OpenVAPT Self-Assessment Report
lab-hardened (simulated) - Ubuntu 24.04.1 LTS - 2026-10-16 02:10 UTC
OpenVAPT is an academic, non-commercial project with source-available code built by AI Cybersecurity Engineers (AI systems, not people or registered engineers). This report was produced by automated, read-only checks run by the user on their own machine, for their own use, 100% at their own risk. It is not a penetration test, an audit, a certification, a service or professional advice, and it may be wrong or incomplete. The developers accept no responsibility or liability for any decision taken from it. OpenVAPT may not be sold or used to provide services. No data from this report was sent anywhere.
Executive Summary
Scope: this report covers one machine, lab-hardened (simulated), assessed on 2026-10-16 02:10 UTC, with root access. 310 checks ran, read-only and limited to this machine.
Result: 0 checks failed (0 Critical, 0 High, 0 Medium, 0 Low, 0 Info) and 310 passed. No checks failed and every check completed; this is still an automated self-assessment, not proof the machine is free of weaknesses.
Vulnerability snapshot: 2026-10-16 (0 days old, 7 advisories).
Limitation: this is an automated, read-only self-assessment, not a penetration test. A clean result does not prove the machine is free of weaknesses.
0Critical
0High
0Medium
0Low
310Passed
0Incomplete
0Incomplete Targets
0Skipped
0Errors
| Scope | This machine only (310 checks, sites: shop.example.test) |
|---|---|
| Run As Root | Yes |
| Tool | OpenVAPT v0.1.0-dev (commit unknown) Pre-Release: dev |
| Vulnerability Data | Snapshot 2026-10-16, 0 days old, 7 advisories |
Top 5 Risks
| ID | Risk | Severity | CVSS | Why It Matters |
|---|
Risk Heat Map
Failed checks by security control area and severity.
| Category | Critical | High | Medium | Low | Info |
|---|---|---|---|---|---|
| Identity and Authentication | 0 | 0 | 0 | 0 | 0 |
| Access Control | 0 | 0 | 0 | 0 | 0 |
| Patch and Vulnerability Management | 0 | 0 | 0 | 0 | 0 |
| Secure Configuration | 0 | 0 | 0 | 0 | 0 |
| Cryptography and TLS | 0 | 0 | 0 | 0 | 0 |
| Logging and Monitoring | 0 | 0 | 0 | 0 | 0 |
| Network Exposure | 0 | 0 | 0 | 0 | 0 |
| Data Services | 0 | 0 | 0 | 0 | 0 |
| Web Application Security | 0 | 0 | 0 | 0 | 0 |
| Information Exposure | 0 | 0 | 0 | 0 | 0 |
Compliance Coverage
Coverage shows mapped automated checks and does not certify compliance.
| Framework | Safeguard or Subcategory | Checks Run | Failed | Passed |
|---|---|---|---|---|
| CIS Controls v8 | 2.2 | 5 | 0 | 5 |
| CIS Controls v8 | 2.5 | 1 | 0 | 1 |
| CIS Controls v8 | 3.3 | 51 | 0 | 51 |
| CIS Controls v8 | 3.10 | 23 | 0 | 23 |
| CIS Controls v8 | 4.1 | 75 | 0 | 75 |
| CIS Controls v8 | 4.3 | 1 | 0 | 1 |
| CIS Controls v8 | 4.4 | 6 | 0 | 6 |
| CIS Controls v8 | 4.7 | 1 | 0 | 1 |
| CIS Controls v8 | 4.8 | 24 | 0 | 24 |
| CIS Controls v8 | 5.2 | 23 | 0 | 23 |
| CIS Controls v8 | 5.3 | 1 | 0 | 1 |
| CIS Controls v8 | 5.4 | 5 | 0 | 5 |
| CIS Controls v8 | 7.3 | 8 | 0 | 8 |
| CIS Controls v8 | 7.4 | 5 | 0 | 5 |
| CIS Controls v8 | 8.2 | 11 | 0 | 11 |
| CIS Controls v8 | 8.3 | 4 | 0 | 4 |
| CIS Controls v8 | 8.4 | 1 | 0 | 1 |
| CIS Controls v8 | 8.5 | 5 | 0 | 5 |
| CIS Controls v8 | 8.9 | 1 | 0 | 1 |
| CIS Controls v8 | 16.2 | 1 | 0 | 1 |
| CIS Controls v8 | 16.7 | 58 | 0 | 58 |
| NIST CSF 2.0 | DE.CM-09 | 1 | 0 | 1 |
| NIST CSF 2.0 | ID.RA-01 | 18 | 0 | 18 |
| NIST CSF 2.0 | ID.RA-08 | 1 | 0 | 1 |
| NIST CSF 2.0 | PR.AA-01 | 25 | 0 | 25 |
| NIST CSF 2.0 | PR.AA-05 | 56 | 0 | 56 |
| NIST CSF 2.0 | PR.DS-01 | 51 | 0 | 51 |
| NIST CSF 2.0 | PR.DS-02 | 23 | 0 | 23 |
| NIST CSF 2.0 | PR.IR-01 | 30 | 0 | 30 |
| NIST CSF 2.0 | PR.PS-01 | 158 | 0 | 158 |
| NIST CSF 2.0 | PR.PS-02 | 18 | 0 | 18 |
| NIST CSF 2.0 | PR.PS-04 | 22 | 0 | 22 |
| NIST CSF 2.0 | PR.PS-05 | 1 | 0 | 1 |
Prioritised Remediation Plan
High-severity, low-effort quick wins appear first.
