OSift

Detailed View

INFO OSIFT-001 — Discovery: Subdomain

Description: A subdomain belonging to the target organisation was identified through passive or active enumeration (Amass, subfinder, certificate transparency, theHarvester, puredns brute-force).

Impact: Discovered subdomains expand the known attack surface and may reveal development environments, internal tools, or forgotten services that lack production-grade security controls.

Remediation: Review all discovered subdomains for unintended exposure. Ensure internal/development subdomains are not publicly resolvable where unnecessary.

Effort: Low

CVSS Vector: N/A

MITRE ATT&CK: T1590.001 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

INFO OSIFT-002 — Live Host Confirmed

Description: A subdomain or IP address responded to HTTP/HTTPS probing (httpx) or ICMP/TCP and is confirmed to be serving traffic.

Impact: Confirmed live hosts verify that discovered IP addresses are actively serving content, distinguishing real targets from inactive allocations. This narrows the attack surface to actionable targets for subsequent vulnerability scanning.

Remediation: Ensure only intended services are publicly accessible. Review the confirmed host list for shadow IT or forgotten assets.

Effort: Low

CVSS Vector: N/A

MITRE ATT&CK: T1590.001 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

MEDIUM OSIFT-003 — Open Port Identified on Subdomain

Description: A non-standard or sensitive port (e.g., 8080, 8443, 9200, 27017, 3306) was found open on a subdomain via naabu port scanning or Shodan. Exposes additional attack surface.

Impact: Open ports on subdomains expose services that may not receive the same security attention as the primary domain. These services often have default configurations, weak credentials, or unpatched vulnerabilities.

Remediation: Restrict open ports to those strictly required. Apply firewall rules to limit access to sensitive ports (databases, admin panels) by source IP.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

LOW OSIFT-004 — SSL/TLS Certificate Expiring Soon

Description: An SSL/TLS certificate for a discovered host will expire within 30 days. Expiry causes browser security warnings and can disrupt services.

Remediation: Renew the certificate before expiry. Implement automated certificate renewal (e.g., Let's Encrypt with certbot/acme.sh).

CVSS Vector: N/A

HIGH OSIFT-005 — SSL/TLS Certificate: Expired

Description: The server's TLS certificate has passed its expiry date, causing browser trust errors and indicating a breakdown in certificate lifecycle management.

Impact: An expired certificate causes browser warnings that train users to bypass security prompts, and in many configurations disables certificate pinning. An attacker can present their own certificate to users conditioned to click through warnings, enabling silent interception of all encrypted traffic.

Remediation: Renew the certificate immediately and implement automated renewal (e.g., ACME/Let's Encrypt) to prevent future expiry.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

MEDIUM OSIFT-006 — SSL/TLS Certificate Misconfiguration

Description: A certificate was found with a misconfiguration: hostname mismatch, self-signed cert on a public host, wildcard overuse, or weak signing algorithm (MD5/SHA-1).

Remediation: Replace self-signed or mis-issued certificates with certificates from a trusted CA. Use SHA-256 or stronger signing algorithms.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

MEDIUM OSIFT-007 — DNS Misconfiguration

Description: A DNS record anomaly was detected: dangling CNAME, multiple conflicting A records, DNSSEC misconfiguration, or inconsistent NS delegation that could be exploited.

Impact: DNS misconfigurations can enable domain takeover, cache poisoning, or unauthorized zone transfers. An attacker exploiting these weaknesses can redirect traffic, intercept email, or impersonate the organization's services.

Remediation: Audit DNS records for the affected domain. Remove stale or dangling records. Ensure DNSSEC is correctly signed and validated.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NIST 800-53: SC-20, SC-21

PCI DSS 4: 1.3.3

MEDIUM OSIFT-008 — SPF Record Missing

Description: No SPF (Sender Policy Framework) TXT record was found for the target domain. Without SPF, attackers can spoof email from this domain and bypass basic spam filters.

