Case study 05 · External · Cloud · Identity · Network

    A well-defended core, serious exposures in the estate around it

    A philanthropic organization's internet-facing estate: a public website behind a cloud edge service, a staging environment, a federated single-sign-on identity layer, and perimeter network appliances.

    Client profile

    A philanthropic organization's internet-facing estate: a public website behind a cloud edge service, a staging environment, a federated single-sign-on identity layer, and perimeter network appliances.

    Challenge

    The public website was reasonably well defended. The real question was what sat around it: the staging environment, the identity layer, and the network perimeter, where an external attacker with no credentials has room to operate.

    Scope

    • The public website and its cloud edge protection
    • A public staging server
    • The federated single-sign-on identity layer
    • Perimeter network appliances
    • External, unauthenticated, black-box; a live credential-guessing run was treated as authorization-gated and not executed

    Authorized external red team, OSINT-led, delivered as a leadership-level findings report.

    ApproachAI-accelerated, human-validated

    An OSINT-led external engagement on TitanDef's agent-orchestrated pipeline, powered by frontier models and aligned to OWASP and PTES. Each exposure is presented with what was observed, why it matters, and live proof. Findings were human-reviewed; the one step that required active credential guessing was deliberately held as an authorization-gated action rather than run.

    Key findingsby severity

    4 validated findings

    High 4

    High

    • The website's administrator control panel was reachable from the open internet through an inconsistency in the edge protection: requests presenting a crawler identity were exempted and passed straight through to the content-management system's administrator login, on an end-of-life platform with no login lockout or rate-limiting.
    • A public staging server exposed an unauthenticated search database holding a full copy of the site index (tens of thousands of records spanning program, staff and page data), readable and write-capable with no credential, alongside source-control and environment files on disk.
    • The federated identity layer retained a legacy authentication endpoint that sits outside account-lockout and throttling, letting an attacker guess passwords without tripping the lockout counter.
    • Two perimeter appliances answered DNS for the whole internet and amplified responses to roughly 22 times the request size, usable as a reflection and amplification source against third parties.

    Four High findings, each with live proof. The edge-bypass path to the administrator panel is the most attractive target on the estate; the exposed staging database is both a disclosure and a destruction risk.

    Outcomefixed / retested

    Midway through the assessment the organization tightened the control on the administrator path. The engagement then identified a second route, through the platform's own request handling, that reached the same administrator login and the password-reset form despite the new rule, and reported it. Each finding shipped with what was observed and live proof; remaining fixes (retire or isolate the staging host, disable the legacy identity endpoint, restrict the open resolvers) were supplied.

    1. During the assessment

      Organization tightened the control on the administrator path.

    2. Same assessment

      A second route to the administrator login was found despite the fix, and reported.

    3. Supplied

      Fix order for the staging host, legacy identity endpoint, and open resolvers.

    Engage

    Find out what an adversary already sees.

    Focused engagements of 5 to 7 business days, with first findings in 72 hours. Powered by frontier models; every finding validated by a senior human.

    Scope a pen test →