Findings
No check failed. This does not prove the machine is secure; see Limitations.
Coverage Gaps
Incomplete, Error and Skipped checks did not establish that the affected area is secure. Review the reason and rerun with the required access or corrected configuration.
| ID | Status | Affected Area and Reason |
|---|
All Checks
| ID | Title | Category | Effort | Severity | Status |
|---|---|---|---|---|---|
HOST-CTR-001 | Docker API Exposed Over TCP Without TLS | Network Exposure | Low | Critical | Pass |
HOST-CVE-002 | Known Exploited Vulnerabilities Present | Patch and Vulnerability Management | Medium | Critical | Pass |
HOST-K8S-001 | Kubelet Allows Anonymous or Unauthorised Access | Identity and Authentication | Medium | Critical | Pass |
HOST-SSH-003 | SSH Permits Empty Passwords | Identity and Authentication | Low | Critical | Pass |
NET-DB-002 | Redis Authentication and Network Binding | Data Services | Low | Critical | Pass |
NET-DB-003 | MongoDB Authorization and Network Binding | Data Services | Low | Critical | Pass |
NET-DB-004 | PostgreSQL Trust and Broad Client Access | Data Services | Low | Critical | Pass |
NET-DB-007 | Elasticsearch Security and Network Binding | Data Services | Low | Critical | Pass |
NET-SVC-002 | Control Plane or Remote Desktop Ports Network-Reachable | Network Exposure | Medium | Critical | Pass |
WEB-EXP-002 | Environment or Secrets File Exposed | Information Exposure | Medium | Critical | Pass |
WEB-NODE-002 | Node.js Debugger (Inspector) Enabled in a Service | Secure Configuration | Low | Critical | Pass |
WEB-PY-004 | Python Interactive Debugger Enabled in a Service | Secure Configuration | Low | Critical | Pass |
WEB-TOM-002 | Tomcat Administrative Users With Default or Weak Passwords | Identity and Authentication | Low | Critical | Pass |
WEB-TOM-004 | Tomcat AJP Connector Unprotected (Ghostcat) | Web Application Security | Low | Critical | Pass |
HOST-CRON-001 | Cron Jobs Run Programs Other Users Can Modify | Access Control | Low | High | Pass |
HOST-CRON-002 | World-Writable Directory in Cron's PATH | Access Control | Low | High | Pass |
HOST-CTR-003 | Privileged or Host-Namespace Containers | Secure Configuration | Medium | High | Pass |
HOST-CTR-004 | Containers Mount the Docker Socket or Host Root | Access Control | Medium | High | Pass |
HOST-CTR-008 | Docker Socket Accessible to Non-Administrators | Access Control | Low | High | Pass |
HOST-CTR-011 | Seccomp or AppArmor Disabled for Containers | Secure Configuration | Medium | High | Pass |
HOST-CTR-014 | containerd Remote API or Podman Unconfined Defaults | Secure Configuration | Medium | High | Pass |
HOST-CVE-001 | Installed OS Packages With Known Vulnerabilities | Patch and Vulnerability Management | Medium | High | Pass |
HOST-DKR-001 | Users With Root-Equivalent Docker Access | Identity and Authentication | Medium | High | Pass |
HOST-FS-001 | Sensitive Account Files Have Unsafe Permissions | Access Control | Low | High | Pass |
HOST-FS-002 | Temporary Directory Missing the Sticky Bit | Access Control | Low | High | Pass |
HOST-FS-003 | World-Writable Files in System Configuration | Access Control | Medium | High | Pass |
HOST-FS-004 | Unexpected SUID or SGID Programs | Access Control | Medium | High | Pass |
HOST-FS-005 | Cron Files Writable by Non-Root Users | Access Control | Low | High | Pass |
HOST-FS-007 | Private TLS Keys Readable by Others | Cryptography and TLS | Low | High | Pass |
HOST-FS-022 | Account Database Files or Their Backups Not Owned and Locked by Root | Access Control | Low | High | Pass |
HOST-K8S-002 | Kubernetes Data Directory Accessible to Others | Access Control | Low | High | Pass |
HOST-K8S-003 | Kubernetes Credential Files Readable by Others | Identity and Authentication | Low | High | Pass |
HOST-OS-001 | Operating System Past End of Security Support | Patch and Vulnerability Management | High | High | Pass |
HOST-PKG-001 | Security Updates Waiting to Be Installed | Patch and Vulnerability Management | Medium | High | Pass |
HOST-PKG-002 | Repository Signature Checks Disabled | Patch and Vulnerability Management | Low | High | Pass |
HOST-SEC-001 | Secrets in World-Readable Files | Information Exposure | Medium | High | Pass |
HOST-SSH-001 | SSH Allows Direct Root Login | Identity and Authentication | Low | High | Pass |
HOST-SSH-009 | SSH Host Private Keys Readable by Others | Cryptography and TLS | Low | High | Pass |
HOST-SSH-010 | SSH Server Configuration Writable by Non-Root Users | Access Control | Low | High | Pass |
HOST-SYSD-003 | Service Unit Files Writable by Non-Root Users | Access Control | Low | High | Pass |
HOST-SYSD-004 | Service Programs in Writable Locations | Access Control | Low | High | Pass |
HOST-USR-001 | Extra Accounts With Root Privileges (UID 0) | Identity and Authentication | Medium | High | Pass |
HOST-USR-002 | Accounts Without a Password | Identity and Authentication | Low | High | Pass |