Remediation: Add an SPF TXT record to the domain's DNS: e.g., v=spf1 include:_spf.google.com ~all. Consult your mail provider's documentation.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

MITRE ATT&CK: T1566 (Initial Access), T1036 (Defense Evasion)

NIST 800-53: SC-5, SI-8, SC-8

PCI DSS 4: 12.5.1

MEDIUM OSIFT-009 — DMARC Record Missing

Description: No DMARC (_dmarc.<domain> TXT) record was found. Without DMARC, there is no policy instructing receiving mail servers how to handle unauthenticated email from this domain.

Remediation: Add a DMARC record starting with p=quarantine or p=reject. Example: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

MITRE ATT&CK: T1566 (Initial Access), T1036 (Defense Evasion)

NIST 800-53: SC-5, SI-8, SC-8

PCI DSS 4: 12.5.1

LOW OSIFT-010 — DKIM Configuration Missing

Description: No DKIM (DomainKeys Identified Mail) selector was discoverable for the target domain. Without DKIM, email authentication is weaker and phishing risk increases.

Remediation: Configure DKIM signing on your mail server and publish the public key as a DNS TXT record under <selector>._domainkey.<domain>.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

MITRE ATT&CK: T1566 (Initial Access), T1036 (Defense Evasion)

NIST 800-53: SC-5, SI-8, SC-8

PCI DSS 4: 12.5.1

HIGH OSIFT-011 — Breached Email Address Found

Description: An email address associated with the target organisation appeared in a known data breach (HIBP or Dehashed). The account holder's credentials may have been exposed.

Impact: Email addresses found in breach databases indicate that associated passwords may be available to attackers. Credential reuse across services means these compromised credentials may grant access to the organization's systems.

Remediation: Notify affected employees. Force password resets for all affected accounts. Enable MFA. Review whether compromised accounts have access to sensitive systems.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CRITICAL OSIFT-012 — Plaintext Credential Found in Breach Database

Description: A plaintext or reversibly hashed password was found in a breach database (Dehashed) for a target-domain email address. Direct account compromise may be possible.

Impact: Plaintext credentials from data breaches provide direct access if the user has reused passwords across services. This represents an immediate, exploitable risk requiring urgent password reset and multi-factor authentication enforcement.

Remediation: Immediately force a password reset for the affected account. Check for reuse across other systems (VPN, cloud consoles, O365). Enable MFA on all accounts.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CRITICAL OSIFT-013 — Information Disclosure: Github Secret / API Key

Description: GitDorker or TruffleHog identified a secret, API key, token, or private key in a public GitHub repository associated with the target organisation or its employees.

Remediation: Revoke the exposed secret immediately. Rotate all affected credentials. Scrub the secret from git history (git filter-repo). Enable GitHub secret scanning alerts.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

HIGH OSIFT-014 — M365 Valid User Enumerated

Description: TREVORspray or Azure AD authentication confirmed that a discovered email address is a valid M365/Azure AD account (user exists in the tenant). Confirms the account is a viable spray target.

Remediation: Enable account lockout and smart lockout in Azure AD. Implement Conditional Access policies. Consider disabling legacy authentication protocols.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CRITICAL OSIFT-015 — M365 Valid Credential Found (Credential Spray Success)

Description: TREVORspray successfully authenticated to M365/Azure AD with a discovered credential. Full account access to Microsoft cloud services may be available to an attacker.

Remediation: Immediately revoke the session, reset the password, and enable MFA for the compromised account. Investigate access logs for lateral movement. Review Conditional Access policies.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

HIGH OSIFT-016 — Subdomain Takeover Risk

Description: A subdomain has a CNAME pointing to an external service (e.g., GitHub Pages, S3, Heroku, Shopify) that is no longer claimed. An attacker could register the resource and serve malicious content under the organisation's subdomain.

