# Cloud meta data potentially exposed - Pen. testing

**URL:** https://meta.discourse.org/t/cloud-meta-data-potentially-exposed-pen-testing/284094
**Category:** Self-hosting
**Created:** [November 1, 2023, 10:34am UTC](https://meta.discourse.org/t/cloud-meta-data-potentially-exposed-pen-testing/284094 "2023-11-01T10:34:43Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![PrettyGirl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/prettygirl/32/330415_2.png) [@PrettyGirl](https://meta.discourse.org/u/PrettyGirl)
#### Post date: [November 1, 2023, 10:34am UTC](https://meta.discourse.org/t/cloud-meta-data-potentially-exposed-pen-testing/284094/1 "2023-11-01T10:34:44Z")

</div>

These are from ZAP pen testing software in `attack` mode. I see it says confidence is low and the output response says `HTTP/1.1 301 Moved Permanently`, so hope everything is alright?

**1. Cloud meta data potentially exposed**

 ![Screenshot 2023-11-01 at 9.24.42 pm](https://global.discourse-cdn.com/meta/original/4X/b/3/f/b3f5ebed4263294c010c11b00238d3f663f25b04.png)

Response header

```plaintext
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 01 Nov 2023 10:10:17 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://examplesite.com/latest/meta-data/
Strict-Transport-Security: max-age=63072000

```

**2. Hidden file found `www.mysite.com/.hg`**

 ![Screenshot 2023-11-01 at 9.27.09 pm](https://global.discourse-cdn.com/meta/original/4X/6/2/d/62d93860e9e3d62b57634c63413f30c11c034687.png)

What other tests that I can do to get a confirmation?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [November 1, 2023, 4:29pm UTC](https://meta.discourse.org/t/cloud-meta-data-potentially-exposed-pen-testing/284094/2 "2023-11-01T16:29:32Z")

</div>

Results from off-the-shelf penetration test software are mostly garbage and it’s a waste of everyone’s time to explain every single false positive.

If you find an actual security issue with reproducible steps please report at [HackerOne](https://hackerone.com/discourse).

---

<div class="post-metadata">

### Author: ![PrettyGirl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/prettygirl/32/330415_2.png) [@PrettyGirl](https://meta.discourse.org/u/PrettyGirl)
#### Post date: [November 2, 2023, 12:40am UTC](https://meta.discourse.org/t/cloud-meta-data-potentially-exposed-pen-testing/284094/3 "2023-11-02T00:40:00Z")

</div>

Thank you for the reply.

Is there any recommended pen testing software/websites?

I noticed the one you mentioned `HackerOne` also does pen testing as a service. Is it owned by or linked/affiliated to discourse or any of the team members?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [November 2, 2023, 12:47am UTC](https://meta.discourse.org/t/cloud-meta-data-potentially-exposed-pen-testing/284094/4 "2023-11-02T00:47:50Z")

</div>

We pay for HackerOne to handle our security reports and triage bogus reports, like those from pen testing software. There is no affiliation between CDCK and H1.

---

<div class="post-metadata">

### Author: ![PrettyGirl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/prettygirl/32/330415_2.png) [@PrettyGirl](https://meta.discourse.org/u/PrettyGirl)
#### Post date: [November 2, 2023, 12:55am UTC](https://meta.discourse.org/t/cloud-meta-data-potentially-exposed-pen-testing/284094/5 "2023-11-02T00:55:37Z")

</div>

Thank you for the prompt reply.