HOST-USR-003 | Sudo Rules Without Password (NOPASSWD) | Identity and Authentication | Low | High | Pass |
HOST-USR-007 | Insecure Trust Files in Home Directories | Identity and Authentication | Low | High | Pass |
NET-AI-001 | AI Model Server or Dashboard Reachable From the Network | Network Exposure | Low | High | Pass |
NET-AI-002 | Jupyter Configuration Weakens Authentication | Identity and Authentication | Low | High | Pass |
NET-APP-001 | Debugger or Application Control Ports Exposed | Network Exposure | Low | High | Pass |
NET-DB-001 | Database or Cache Service Exposed to the Network | Data Services | Low | High | Pass |
NET-DB-005 | MySQL or MariaDB Unsafe Network Options | Data Services | Low | High | Pass |
NET-DB-006 | Memcached UDP or Broad Listen Address | Data Services | Low | High | Pass |
NET-DB-008 | Unsafe NFS Export Options | Data Services | Low | High | Pass |
NET-DB-009 | Unsafe Samba Guest or SMB1 Configuration | Data Services | Low | High | Pass |
NET-DB-010 | BIND Open Recursion | Data Services | Low | High | Pass |
NET-DB-011 | BIND Zone Transfers Allowed to Any | Data Services | Low | High | Pass |
NET-DB-012 | Postfix Open Relay Controls | Data Services | Low | High | Pass |
NET-FW-002 | IPv6 Listeners Without IPv6 Firewall | Network Exposure | Medium | High | Pass |
NET-FW-003 | Firewall Allows Sensitive Services From Anywhere | Network Exposure | Low | High | Pass |
NET-SVC-001 | Cleartext Legacy Services Listening | Network Exposure | Medium | High | Pass |
NET-SVC-003 | Network Time Service Amplification Risk | Network Exposure | Low | High | Pass |
WEB-APA-005 | Apache Allows TLS 1.0 or 1.1 | Cryptography and TLS | Low | High | Pass |
WEB-APA-006 | Apache Cipher Suite Includes Weak Suites | Cryptography and TLS | Low | High | Pass |
WEB-APP-001 | Laravel Debug Mode On or Application Key Missing | Information Exposure | Low | High | Pass |
WEB-APP-003 | Symfony Running in the Development Environment | Information Exposure | Low | High | Pass |
WEB-APP-004 | Rails Master Key or Secrets File Exposed | Access Control | Low | High | Pass |
WEB-APP-006 | Spring Boot Actuator Endpoints Fully Exposed | Information Exposure | Low | High | Pass |
WEB-CMS-004 | CMS Configuration Readable by All Users | Access Control | Low | High | Pass |
WEB-CMS-005 | CMS Configuration Writable by Other Users | Access Control | Low | High | Pass |
WEB-CMS-012 | Drupal Core Past End of Life | Patch and Vulnerability Management | High | High | Pass |
WEB-CMS-014 | Joomla Core Past End of Life | Patch and Vulnerability Management | High | High | Pass |
WEB-CMS-019 | Drupal update.php Open Without Authentication | Secure Configuration | Low | High | Pass |
WEB-CVE-001 | Vulnerable Web Application Libraries | Patch and Vulnerability Management | Medium | High | Pass |
WEB-DOC-001 | Secrets or Backups Stored Inside a Web Root | Information Exposure | Low | High | Pass |
WEB-DOC-002 | Web Root Files Writable by Other Users | Access Control | Low | High | Pass |
WEB-EXP-001 | Git Repository Exposed on the Website | Information Exposure | Low | High | Pass |
WEB-EXP-004 | Backup or Database Dump Files Downloadable | Information Exposure | Low | High | Pass |
WEB-EXP-007 | Other Version Control Metadata Exposed | Information Exposure | Low | High | Pass |
WEB-EXP-008 | Log Files Downloadable From the Website | Information Exposure | Low | High | Pass |
WEB-EXP-012 | Framework Debug Pages Exposed | Information Exposure | Low | High | Pass |
WEB-NGX-003 | nginx Allows TLS 1.0 or 1.1 | Cryptography and TLS | Low | High | Pass |
WEB-NGX-004 | nginx Cipher List Includes Weak Suites | Cryptography and TLS | Low | High | Pass |
WEB-NODE-001 | Node.js Version Past End of Life | Patch and Vulnerability Management | High | High | Pass |
WEB-PHP-003 | PHP Allows Remote File Inclusion | Secure Configuration | Low | High | Pass |
WEB-PHP-004 | PHP Version Past End of Security Support | Patch and Vulnerability Management | High | High | Pass |
WEB-PY-001 | Django Debug Mode Enabled | Information Exposure | Low | High | Pass |
WEB-PY-003 | Django Uses the Generated Development Secret Key | Cryptography and TLS | Low | High | Pass |
WEB-TOM-001 | Tomcat Manager Reachable Without Address Restriction | Web Application Security | Low | High | Pass |
HOST-BOOT-001 | Boot Loader Has No Password | Access Control | Medium | Medium | Pass |
HOST-BOOT-002 | UEFI Secure Boot Disabled | Secure Configuration | High | Medium | Pass |
HOST-BOOT-003 | Uncommon Filesystem Modules Not Disabled | Secure Configuration | Low | Medium | Pass |
HOST-BOOT-004 | USB Storage Driver Not Disabled | Secure Configuration | Low | Medium | Pass |
HOST-BOOT-006 | No File Integrity Monitoring | Logging and Monitoring | Medium | Medium | Pass |
HOST-CTR-002 | Docker Daemon Not Hardened | Secure Configuration | Medium | Medium | Pass |