Remediation: Remove the dangling DNS record immediately. If the external service is still needed, reclaim the resource. Implement subdomain monitoring.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

HIGH OSIFT-017 — DNS Zone Transfer Permitted (AXFR)

Description: The DNS server responds to unauthenticated AXFR zone transfer requests, exposing the complete DNS zone including internal hostnames, IP addresses, and mail infrastructure.

Impact: Permitted zone transfers expose the complete DNS zone contents including all hostnames, IP addresses, and service records. This provides an attacker with a comprehensive map of the organization's infrastructure without active scanning.

Remediation: Restrict zone transfer permissions to authorised secondary name server IP addresses using ACLs in the DNS server configuration.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1590.002 (Reconnaissance), T1018 (Discovery)

NIST 800-53: SC-20, CM-7, AC-3

PCI DSS 4: 1.3.2, 6.5.1

INFO OSIFT-018 — Employee Email Address Harvested

Description: An employee email address was discovered via theHarvester, Hunter.io, LinkedIn, or public sources. Collected addresses support phishing and credential spray attacks.

Remediation: Educate employees on minimising personal information exposure. Implement email security controls (SPF, DKIM, DMARC, anti-phishing).

Effort: Moderate

CVSS Vector: N/A

MITRE ATT&CK: T1598.003 (Reconnaissance), T1589.002 (Reconnaissance)

NIST 800-53: PM-5, PL-4, RA-2

PCI DSS 4: 12.5.1

INFO OSIFT-019 — Web Technology Fingerprint

Description: The technology stack of a live host was identified (Wappalyzer, httpx, whatweb): CMS, web framework, server software, JavaScript libraries, CDN providers. Helps attackers target known vulnerabilities.

Impact: Technology fingerprints reveal the application stack, framework versions, and third-party components. An attacker uses this to target version-specific vulnerabilities and narrow exploit selection to applicable attack vectors.

Remediation: Remove version disclosure from HTTP headers (Server, X-Powered-By). Keep software up to date. Consider a WAF to obscure fingerprinting.

CVSS Vector: N/A

MEDIUM OSIFT-020 — Wayback Machine URL with Sensitive Path

Description: waybackurls or xurlfind3r discovered a historical URL containing a sensitive path (e.g., /admin, /backup, /.env, /config, /api/v1/keys) that was once publicly accessible.

Remediation: Verify whether the resource still exists. Remove sensitive files from public-facing web roots. Review server access logs for recent access to these paths.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

MEDIUM OSIFT-021 — Shodan Exposure — Open Service

Description: Shodan reports an open service on a target IP that is visible to the public internet. Banner data, software version, and service type are indexed and searchable by anyone.

Impact: Shodan-indexed services are visible to any internet user and often reveal version strings, default pages, and configuration details. Attackers routinely search Shodan for exposed services matching known vulnerable versions.

Remediation: Restrict access to services that do not need to be publicly reachable. Apply firewall rules. Update exposed services to current versions.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

HIGH OSIFT-022 — Shodan Exposure — Known CVE on Service

Description: Shodan has associated one or more CVEs with a service running on a target IP based on the service banner and version string. A known public exploit may exist.

Impact: Shodan-indexed services are visible to any internet user and often reveal version strings, default pages, and configuration details. Attackers routinely search Shodan for exposed services matching known vulnerable versions.

Remediation: Patch or update the affected service immediately. If patching is not immediately possible, apply mitigating controls (WAF rule, network restriction).

CVSS Vector: N/A

HIGH OSIFT-023 — Cloud Storage Bucket Found

Description: cloud_enum or manual enumeration discovered a publicly accessible cloud storage bucket (AWS S3, Azure Blob, GCP Storage) associated with the target. It may contain sensitive files.

