not modified
[complete] audit-only mandate held, host state unchanged
11:47:02 $ lateral movement checkpoint
SMB reachable 41 sessions created 0
WinRM reachable 38 sessions created 0
RDP reachable 12 sessions created 0
[audit] SMB, WinRM and RDP paths reviewed as evidence only
[blocked] no remote sessions created, no commands executed on endpoints
11:47:07 $ privilege escalation summary
path 1 svc_report -> Workstation Admins -> WS-117 status=review
path 2 Legacy Operators -> Default Domain Policy status=review
[ad] verified escalation paths=0, review paths=6, credentials=none
[note] graph findings require domain-owner validation before remediation
11:47:12 $ generate AD narrative for NAU-1187
rendering report NAU-1187-ad-assessment.md (9 sections, 4 findings, 6 review paths)
manifest sha256 c04f...91d3 written to /srv/evidence/NAU-1187/manifest.txt
[report] directory exposure and privilege paths mapped, no exploitation
[complete] audit phase closed, findings queued for domain-owner review
[observe] holding for next window, cursor=6d3be5a1
11:47:26 $ engagement close --all
NAU-1187 closed: 4 phases, 207 evidence items, 14 findings, manifest signed
[complete] report bundle queued for client delivery, transfer=out-of-hours
11:47:33 $ exit
[roe-guard] engagement shell closed, scope NAU-1187 released
┌──(analyst㉿naunet-kali)-[~]
└─$ sudo systemctl poweroff
Broadcast message from root@naunet-kali on tty1 (Wed Sep 9 11:47:38 2026):
The system will power off now!
[ OK ] Stopped target Graphical Interface.
Stopping GNOME Display Manager...
[ OK ] Stopped GNOME Display Manager.
[ OK ] Stopped target Multi-User System.
Stopping PostgreSQL 17 database server...
Stopping Engagement evidence vault (evidence-vault.service)...
[ OK ] Stopped PostgreSQL 17 database server.
[ OK ] Stopped Engagement evidence vault (evidence-vault.service).
[ OK ] Stopped Scope guard (roe-guard.service).
[ OK ] Stopped OpenBSD Secure Shell server.
[ OK ] Stopped Bluetooth service.
[ OK ] Stopped ModemManager.service.
[ OK ] Stopped NetworkManager.service.
[ OK ] Stopped TLP system startup/shutdown.
[ OK ] Stopped target Basic System.
[ OK ] Unmounted /boot/efi.
[ OK ] Deactivated swap /dev/mapper/kali--vg-swap.
[ OK ] Reached target Unmount All Filesystems.
[ OK ] Stopped Cryptography Setup for nvme0n1p3_crypt.
[ OK ] Stopped target Local Encrypted Volumes.
[ OK ] Reached target Late Shutdown Services.
[ OK ] Finished System Power Off.
[ OK ] Reached target System Power Off.
[ 1081.114882] systemd-journald[402]: Received SIGTERM from PID 1 (systemd-shutdow).
[ 1081.208447] systemd-shutdown[1]: Syncing filesystems and block devices.
[ 1081.241118] systemd-shutdown[1]: Sending SIGTERM to remaining processes...
[ 1081.318774] systemd-shutdown[1]: Sending SIGKILL to remaining processes...
[ 1081.344002] systemd-shutdown[1]: Unmounting file systems.
[ 1081.361441] systemd-shutdown[1]: Unmounting /boot/efi.
[ 1081.378119] systemd-shutdown[1]: Remounting '/' read-only.
[ 1081.394663] systemd-shutdown[1]: All filesystems unmounted.
[ 1081.408228] systemd-shutdown[1]: Deactivating swaps.
[ 1081.416001] systemd-shutdown[1]: All swaps deactivated.
[ 1081.423918] systemd-shutdown[1]: Detaching loop devices.
[ 1081.431227] systemd-shutdown[1]: All loop devices detached.
[ 1081.438774] systemd-shutdown[1]: Stopping MD devices.
[ 1081.446119] systemd-shutdown[1]: Detaching DM devices.
[ 1081.461408] systemd-shutdown[1]: Detaching DM /dev/dm-2 (253:2).
[ 1081.486550] systemd-shutdown[1]: Not all DM devices detached, 2 left.
[ 1081.502118] systemd-shutdown[1]: Failed to finalize DM devices, ignoring.
[ 1081.518774] systemd-shutdown[1]: Powering off.
[ ***.******] amdgpu 0000:c1:00.0: amdgpu: MODE1 reset skipped on shutdown
[ ***.******] ACPI: PM: Preparing to enter system sleep state S5
[ ***.******] reboot: Power down
=== ===
******
******
******
****** ******
****** ******
****** ******
****** ****** ******
****** ****** ******
****** ****** ******
=== ===