HOST-CTR-010 | Docker Daemon Allows Insecure Registries or Debug Features | Secure Configuration | Low | Medium | Pass |
HOST-CTR-012 | Containers Run Without Memory or Process Limits | Secure Configuration | Medium | Medium | Pass |
HOST-CTR-013 | Containers Run as Root With a Writable Root Filesystem | Secure Configuration | Medium | Medium | Pass |
HOST-FS-006 | Boot Loader Configuration Exposed | Access Control | Low | Medium | Pass |
HOST-FS-014 | World-Writable Files Outside Temporary Directories | Access Control | Low | Medium | Pass |
HOST-FS-016 | SUID or SGID Programs Outside the Known Baseline | Access Control | Medium | Medium | Pass |
HOST-FS-017 | World-Writable Directories Without the Sticky Bit | Access Control | Low | Medium | Pass |
HOST-KRN-001 | Address Space Layout Randomisation Not Fully Enabled | Secure Configuration | Low | Medium | Pass |
HOST-KRN-009 | Unprivileged eBPF Allowed | Secure Configuration | Low | Medium | Pass |
HOST-PAM-008 | Root PATH Contains Unsafe Entries | Identity and Authentication | Low | Medium | Pass |
HOST-PKG-005 | Running Kernel Older Than Installed Kernel | Patch and Vulnerability Management | Medium | Medium | Pass |
HOST-PWD-001 | Weak Password Hashing Algorithm Configured | Identity and Authentication | Low | Medium | Pass |
HOST-PWD-002 | Accounts With Obsolete Password Hashes | Identity and Authentication | Low | Medium | Pass |
HOST-PWD-004 | No Account Lockout After Failed Logins | Identity and Authentication | Medium | Medium | Pass |
HOST-SSH-002 | SSH Password Authentication Enabled | Identity and Authentication | Low | Medium | Pass |
HOST-SSH-004 | SSH Offers Weak Cryptography | Cryptography and TLS | Low | Medium | Pass |
HOST-SSH-007 | SSH Forwarding Features Enabled | Secure Configuration | Low | Medium | Pass |
HOST-SSH-011 | SSH Legacy Trust Options Enabled | Identity and Authentication | Low | Medium | Pass |
HOST-SVC-002 | Telnet Server Installed or Enabled | Secure Configuration | Low | Medium | Pass |
HOST-SVC-003 | rsh, rlogin, rexec or finger Server Installed or Enabled | Secure Configuration | Low | Medium | Pass |
HOST-SVC-004 | TFTP Server Installed or Enabled | Secure Configuration | Low | Medium | Pass |
HOST-SVC-005 | FTP Server Installed or Enabled | Secure Configuration | Low | Medium | Pass |
HOST-SVC-006 | NIS Server or Client Installed or Enabled | Secure Configuration | Low | Medium | Pass |
HOST-SYSD-001 | Custom Services Run as Root | Identity and Authentication | Medium | Medium | Pass |
HOST-SYSD-005 | Secrets Written Into Service Unit Files | Information Exposure | Low | Medium | Pass |
HOST-UPD-002 | Reboot Required to Apply Updates | Patch and Vulnerability Management | Medium | Medium | Pass |
HOST-USR-004 | Duplicate User IDs | Identity and Authentication | Medium | Medium | Pass |
HOST-USR-006 | Legacy NIS Entries in Account Files | Identity and Authentication | Low | Medium | Pass |
HOST-USR-008 | Duplicate Group IDs or Account Names | Identity and Authentication | Medium | Medium | Pass |
HOST-USR-009 | Password and Shadow Files Out of Step | Identity and Authentication | Low | Medium | Pass |
NET-APP-002 | Application Server Ports Reachable Without a Reverse Proxy | Network Exposure | Low | Medium | Pass |
NET-DB-013 | Mail Cleartext Authentication Allowed | Cryptography and TLS | Low | Medium | Pass |
NET-DB-014 | MySQL Symbolic Links Allowed for Tables | Data Services | Low | Medium | Pass |
NET-DB-015 | MySQL secure_file_priv Not Restricted | Data Services | Low | Medium | Pass |
NET-DB-016 | MySQL Does Not Require Encrypted Client Connections | Cryptography and TLS | Low | Medium | Pass |
NET-DB-019 | PostgreSQL Uses md5 or password Authentication | Identity and Authentication | Low | Medium | Pass |
NET-DB-020 | PostgreSQL SSL Not Enabled | Cryptography and TLS | Low | Medium | Pass |
NET-DB-022 | PostgreSQL Password Encryption Not SCRAM | Identity and Authentication | Low | Medium | Pass |
NET-DB-023 | Redis Dangerous Commands Not Restricted | Data Services | Low | Medium | Pass |
NET-DNS-002 | BIND DNSSEC Validation Disabled | Data Services | Low | Medium | Pass |
NET-FW-001 | No Active Host Firewall | Network Exposure | Medium | Medium | Pass |
NET-FW-005 | Container Ports Bypass the Host Firewall | Network Exposure | Medium | Medium | Pass |
NET-MAIL-001 | Postfix SMTP TLS Not Offered or Has No Certificate | Cryptography and TLS | Low | Medium | Pass |
NET-MAIL-002 | Postfix Allows TLS 1.0 or 1.1 | Cryptography and TLS | Low | Medium | Pass |
NET-MAIL-004 | Dovecot Does Not Require TLS | Cryptography and TLS | Low | Medium | Pass |
NET-SVC-004 | Management Panel or Monitoring Ports Network-Reachable | Network Exposure | Low | Medium | Pass |
NET-TLS-001 | Deprecated TLS 1.0 or 1.1 Accepted | Cryptography and TLS | Low | Medium | Pass |
NET-TLS-002 | TLS Certificate Expired or Expiring Soon | Cryptography and TLS | Low | Medium | Pass |