Remediation: Immediately set the bucket to private unless public access is intentional. Audit bucket contents for sensitive data. Enable bucket access logging and alerts.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

INFO OSIFT-024 — Certificate Transparency Log Entry

Description: A certificate was found in CT logs (crt.sh, Certspotter, Facebook CT) for the target domain. The SAN/CN reveals subdomain names that may not be otherwise discoverable.

Impact: Certificate Transparency logs reveal all certificates ever issued for the domain, exposing subdomain naming patterns, internal service names, and historical infrastructure that may still be accessible.

Remediation: No direct remediation required. Review disclosed subdomains for unintended exposure. Consider certificate issuance monitoring for your domain.

CVSS Vector: N/A

INFO OSIFT-025 — ASN / IP Range Identified

Description: The Autonomous System Number (ASN) and associated IP ranges for the target organisation were identified via BGP data and asnmap. This defines the full network footprint for scanning.

Impact: Identified ASN and IP ranges map the organization's network allocations, revealing hosting providers, data center locations, and the full scope of publicly routable infrastructure that may harbor additional attack surface.

Remediation: No immediate action required. Ensure only intended IP ranges are associated with the organisation's ASN. Review WHOIS/ARIN records for accuracy.

Effort: Low

CVSS Vector: N/A

MITRE ATT&CK: T1590.005 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

INFO OSIFT-026 — WHOIS Data Exposure

Description: WHOIS records for the target domain revealed registrant contact details, nameserver names, registrar information, and registration dates. This information aids in phishing and social engineering.

Impact: WHOIS records may reveal registrant names, email addresses, phone numbers, and physical addresses of domain administrators. This personally identifiable information enables targeted social engineering against infrastructure personnel.

Remediation: Enable WHOIS privacy protection through your registrar for domains where registrant PII should not be public.

CVSS Vector: N/A

INFO OSIFT-027 — LinkedIn Employee Profile Enumerated

Description: Employee names, titles, and organisational roles were enumerated from LinkedIn. This information supports spear-phishing, social engineering, and targeted credential spray attacks.

Remediation: Educate staff on LinkedIn exposure. Implement strict email security (DMARC p=reject). Train employees to recognise spear-phishing.

CVSS Vector: N/A

INFO OSIFT-028 — Social Media Profile Linked to Employee

Description: maigret discovered social media profiles (Twitter, GitHub, Reddit, etc.) linked to an employee username derived from their email address. May reveal personal information useful for social engineering.

Remediation: Assess employee privacy settings. Provide training on personal operational security.

CVSS Vector: N/A

HIGH OSIFT-029 — Sensitive File Found via Web Crawler

Description: katana or xurlfind3r discovered a publicly accessible file containing potentially sensitive data: backup archives (.zip, .bak), configuration files (.env, .config), log files, or database dumps.

Remediation: Remove the file from the web root immediately. Audit web server directory listings. Restrict access to backup and config files via .htaccess or server config.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

LOW OSIFT-030 — HTTP Security Headers Missing

Description: httpx detected missing security headers on a live host: Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, or Referrer-Policy.

Remediation: Add security headers to web server or application configuration. Verify with securityheaders.com.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CRITICAL OSIFT-031 — Weak or Default Credentials Accepted

Description: The target accepted well-known default or factory-set credentials, granting unauthorised access.

Remediation: Replace all default credentials with strong, unique secrets and enforce a password policy prior to any deployment.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5, CM-6

PCI DSS 4: 8.3.1, 2.2.1

CISA KEV

MEDIUM OSIFT-032 — Uncover / Internet-Wide Scan Engine Match

Description: The uncover tool found the target in internet-wide scan engine results (Shodan, Censys, FOFA, Quake360, ZoomEye, CriminalIP). Services and their versions are publicly catalogued.

Remediation: Review all indexed services. Remove unnecessary public exposure. Ensure indexed software versions are patched and up to date.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

LOW OSIFT-033 — Wildcard DNS Record Detected

Description: A wildcard DNS record (*.domain.com) was detected. This causes all subdomains to resolve, which may mask dangling CNAMEs and complicate subdomain takeover detection.

