Cloud meta data potentially exposed - Pen. testing

Product Support Self-hosting

AI-generated summary

PrettyGirl shared results from ZAP penetration testing software, indicating potential exposure of cloud meta data with low confidence. The output response showed an HTTP 301 redirect. Additionally, a hidden file www.mysite.com/.hg was found. Falco expressed skepticism about the results, advising against using off-the-shelf penetration test software and recommending reporting actual security issues with reproducible steps on HackerOne. PrettyGirl inquired about recommended penetration testing software and the relationship between HackerOne and Discourse. Falco clarified that Discourse pays for HackerOne’s services to handle security reports and triage, but there is no affiliation between the two.

1

These are from ZAP pen testing software in attack mode. I see it says confidence is low and the output response says HTTP/1.1 301 Moved Permanently, so hope everything is alright?

1. Cloud meta data potentially exposed

Screenshot 2023-11-01 at 9.24.42 pm
Screenshot 2023-11-01 at 9.24.42 pm1752×620 70.7 KB

Response header

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 01 Nov 2023 10:10:17 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://examplesite.com/latest/meta-data/
Strict-Transport-Security: max-age=63072000

2. Hidden file found www.mysite.com/.hg

Screenshot 2023-11-01 at 9.27.09 pm
Screenshot 2023-11-01 at 9.27.09 pm2558×620 70 KB

What other tests that I can do to get a confirmation?

2

Results from off-the-shelf penetration test software are mostly garbage and it’s a waste of everyone’s time to explain every single false positive.

If you find an actual security issue with reproducible steps please report at HackerOne.

3

Thank you for the reply.

Is there any recommended pen testing software/websites?

I noticed the one you mentioned HackerOne also does pen testing as a service. Is it owned by or linked/affiliated to discourse or any of the team members?

4

We pay for HackerOne to handle our security reports and triage bogus reports, like those from pen testing software. There is no affiliation between CDCK and H1.

5

Thank you for the prompt reply.