NET-TLS-003 | Self-Signed or Mismatched TLS Certificate | Cryptography and TLS | Low | Medium | Pass |
NET-TLS-004 | Weak TLS 1.2 Cipher Suites Accepted | Cryptography and TLS | Low | Medium | Pass |
NET-TLS-005 | TLS Certificate Public Key Too Small | Cryptography and TLS | Medium | Medium | Pass |
NET-TLS-006 | SHA-1 Signed TLS Leaf Certificate | Cryptography and TLS | Medium | Medium | Pass |
WEB-APA-003 | Apache Directory Indexes Enabled in Configuration | Information Exposure | Low | Medium | Pass |
WEB-APA-011 | Apache Has No Slow Request Protection | Secure Configuration | Low | Medium | Pass |
WEB-APP-002 | Application .env File Readable by All Users | Access Control | Low | Medium | Pass |
WEB-APP-005 | Rails Production Does Not Force HTTPS | Web Application Security | Low | Medium | Pass |
WEB-APP-009 | Git Repository Stored Inside a Web Root | Information Exposure | Low | Medium | Pass |
WEB-APP-010 | Framework Writable Folders Open to All Users | Access Control | Low | Medium | Pass |
WEB-CK-001 | Cookies Missing Secure, HttpOnly or SameSite | Web Application Security | Medium | Medium | Pass |
WEB-CMS-006 | WordPress Shows Debug Output to Visitors | Information Exposure | Low | Medium | Pass |
WEB-CMS-008 | WordPress Automatic Updates Disabled | Patch and Vulnerability Management | Low | Medium | Pass |
WEB-CMS-009 | Joomla Debug or Verbose Error Reporting Enabled | Information Exposure | Low | Medium | Pass |
WEB-CMS-013 | Drupal Trusted Host Patterns Not Set | Web Application Security | Low | Medium | Pass |
WEB-CMS-015 | Magento Not in Production Mode | Information Exposure | Low | Medium | Pass |
WEB-CMS-016 | Ghost Configured With a Plain HTTP Site URL | Web Application Security | Low | Medium | Pass |
WEB-COR-001 | Cross-Origin Resource Sharing Allows Any Origin With Credentials | Web Application Security | Low | Medium | Pass |
WEB-DOC-003 | Archives or Certificates Inside a Web Root | Information Exposure | Low | Medium | Pass |
WEB-EXP-003 | PHP Information Page Exposed | Information Exposure | Low | Medium | Pass |
WEB-EXP-005 | Directory Listing Enabled | Information Exposure | Low | Medium | Pass |
WEB-EXP-006 | Web Server Status Page Exposed | Information Exposure | Low | Medium | Pass |
WEB-EXP-011 | Database Administration Tool Exposed | Information Exposure | Low | Medium | Pass |
WEB-HDR-001 | Missing HTTP Strict Transport Security (HSTS) | Web Application Security | Low | Medium | Pass |
WEB-HDR-002 | Missing Content Security Policy | Web Application Security | Medium | Medium | Pass |
WEB-HDR-003 | Site Can Be Framed (Clickjacking) | Web Application Security | Low | Medium | Pass |
WEB-NGX-002 | nginx Directory Listing Enabled in Configuration | Information Exposure | Low | Medium | Pass |
WEB-NGX-007 | nginx Serves Hidden Files and Folders | Information Exposure | Low | Medium | Pass |
WEB-PHP-001 | PHP Displays Errors to Visitors | Secure Configuration | Low | Medium | Pass |
WEB-PHP-005 | PHP Session Cookies Not Hardened | Web Application Security | Low | Medium | Pass |
WEB-PY-002 | Django Accepts Any Host Header | Web Application Security | Low | Medium | Pass |
WEB-PY-005 | Python Development Server Used in a Service | Secure Configuration | Medium | Medium | Pass |
WEB-TLS-001 | Site Available Over Plain HTTP Without Redirect | Cryptography and TLS | Low | Medium | Pass |
WEB-TOM-003 | Tomcat Shutdown Port Uses the Default Command | Secure Configuration | Low | Medium | Pass |
WEB-TOM-005 | Tomcat Example and Documentation Applications Deployed | Information Exposure | Low | Medium | Pass |
HOST-AUD-001 | Audit Daemon Not Enabled at Boot | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-002 | Identity Files Not Audited | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-003 | Login and Logout Events Not Audited | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-004 | System Time Changes Not Audited | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-005 | Kernel Module Loading Not Audited | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-006 | Privileged Command Use Not Audited | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-007 | Audit Configuration Not Immutable | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-008 | Audit Log Files Readable by Others | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-009 | Audit Daemon Ignores a Full Log Disk | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-010 | Journal Not Persistent or Not Compressed | Logging and Monitoring | Low | Low | Pass |
HOST-AUD-011 | Logs Not Forwarded to a Remote Collector | Logging and Monitoring | Medium | Low | Pass |
HOST-BOOT-005 | Kernel Module Loading Unrestricted | Secure Configuration | Medium | Low | Pass |
HOST-BOOT-007 | Prelink Installed | Secure Configuration | Low | Low | Pass |
HOST-BOOT-008 | Core Dumps Not Restricted | Information Exposure | Low | Low | Pass |