Remediation: Remove wildcard records unless they serve a specific purpose. Document and review all subdomains that rely on wildcard resolution.

Effort: Moderate

CVSS Vector: N/A

NIST 800-53: SC-20, SC-21

PCI DSS 4: 1.3.3

INFO OSIFT-034 — Cloud Service Provider Asset Identified

Description: cloudlist or cdncheck identified assets hosted in cloud or CDN infrastructure (AWS, Azure, GCP, Cloudflare, Fastly, Akamai). Provides context for attack surface mapping.

Remediation: Ensure cloud-hosted assets have appropriate access controls, IAM policies, and logging. Review for misconfigured security groups or ACLs.

Effort: Low

CVSS Vector: N/A

MITRE ATT&CK: T1590.005 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

INFO OSIFT-035 — SEC EDGAR Filing Data Found

Description: Public SEC EDGAR filings for the target company revealed corporate structure, subsidiary entities, executive names, and legal entity identifiers (LEI, CIK). Useful for targeted attacks and social engineering.

Remediation: No direct remediation. Public regulatory filings are legally required for public companies. Ensure security awareness training covers executive impersonation risk.

CVSS Vector: N/A

INFO OSIFT-036 — Third-Party / Supply Chain Domain Identified

Description: Enumeration revealed domains or subdomains associated with third-party services, SaaS providers, or supply chain vendors (identified via CNAME targets, MX records, or certificate SANs).

Remediation: Maintain an inventory of third-party services. Assess vendor security posture. Monitor for supply chain compromise indicators.

Effort: Moderate

CVSS Vector: N/A

OWASP Web: A08:2021 – Software and Data Integrity Failures

MITRE ATT&CK: T1195 (Initial Access)

NIST 800-53: SA-12, SR-3

PCI DSS 4: 12.8.1, 12.8.4

INFO OSIFT-037 — Discovery: Email Address

Description: One or more email addresses associated with the target organisation or its employees were harvested during OSINT enumeration using tools such as theHarvester, Hunter.io, or Phonebook.cz. Exposed email addresses directly enable phishing campaigns, password spray attacks against cloud identity platforms (M365, Google Workspace), and account enumeration. Even a single valid address provides an attacker with a confirmed naming convention from which to infer additional accounts.

Impact: Harvested email addresses enable targeted phishing, credential stuffing against SSO portals, and username enumeration. Email naming conventions reveal the format used for all employees, allowing generation of valid email addresses for the entire organization.

Remediation: Educate employees on minimising professional email exposure in public contexts. Implement robust email security controls including SPF, DKIM, and DMARC at p=reject. Enable anti-phishing and impersonation protection in the email gateway. Monitor for credential spray activity against cloud identity providers.

Effort: Moderate

CVSS Vector: N/A

MITRE ATT&CK: T1598.003 (Reconnaissance), T1589.002 (Reconnaissance)

NIST 800-53: PM-5, PL-4, RA-2

PCI DSS 4: 12.5.1

INFO OSIFT-038 — Discovery: IP Address

Description: One or more IP addresses were mapped to the target organisation's assets through DNS resolution, certificate transparency log analysis, ASN enumeration, WHOIS records, or OSINT sources. Confirmed IP addresses expand the known attack surface beyond the primary domain, enabling direct host scanning, service fingerprinting, and identification of infrastructure not protected by a CDN or application-layer proxy.

Remediation: Reconcile all discovered IP addresses against the authorised asset inventory. Ensure cloud-hosted instances are protected by security groups or firewall rules limiting unnecessary public exposure. Review whether any discovered IPs host unintended or forgotten services.

