Cloud meta data potentially exposed - Pen. testing

Installation
1

These are from ZAP pen testing software in attack mode. I see it says confidence is low and the output response says HTTP/1.1 301 Moved Permanently, so hope everything is alright?

1. Cloud meta data potentially exposed

Screenshot 2023-11-01 at 9.24.42 pm
Screenshot 2023-11-01 at 9.24.42 pm1752×620 70.7 KB

Response header

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 01 Nov 2023 10:10:17 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://examplesite.com/latest/meta-data/
Strict-Transport-Security: max-age=63072000

2. Hidden file found www.mysite.com/.hg

Screenshot 2023-11-01 at 9.27.09 pm
Screenshot 2023-11-01 at 9.27.09 pm2558×620 70 KB

What other tests that I can do to get a confirmation?

2

Results from off-the-shelf penetration test software are mostly garbage and it’s a waste of everyone’s time to explain every single false positive.

If you find an actual security issue with reproducible steps please report at HackerOne.

4 Likes
3

Thank you for the reply.

Is there any recommended pen testing software/websites?

I noticed the one you mentioned HackerOne also does pen testing as a service. Is it owned by or linked/affiliated to discourse or any of the team members?

4

We pay for HackerOne to handle our security reports and triage bogus reports, like those from pen testing software. There is no affiliation between CDCK and H1.

4 Likes
5

Thank you for the prompt reply.