HOST-CTR-005 | Docker Container Logs Have No Size Limit | Logging and Monitoring | Low | Low | Pass |
HOST-CTR-006 | Docker Userland Proxy Enabled | Secure Configuration | Low | Low | Pass |
HOST-CTR-007 | Docker Default Ulimits Not Set | Secure Configuration | Low | Low | Pass |
HOST-CTR-015 | Docker Content Trust Not Enabled | Secure Configuration | Medium | Low | Pass |
HOST-CVE-003 | Vulnerability Snapshot Outdated or Test Data | Patch and Vulnerability Management | Medium | Low | Pass |
HOST-FS-008 | Temporary Filesystems Allow Executables or Devices | Secure Configuration | Medium | Low | Pass |
HOST-FS-009 | Default File Creation Mask Too Permissive | Access Control | Low | Low | Pass |
HOST-FS-010 | /var/tmp Not a Separate Filesystem | Secure Configuration | Medium | Low | Pass |
HOST-FS-011 | /home Not a Separate Filesystem With nodev | Secure Configuration | Medium | Low | Pass |
HOST-FS-012 | Log Directories on the Root Filesystem | Secure Configuration | Medium | Low | Pass |
HOST-FS-013 | Temporary Filesystems Allow Executables | Secure Configuration | Medium | Low | Pass |
HOST-FS-015 | Files With No Known Owner or Group | Access Control | Low | Low | Pass |
HOST-FS-018 | Kernel Symbol Map or Initial RAM Disk Readable by Others | Information Exposure | Low | Low | Pass |
HOST-FS-019 | Cron and At Not Restricted to Allowed Users | Access Control | Low | Low | Pass |
HOST-FS-020 | Cron Configuration Readable by Other Users | Access Control | Low | Low | Pass |
HOST-FS-021 | Shell Profile Sets a Permissive File Creation Mask | Access Control | Low | Low | Pass |
HOST-IDS-001 | No Brute-Force Protection Service | Logging and Monitoring | Low | Low | Pass |
HOST-KRN-002 | Kernel Pointers Exposed to Unprivileged Users | Secure Configuration | Low | Low | Pass |
HOST-KRN-003 | Kernel Log Readable by Unprivileged Users | Secure Configuration | Low | Low | Pass |
HOST-KRN-004 | Setuid Programs May Dump Core | Secure Configuration | Low | Low | Pass |
HOST-KRN-005 | IP Forwarding Enabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-006 | ICMP Redirects Accepted | Secure Configuration | Low | Low | Pass |
HOST-KRN-007 | Source-Routed Packets Accepted | Secure Configuration | Low | Low | Pass |
HOST-KRN-008 | TCP SYN Cookies Disabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-010 | Process Tracing Not Restricted | Secure Configuration | Low | Low | Pass |
HOST-KRN-011 | Symlink Protection Disabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-012 | Hardlink Protection Disabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-013 | Reverse Path Filtering Disabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-014 | Martian Packets Not Logged | Secure Configuration | Low | Low | Pass |
HOST-KRN-015 | Server Sends ICMP Redirects | Secure Configuration | Low | Low | Pass |
HOST-KRN-016 | Broadcast ICMP Echo Answered | Secure Configuration | Low | Low | Pass |
HOST-KRN-017 | IPv6 ICMP Redirects Accepted | Secure Configuration | Low | Low | Pass |
HOST-KRN-018 | Performance Events Open to Unprivileged Users | Secure Configuration | Low | Low | Pass |
HOST-KRN-019 | Magic SysRq Key Enabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-020 | FIFO Protection in Shared Directories Disabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-021 | Regular File Protection in Shared Directories Disabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-022 | Unprivileged User Namespaces Allowed | Secure Configuration | Low | Low | Pass |
HOST-KRN-023 | IPv6 Source-Routed Packets Accepted | Secure Configuration | Low | Low | Pass |
HOST-KRN-024 | Secure ICMP Redirects Accepted | Secure Configuration | Low | Low | Pass |
HOST-KRN-025 | IPv6 Router Advertisements Accepted | Secure Configuration | Low | Low | Pass |
HOST-KRN-026 | Bogus ICMP Error Responses Logged | Secure Configuration | Low | Low | Pass |
HOST-KRN-027 | Kexec Kernel Replacement Allowed | Secure Configuration | Low | Low | Pass |
HOST-KRN-028 | Unprivileged userfaultfd Allowed | Secure Configuration | Low | Low | Pass |
HOST-KRN-029 | TTY Line Discipline Autoloading Enabled | Secure Configuration | Low | Low | Pass |
HOST-KRN-030 | BPF JIT Hardening Off | Secure Configuration | Low | Low | Pass |
HOST-KRN-031 | io_uring Open to Unprivileged Users | Secure Configuration | Low | Low | Pass |
HOST-LOG-001 | System Logging Not Persistent | Logging and Monitoring | Low | Low | Pass |
HOST-LOG-002 | Security Audit Daemon Not Running | Logging and Monitoring | Medium | Low | Pass |
HOST-LOG-003 | Security Logs Readable by All Users | Logging and Monitoring | Low | Low | Pass |
HOST-LOG-004 | Log Rotation Not Configured | Logging and Monitoring | Low | Low | Pass |
HOST-MAC-001 | No Mandatory Access Control Enforced | Secure Configuration | High | Low | Pass |
HOST-PAM-001 | Password Quality Module Not Enforced | Identity and Authentication | Low | Low | Pass |