Effort: Low

CVSS Vector: N/A

MITRE ATT&CK: T1590.005 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

MEDIUM OSIFT-039 — Information Disclosure: Internal Server Directory Structure

Description: Internal filesystem path components were found exposed in publicly accessible sources, including HTTP response bodies, error messages, stack traces, application comments, or historical Wayback Machine snapshots. Exposed paths such as /var/www/app/releases/20231105/, C:\inetpub\wwwroot\api\, or /home/deploy/app/ reveal the server's operating system, directory layout, deployment tooling, and technology stack. This information assists attackers in crafting targeted local file inclusion, path traversal, or directory brute-force payloads.

Remediation: Configure the web application to display generic error pages rather than stack traces or exception details in production. Suppress server-side path information from HTTP response headers and application output. Review Wayback Machine archives for pages that previously revealed directory structure and ensure those resources are no longer publicly accessible.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

INFO OSIFT-040 — Phone Number Pattern Spotted

Description: A pattern matching a telephone number (e.g., +1-555-867-5309, (800) 123-4567) was identified in publicly accessible web content associated with the target domain. Exposed phone numbers can be used to conduct vishing (voice phishing) attacks impersonating employees or IT support, to enumerate internal organisational structure, or to harvest contact information for social engineering campaigns targeting staff.

Impact: Discovered phone numbers enable vishing (voice phishing) and SMS-based social engineering attacks. Combined with employee names and roles from other OSINT sources, phone numbers allow targeted pretexting calls that bypass email security controls entirely.

Remediation: Review whether the exposed telephone number serves a legitimate public-facing business purpose (e.g., a sales or support line). For internal or employee numbers, remove them from public web properties. Conduct security awareness training focused on social engineering and vishing recognition.

Effort: Low

CVSS Vector: N/A

MITRE ATT&CK: T1589.001 (Reconnaissance)

NIST 800-53: PM-5, PL-4, SC-28

PCI DSS 4: 12.5.1

HIGH OSIFT-041 — Potential PII Pattern — Social Security Number Format Detected

Description: Content matching the US Social Security Number format (XXX-XX-XXXX, nine digits with specific separators) was identified in publicly accessible content associated with the target domain or organisation. Exposure of SSN-format data in a publicly reachable location constitutes a potential data breach under US federal and state regulations (HIPAA, state breach notification laws, FTC Act). Even if the values are synthetic or test data, their public exposure indicates a failure in data classification and handling controls.

Remediation: Immediately investigate whether the detected values are real SSNs or test data. If real, initiate incident response per your breach notification obligations (HIPAA, state data breach laws). Remove the file or page containing the data from public access. Implement data loss prevention (DLP) scanning to detect SSN-format strings in web application output and source code repositories. Conduct a broader audit of publicly accessible content for additional PII exposure.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1589 (Reconnaissance)

NIST 800-53: SC-28, PM-5, PL-4

PCI DSS 4: 12.5.1

MEDIUM OSIFT-042 — SSL/TLS Certificate: Self-Signed

Description: A self-signed TLS certificate was identified on a publicly reachable host associated with the target organisation. Self-signed certificates are not anchored to a trusted certificate authority (CA), meaning standard clients — browsers, API consumers, mobile apps — cannot cryptographically verify the server's identity. This condition enables trivial man-in-the-middle attacks: an attacker presenting their own self-signed certificate will produce an identical trust error to the legitimate server, making MITM transparent to users already conditioned to accept the warning.

Impact: Self-signed certificates are not validated by any trusted certificate authority, meaning clients cannot verify the server's identity. An attacker can trivially generate their own self-signed certificate and perform man-in-the-middle attacks without detection.

Remediation: Replace the self-signed certificate with one issued by a publicly trusted CA. For internet-facing services, use Let's Encrypt via ACME automation (certbot, acme.sh, or Caddy) for zero-cost, automatically renewing certificates. For internal services, establish an internal CA with proper trust distribution rather than using ad-hoc self-signed certificates.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

INFO OS-001 — Phone Number Pattern Spotted - Unconfirmed

Impact: Discovered phone numbers enable vishing (voice phishing) and SMS-based social engineering attacks. Combined with employee names and roles from other OSINT sources, phone numbers allow targeted pretexting calls that bypass email security controls entirely.

