Blind pentest against dev build on k3s #61

Closed
opened 2026-09-09 13:57:25 +00:00 by poslop · 1 comment
Owner

Adversarial black-box pentest of the running dev deployment. Tester gets NO source access and NO knowledge of prior findings or fixes. Attack surface is the live HTTP service only.

Target: palette on goyplex-vm k3s (namespace palette, ClusterIP 10.43.175.20:80, host palette.archfox.org).

Scope: anything reachable over HTTP(S): input validation, auth bypass, injection, XSS, path handling, races, rate-limit evasion, info disclosure. Live-verify every finding with a repro.

Report: severity, finding, repro, impact. File followup issues for confirmed bugs.

Adversarial black-box pentest of the running dev deployment. Tester gets NO source access and NO knowledge of prior findings or fixes. Attack surface is the live HTTP service only. Target: palette on goyplex-vm k3s (namespace palette, ClusterIP 10.43.175.20:80, host palette.archfox.org). Scope: anything reachable over HTTP(S): input validation, auth bypass, injection, XSS, path handling, races, rate-limit evasion, info disclosure. Live-verify every finding with a repro. Report: severity, finding, repro, impact. File followup issues for confirmed bugs.
Author
Owner

Round 1 complete. All findings fixed and merged into v0.2.1 (deployed to prod + dev on k3s): #63 critical delete auth (live-verified 403 on dev), #58/#62 burn race, #65 listing leak, #66 admin ratelimit, #67 app-side headers (via #76; Traefik-side HSTS/host-redirect tracked separately in #67), #68 validation. Round 2 verification pentest tracked in the new issue.

Round 1 complete. All findings fixed and merged into v0.2.1 (deployed to prod + dev on k3s): #63 critical delete auth (live-verified 403 on dev), #58/#62 burn race, #65 listing leak, #66 admin ratelimit, #67 app-side headers (via #76; Traefik-side HSTS/host-redirect tracked separately in #67), #68 validation. Round 2 verification pentest tracked in the new issue.
Sign in to join this conversation.