HOST-PAM-002 | Account Lockout Releases Too Quickly | Identity and Authentication | Low | Low | Pass |
HOST-PAM-003 | su Not Restricted to an Administrative Group | Identity and Authentication | Low | Low | Pass |
HOST-PAM-004 | Password History Not Enforced | Identity and Authentication | Low | Low | Pass |
HOST-PAM-005 | Minimum Password Age Not Set | Identity and Authentication | Low | Low | Pass |
HOST-PAM-007 | Inactive Accounts Never Locked | Identity and Authentication | Low | Low | Pass |
HOST-PAM-009 | No Shell Idle Timeout | Identity and Authentication | Low | Low | Pass |
HOST-PKG-004 | Many Old Kernels Retained | Patch and Vulnerability Management | Low | Low | Pass |
HOST-PKG-006 | Package Lists Not Refreshed Automatically | Patch and Vulnerability Management | Low | Low | Pass |
HOST-PWD-003 | Short Minimum Password Length | Identity and Authentication | Low | Low | Pass |
HOST-SSH-005 | SSH X11 Forwarding Enabled | Secure Configuration | Low | Low | Pass |
HOST-SSH-006 | SSH Allows Many Authentication Attempts | Identity and Authentication | Low | Low | Pass |
HOST-SSH-008 | SSH Authentication Controls Too Permissive | Identity and Authentication | Low | Low | Pass |
HOST-SSH-012 | SSH Logging Level Too Low | Logging and Monitoring | Low | Low | Pass |
HOST-SSH-013 | SSH Authorized Keys Without Restrictions or Protection | Identity and Authentication | Low | Low | Pass |
HOST-SUDO-001 | Sudo Commands Not Logged to a Dedicated File | Logging and Monitoring | Low | Low | Pass |
HOST-SVC-001 | Unnecessary Legacy Services Running | Secure Configuration | Low | Low | Pass |
HOST-SVC-007 | Avahi or CUPS Installed or Enabled | Secure Configuration | Low | Low | Pass |
HOST-SVC-008 | NFS Server or rpcbind Installed or Enabled | Secure Configuration | Low | Low | Pass |
HOST-SVC-009 | DHCP or DNS Server Installed or Enabled | Secure Configuration | Low | Low | Pass |
HOST-SVC-010 | Samba File Server Installed or Enabled | Secure Configuration | Low | Low | Pass |
HOST-SVC-011 | SNMP Agent or Squid Proxy Installed or Enabled | Secure Configuration | Low | Low | Pass |
HOST-SVC-012 | inetd Super-Server Installed or Enabled | Secure Configuration | Low | Low | Pass |
HOST-SYSD-002 | Custom Services Lack Sandboxing | Secure Configuration | Medium | Low | Pass |
HOST-TIME-001 | Time Synchronisation Not Active | Logging and Monitoring | Low | Low | Pass |
HOST-UPD-001 | Automatic Security Updates Not Configured | Patch and Vulnerability Management | Low | Low | Pass |
HOST-USR-005 | System Accounts With Login Shells | Identity and Authentication | Low | Low | Pass |
HOST-USR-010 | Home Directories Accessible to Other Users | Access Control | Low | Low | Pass |
NET-DB-017 | MySQL Error Log Not Configured | Logging and Monitoring | Low | Low | Pass |
NET-DB-018 | MySQL Resolves Client Host Names | Data Services | Low | Low | Pass |
NET-DB-021 | PostgreSQL Connection Logging Off | Logging and Monitoring | Low | Low | Pass |
NET-DNS-001 | BIND Version String Disclosed | Information Exposure | Low | Low | Pass |
NET-FW-004 | Firewall Rules Open Ports With No Service | Network Exposure | Low | Low | Pass |
NET-MAIL-003 | Postfix VRFY Command Enabled | Information Exposure | Low | Low | Pass |
WEB-APA-001 | Apache Reveals Version in Header and Footer | Information Exposure | Low | Low | Pass |
WEB-APA-002 | Apache TRACE Method Enabled | Secure Configuration | Low | Low | Pass |
WEB-APA-004 | Apache AllowOverride All Permits .htaccess Control | Secure Configuration | Low | Low | Pass |
WEB-APA-007 | Apache OCSP Stapling Not Enabled | Cryptography and TLS | Low | Low | Pass |
WEB-APA-009 | Apache ETag Reveals Inode Numbers | Information Exposure | Low | Low | Pass |
WEB-APA-010 | Apache Serves Repository and Environment Files | Information Exposure | Low | Low | Pass |
WEB-APP-007 | Flask Debug Mode Enabled in Application Code | Secure Configuration | Low | Low | Pass |
WEB-CMS-001 | WordPress Version Disclosed | Information Exposure | Low | Low | Pass |
WEB-CMS-002 | WordPress XML-RPC Interface Enabled | Web Application Security | Low | Low | Pass |
WEB-CMS-003 | WordPress User Accounts Enumerable | Information Exposure | Low | Low | Pass |
WEB-CMS-007 | WordPress Dashboard File Editor Enabled | Secure Configuration | Low | Low | Pass |
WEB-CMS-010 | Joomla Version Disclosed | Information Exposure | Low | Low | Pass |
WEB-CMS-011 | Drupal Version Disclosed by Changelog | Information Exposure | Low | Low | Pass |
WEB-CMS-018 | WordPress Author Archive Reveals Login Names | Information Exposure | Low | Low | Pass |
WEB-EXP-009 | Dependency Manifests Exposed | Information Exposure | Low | Low | Pass |
WEB-EXP-010 | Default Web Server Page Served | Information Exposure | Low | Low | Pass |
WEB-HDR-004 | Missing X-Content-Type-Options | Web Application Security | Low | Low | Pass |