Remediation: Review publicly accessible pages, metadata, and contact forms for inadvertent phone number exposure. Apply data minimisation principles — only publish contact numbers that need to be public. Monitor external sources with OSINT tooling for leaked PII on a periodic basis.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1589.001 (Reconnaissance)

NIST 800-53: PM-5, PL-4, SC-28

PCI DSS 4: 12.5.1

INFO OS-002 — Social Security pattern detected:

Remediation: Immediately investigate any SSN-pattern strings discovered via OSINT to determine if real data has been exposed. If confirmed, invoke the incident response process, notify affected individuals, and report to relevant data protection authorities under applicable breach notification requirements. Implement DLP controls and audit document stores for improperly shared sensitive identifiers.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1589 (Reconnaissance)

NIST 800-53: SC-28, PM-5, PL-4

PCI DSS 4: 12.5.1

INFO OSIFT-043 — DNS: DMARC record found

Description: A DMARC (Domain-based Message Authentication, Reporting and Conformance) record was found for the domain. DMARC instructs receiving mail servers on how to handle messages that fail SPF and DKIM validation checks.

Impact: A properly configured DMARC record instructs receiving mail servers to reject or quarantine spoofed emails. While this is a positive security control, the DMARC policy details reveal the organization's email authentication architecture and reporting endpoints, which inform phishing campaign design.

Remediation: Ensure DMARC policy is set to 'reject' (p=reject) for maximum protection against email spoofing. Configure aggregate and forensic reporting endpoints to monitor policy violations.

Effort: Easy

LOW OSIFT-044 — DNS: Missing CAA Record

Description: No Certificate Authority Authorization (CAA) DNS record was found for the domain. CAA records restrict which certificate authorities are permitted to issue certificates for the domain.

Impact: Without a CAA record, any certificate authority worldwide can issue certificates for this domain. An attacker who compromises or social-engineers a less-secure CA can obtain a trusted certificate, enabling undetectable man-in-the-middle attacks against the organization's users and services.

Remediation: Add a CAA DNS record specifying the authorized certificate authorities for the domain. Example: 'example.com. IN CAA 0 issue "letsencrypt.org"'. This prevents unauthorized CAs from issuing certificates.

Effort: Easy

NIST 800-53: SC-17

INFO OSIFT-045 — nslookup forward lookup: {record_summary}

Description: Forward DNS lookup enumeration was performed, revealing mail exchange (MX), name server (NS), text (TXT), and other DNS records for the domain.

Impact: DNS record enumeration reveals mail servers, nameservers, SPF policies, and other infrastructure details that map the organization's digital footprint. An attacker uses this data to identify email providers, hosting relationships, and security mechanisms that inform subsequent attack phases.

Remediation: Review DNS records for unnecessary information disclosure. Ensure SPF, DKIM, and DMARC are properly configured. Consider restricting zone transfers and minimizing publicly exposed DNS records.

Effort: Easy

MITRE ATT&CK: T1596.001 (Reconnaissance)

MEDIUM OSIFT-046 — Typosquatting Domain Detected

Description: One or more domains visually or typographically similar to the target domain were detected with active DNS resolution, indicating potential typosquatting infrastructure.

Impact: Typosquatting domains that resolve to active infrastructure can be used for phishing, credential harvesting, or malware distribution targeting the organization's users and customers. An attacker registers domains visually similar to the legitimate domain to intercept mistyped URLs or craft convincing phishing campaigns.

Remediation: Monitor for typosquatting domains using automated tools (dnstwist). Consider registering common misspellings of the domain proactively. Implement DMARC to prevent spoofed emails from look-alike domains. Establish a domain takedown process with registrars.

