This is a sample report for evaluation only. All client identifiers, IP addresses, hosts, and findings have been replaced with clearly fictional or REDACTED data. No real client data appears anywhere in this document. This report does not certify compliance with any standard.
This is the real deliverable format — executive summary, detailed findings mapped to NIST 800-171, and a prioritized remediation roadmap. Client data is fully redacted.
Rimrock Security performed an external network and web-application penetration test of Northwind Fabrication LLC's internet-facing infrastructure between April 7 and April 11, 2026. The objective was to identify and safely demonstrate vulnerabilities that a real attacker could exploit, and to assess readiness against relevant NIST 800-171 controls. We identified 6 findings across four severity tiers. Most notably, a chained attack path allowed an unauthenticated external attacker to gain administrative access to an internal management portal — demonstrating that automated scanning alone would have understated the true risk.
| Severity | Count |
|---|---|
| Critical | 1 |
| High | 2 |
| Medium | 2 |
| Low | 1 |
| Informational | 0 |
Testing followed PTES (Penetration Testing Execution Standard), NIST SP 800-115, and the OWASP Testing Guide v4.2 across six phases: scoping and threat modeling, passive reconnaissance, active scanning and enumeration, vulnerability analysis, exploitation and attack-path chaining, and post-exploitation impact assessment. All findings were manually validated to eliminate false positives before inclusion in this report.
See Appendix A for the full tool inventory.
An exposed administrative login at [REDACTED] accepted credentials recovered from an unrelated, publicly disclosed breach (2024). Because the same username and password combination was reused across systems, an external attacker could authenticate without any prior internal access or brute-force activity — the login succeeded on the first attempt using breach data.
Full administrative control of the management console provided a direct pivot point into the internal server segment. Combined with Finding 4.2 (unpatched VPN appliance), this enabled authenticated lateral movement to [REDACTED internal segment] without triggering any existing monitoring alerts.
The perimeter VPN appliance was running firmware two major versions behind the vendor's current release. The installed version contains a publicly documented pre-authentication remote code execution vulnerability disclosed in Q3 2024. Exploit code is available in the wild. The management interface was reachable directly from the internet with no IP restriction.
A remote unauthenticated attacker could execute arbitrary commands on the VPN appliance, intercept VPN tunnels, harvest credentials in transit, and pivot to the internal LAN segment. This vulnerability was used in combination with Finding 4.1 during the engagement to demonstrate chained lateral movement.
The externally accessible supplier portal authenticates users with username and password only. No MFA enrollment is required or offered. The portal exposes order status records, delivery schedules, and part specifications that may contain Controlled Unclassified Information (CUI). No account lockout was observed after repeated failed login attempts — credential stuffing attacks would proceed without friction.
An attacker with access to a single compromised supplier credential (available via breach databases) could access CUI-adjacent records without triggering any lockout, potentially placing the organization in violation of DFARS 252.204-7012 and NIST 800-171 control 3.5.3.
Triggering an application error (e.g., submitting a malformed request) causes the web application to return a full stack trace including the server-side framework version, absolute file system paths, database connection string parameters (without credentials), and the names of internal software components. This information materially assists an attacker's reconnaissance and was instrumental in identifying the attack vectors exploited in this engagement.
The external web server accepts connections over TLS 1.0 and TLS 1.1, both of which are deprecated and known to be vulnerable to protocol downgrade attacks (POODLE, BEAST). NIST SP 800-52 Rev. 2 and PCI DSS 4.0 both require disabling TLS versions prior to 1.2. TLS 1.3 support was not observed.
HTTP responses from all tested web properties were missing recommended security headers: Content-Security-Policy, X-Frame-Options, Referrer-Policy, and Permissions-Policy. While these headers alone do not represent exploitable vulnerabilities, their absence reduces defense-in-depth and can facilitate clickjacking and cross-site scripting attacks if other vulnerabilities arise.
The table below maps each finding directly to the NIST SP 800-171 Rev. 2 controls it violates or weakens. This table is intended to serve as supporting evidence for your System Security Plan (SSP) and Plan of Action & Milestones (POA&M) submissions.
| Finding | Severity | 800-171 Controls | Control Description | Status |
|---|---|---|---|---|
| 4.1 — Reused admin credentials | Critical | 3.5.7 3.1.1 3.5.3 | Password complexity & reuse; limit system access; MFA for privileged access | Not Met |
| 4.2 — Unpatched VPN appliance | High | 3.14.1 3.14.2 3.1.12 | Flaw remediation; security alerts & patches; monitor remote access | Not Met |
| 4.3 — Supplier portal — no MFA | High | 3.5.3 3.1.1 | MFA for network access to CUI systems; limit system access to authorized users | Not Met |
| 4.4 — Verbose error pages | Medium | 3.13.3 | Employ architectural designs and implementation that promote security | Partially Met |
| 4.5 — TLS 1.0 / 1.1 enabled | Medium | 3.13.8 3.13.10 | Implement cryptographic mechanisms to protect CUI in transit; manage cryptographic keys | Not Met |
| 4.6 — Missing security headers | Low | 3.13.3 | Employ architectural designs and implementation that promote security | Partially Met |
| Priority | Window | Findings | Recommended Owner | Key Actions |
|---|---|---|---|---|
| Immediate | 7 days | 4.1, 4.2 | IT / MSP — REDACTED | Force credential rotation; enable MFA on admin console; patch VPN firmware; restrict management interfaces to internal IPs |
| Short-Term | 30 days | 4.3, 4.4 | IT / Dev Team — REDACTED | Enforce MFA on supplier portal; implement account lockout; disable debug/verbose errors in production; audit stale accounts |
| Medium-Term | 90 days | 4.5, 4.6 | IT / Web Dev — REDACTED | Disable TLS 1.0/1.1; enable TLS 1.3; deploy security headers on all public-facing properties; validate with SSL Labs and securityheaders.com |
Every engagement delivers a report like this one — actionable findings, NIST 800-171 mapping, and a clear roadmap your team can execute.