#sample-report // samaritan external surface scan

acme-corp.io

Monitoring period: 2026-07-01 to 2026-07-27

Three high-confidence findings with active internet exposure. One correlated credential-access pattern requires immediate review.

CModerate RiskGenerated: 2026-07-27T14:02:03Z
18Subdomains discovered
12Exposed services
7Findings total
2Critical severity

#attack-surface

Discovered attack surface

18Root & subdomains
  • ›acme-corp.io
  • ›www.acme-corp.io
  • ›api.acme-corp.io
  • ›staging.acme-corp.io
  • ›dev.acme-corp.io
  • ›admin.acme-corp.io
  • ›metrics.acme-corp.io
  • ›grafana.acme-corp.io
  • ›vault.acme-corp.io
  • ›mail.acme-corp.io
  • ›cdn.acme-corp.io
  • ›assets.acme-corp.io
  • ›auth.acme-corp.io
  • ›oauth.acme-corp.io
  • ›docs.acme-corp.io
  • ›status.acme-corp.io
  • ›blog.acme-corp.io
  • ›legacy.acme-corp.io
9IP addresses
  • ›54.203.118.42
  • ›54.203.118.43
  • ›18.184.99.128
  • ›18.184.99.129
  • ›3.122.4.77
  • ›13.49.230.11
  • ›185.199.108.153
  • ›185.199.109.153
  • ›104.21.72.1
12Exposed services
  • ›HTTPS :443 (nginx 1.24.0) - 8 hosts
  • ›HTTP :80 redirect to HTTPS - 8 hosts
  • ›SSH :22 - 2 hosts (NOT recommended)
  • ›Prometheus :9090 - metrics.acme-corp.io (UNAUTHENTICATED)
  • ›Grafana :3000 - grafana.acme-corp.io (default admin password set)
  • ›Redis :6379 - staging.acme-corp.io (public-facing)
  • ›PostgreSQL :5432 - dev.acme-corp.io (public-facing)
  • ›Kubernetes API :6443 - 3.122.4.77 (cert only)
  • ›Vault UI :8200 - vault.acme-corp.io (TLS; Shamir unseal required)
  • ›SMTP :587 - mail.acme-corp.io
  • ›MinIO :9000 - legacy.acme-corp.io (public bucket listing enabled)
  • ›Node.js debug :9229 - dev.acme-corp.io (CRITICAL: open to 0.0.0.0)
14TLS certificates tracked
  • ›acme-corp.io: Let's Encrypt (valid, 61 days remaining)
  • ›staging.acme-corp.io: Let's Encrypt (valid, 8 days remaining - EXPIRY RISK)
  • ›dev.acme-corp.io: self-signed (WARN: MITM surface)
  • ›grafana.acme-corp.io: Let's Encrypt (valid, 44 days remaining)

#findings

Security findings

dev.acme-corp.io:9229 is reachable from the public internet with no authentication. The V8 inspector protocol allows full code execution in the Node.js process.

Impact

Unauthenticated remote code execution. An attacker can attach a debugger, pause execution, and inject arbitrary JavaScript into the running server process.

Affected asset

dev.acme-corp.io (18.184.99.128:9229)

#correlation

Correlation sequence

samaritan-core-correlation-engine / tty1 - target: acme-corp.io
14:01:58.001[INFO]Starting scan sequence for target: acme-corp.io
14:01:58.340[INFO]DNS enumeration: 18 subdomains discovered via zone walk + CT log analysis
14:01:59.112[INFO]Port scan complete: 9 IPs, 12 exposed services mapped
14:01:59.880[WARN]Service fingerprint: dev.acme-corp.io:9229 identified as Node.js V8 inspector (unauthenticated)
14:02:00.201[WARN]Service fingerprint: metrics.acme-corp.io:9090 - Prometheus, no authentication required
14:02:00.618[WARN]Service fingerprint: grafana.acme-corp.io:3000 - Grafana 10.x, admin/admin accepted
14:02:01.002[INFO]CVE lookup: nginx 1.24.0 on :443 - CVE-2023-44487 (CVSS 7.5), CVE-2024-7347 (CVSS 5.3)
14:02:01.290[INFO]CVE lookup: legacy.acme-corp.io MinIO :9000 - CVE-2023-28432 matched (CVSS 7.5)
14:02:01.512[CRIT]ScanResult written: F-001 - Node.js inspector RCE, CVSS 9.8, confidence 0.99
14:02:01.744[CRIT]ScanResult written: F-002 - Prometheus unauthenticated, CVSS 7.5, confidence 0.96
14:02:02.010[INFO]ScanResult written: F-006 - TLS cert expiry in 8 days (staging), CVSS 5.3
14:02:02.310[INFO]Report generated: 7 findings (2 CRIT, 3 HIGH, 2 WARN), overall grade: C
14:02:02.580[INFO]Scan complete: SCAN-4821 acme-corp.io
14:02:03.000[SYS]Awaiting next scan

#alerts

Prioritized alerts

CRITINC-9101-META

Internal topology exposed via unauthenticated Prometheus + Grafana with default credentials

Why this was prioritized

The Prometheus endpoint provides full service-map enumeration without authentication. Grafana login succeeded with admin/admin; dashboards include data source configs with embedded credentials visible in the editor. This chain (Prometheus recon, Grafana access, credential extraction) is a documented lateral-movement path in cloud environments.

Primary asset

metrics.acme-corp.io, grafana.acme-corp.io

89%Correlation confidence
HIGHINC-9102-EXP

Unauthenticated remote code execution surface - Node.js inspector

Why this was prioritized

dev.acme-corp.io:9229 (V8 inspector) is open to 0.0.0.0. The same host has public PostgreSQL on :5432. The combination of RCE surface + database access on the same host elevates this finding from High to immediate-priority: code execution on the dev host gives direct database access without credential requirements.

Primary asset

18.184.99.128 (dev.acme-corp.io)

99%Correlation confidence
HIGHINC-9100-PROM

MinIO public bucket listing - internal export files readable without credentials

Why this was prioritized

legacy.acme-corp.io:9000 has bucket listing enabled with no authentication. Three buckets enumerated: backups-2024, static-assets, internal-exports. The internal-exports bucket contains files dated as recently as 2026-06. This is a direct data exfiltration risk with no authentication barrier.

Primary asset

legacy.acme-corp.io (104.21.72.1:9000)

98%Correlation confidence

This report was generated in under 4 seconds, for a target we had never seen before.

Run this against your infrastructure.

Initiate Scan

scoped to targets you register · no credentials required to start