WEB-HDR-005 | Missing Referrer-Policy | Web Application Security | Low | Low | Pass |
WEB-HDR-006 | Missing Permissions-Policy | Web Application Security | Low | Low | Pass |
WEB-HDR-007 | Server Software Version Disclosed | Information Exposure | Low | Low | Pass |
WEB-NGX-001 | nginx Version Shown in Server Header | Information Exposure | Low | Low | Pass |
WEB-NGX-005 | nginx OCSP Stapling Off or Session Tickets On | Cryptography and TLS | Low | Low | Pass |
WEB-NODE-003 | Node.js Service Not Running in Production Mode | Secure Configuration | Low | Low | Pass |
WEB-PHP-002 | PHP Version Exposed in Headers | Information Exposure | Low | Low | Pass |
HOST-CTR-009 | Docker Not Running in Rootless Mode | Secure Configuration | High | Info | Pass |
HOST-PAM-006 | Password Expiry Warning Too Short | Identity and Authentication | Low | Info | Pass |
HOST-PKG-003 | Third-Party Package Repositories Present | Patch and Vulnerability Management | Medium | Info | Pass |
HOST-PWD-005 | Forced Periodic Password Rotation Configured | Identity and Authentication | Low | Info | Pass |
NET-FW-006 | Firewall Exposure Map of Listening Services | Network Exposure | Low | Info | Pass |
NET-LSN-001 | Inventory of Listening Network Services | Network Exposure | Low | Info | Pass |
WEB-APA-008 | Apache Has No Request Filtering Module | Secure Configuration | Low | Info | Pass |
WEB-APP-008 | Dependency Lock Files Older Than a Year | Patch and Vulnerability Management | Medium | Info | Pass |
WEB-CMS-017 | WordPress Cron Reachable by Visitors | Secure Configuration | Low | Info | Pass |
WEB-NGX-006 | nginx Request Limits Not Configured | Secure Configuration | Low | Info | Pass |
WEB-SEC-001 | No security.txt Contact File | Web Application Security | Low | Info | Pass |
Methodology
- Scope: this machine only. Every network connection is restricted in code to loopback addresses (127.0.0.0/8, ::1). No other host was contacted.
- Approach: automated, non-intrusive vulnerability assessment following the Planning, Discovery and Reporting phases of NIST SP 800-115 (its four phases are Planning, Discovery, Attack and Reporting); the Attack phase is omitted and no exploitation was attempted.
- Discovery: configuration files, /proc and /sys were read; a short allow-list of read-only commands was run (for example sshd -T and apt-get -s upgrade, which only simulates).
- Web: websites were discovered from the local web server configuration and requested through 127.0.0.1 with GET requests for fixed paths only. No forms were submitted and no attack payloads were sent.
- Rating: each check carries a qualitative severity on the CVSS v3.1 scale with a representative base vector. Environmental factors on your network may raise or lower the real risk. Detective gaps such as missing logging, auditing or integrity monitoring carry a local attack vector: a missing record opens no network path, it makes a separate intrusion harder to trace.
- Evidence: secrets (passwords, keys, tokens, hashes) were redacted before writing this report.
Limitations
- An automated self-assessment is not a penetration test. It does not prove that the machine is secure; absence of findings is not proof of absence of vulnerabilities.
- Only the checks listed in this report were performed. Application logic flaws (for example SQL injection, broken access control or business logic errors) require manual testing or code review.
- Some checks need root to read protected files or the real daemon state. A check that could not read what it needed is marked Skipped (it did not apply or could not start) or Incomplete (it ran, but part of its input was unreadable, truncated or missing); neither is a Pass.
- Results reflect the machine at the time of the scan. Configuration drift after the scan is not covered.
- End-of-life and version tables are dated and may be out of date for releases newer than this version of OpenVAPT.
- This report was produced by a pre-release build of OpenVAPT (Unreleased Build, v0.1.0-dev). Pre-release builds may be incomplete or wrong; confirm important findings by hand.
How to Cite
Report generated by OpenVAPT (unreleased build) on 2026-10-16. Using these results in research, teaching or a report? Please cite OpenVAPT.
APA 7: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version unreleased build) [Computer software]. https://github.com/OpenVAPT/openvapt
BibTeX:
@software{openvapt_2026,
author = {{OpenVAPT}},
title = {{OpenVAPT: An Open Academic Vulnerability Assessment Tool}},
year = {2026},
version = {unreleased build},
url = {https://github.com/OpenVAPT/openvapt},
note = {Built by AI Cybersecurity Engineers. https://openvapt.com},
license = {LicenseRef-OpenVAPT-SAL-1.3}
}
Credit when you share this report: Produced with OpenVAPT (https://openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Use does not imply endorsement.
Generated locally by OpenVAPT. Nothing in this report was sent anywhere.