Effort: Moderate

MITRE ATT&CK: T1583.001 (Resource Development)

INFO OSIFT-047 — DNS: A Record

Description: A record maps a domain to an IPv4 address, revealing the IP infrastructure behind a hostname.

Impact: Exposing A records allows attackers to identify hosting providers, colocated services, and network topology for targeted attacks.

Remediation: Minimize unnecessary A records. Use CDN or proxy services to obscure origin server IPs where appropriate.

Effort: Easy

MITRE ATT&CK: T1596.001 (Reconnaissance)

NIST 800-53: SC-20

INFO OSIFT-048 — DNS: AAAA Record

Description: AAAA record maps a domain to an IPv6 address, revealing dual-stack infrastructure.

Impact: IPv6 records can expose additional attack surface on hosts that may have different firewall rules or monitoring than their IPv4 counterparts.

Remediation: Ensure IPv6 hosts have equivalent security controls to IPv4. Remove AAAA records for services not intentionally dual-stacked.

Effort: Easy

MITRE ATT&CK: T1596.001 (Reconnaissance)

NIST 800-53: SC-20

INFO OSIFT-049 — DNS: MX Record

Description: MX record identifies the mail servers responsible for accepting email for the domain.

Impact: Attackers use MX records to identify email infrastructure, target mail servers for exploitation, and craft phishing campaigns that mimic legitimate mail routing.

Remediation: Ensure MX records point only to authorized mail servers. Implement SPF, DKIM, and DMARC. Remove MX records for domains that do not send or receive email.

Effort: Easy

MITRE ATT&CK: T1596.001 (Reconnaissance)

NIST 800-53: SC-20

INFO OSIFT-050 — DNS: NS Record

Description: NS record identifies the authoritative nameservers for the domain.

Impact: Knowledge of nameservers enables DNS cache poisoning attempts, zone transfer attacks, and helps map the organization's DNS infrastructure and hosting relationships.

Remediation: Use reputable DNS providers with DNSSEC support. Restrict zone transfers to authorized secondaries. Monitor for unauthorized NS record changes.

Effort: Easy

MITRE ATT&CK: T1596.001 (Reconnaissance)

NIST 800-53: SC-20

INFO OSIFT-051 — DNS: TXT Record

Description: TXT records contain arbitrary text data including SPF policies, DKIM keys, domain verification tokens, and service configuration.

Impact: TXT records can leak internal service configurations, reveal third-party integrations (Google Workspace, Microsoft 365, etc.), and expose verification tokens that may enable service takeover.

Remediation: Audit TXT records regularly. Remove obsolete verification tokens. Ensure SPF records use restrictive policies (-all). Implement DKIM and DMARC.

Effort: Easy

MITRE ATT&CK: T1596.001 (Reconnaissance)

NIST 800-53: SC-20

INFO OSIFT-052 — DNS: SOA Record

Description: SOA record contains the primary nameserver, responsible party email, and zone serial/refresh parameters.

Impact: SOA records reveal the primary DNS administrator's contact, zone update frequency, and infrastructure details useful for social engineering and timing attacks around zone refreshes.

Remediation: Ensure SOA contact email does not expose internal personnel. Use reasonable TTL and refresh values.

Effort: Easy

MITRE ATT&CK: T1596.001 (Reconnaissance)

NIST 800-53: SC-20

INFO OSIFT-053 — DNS: CNAME Record

Description: CNAME record creates an alias from one domain to another canonical name.

Impact: CNAME records can reveal internal naming conventions, third-party service dependencies, and may be vulnerable to subdomain takeover if the canonical target is decommissioned.

Remediation: Regularly audit CNAME records for dangling references. Remove CNAMEs pointing to decommissioned services to prevent subdomain takeover.

Effort: Easy

MITRE ATT&CK: T1596.001 (Reconnaissance)

NIST 800-53: SC-20

HIGH OSIFT-054 — GitHub Actions: Workflow Injection Vulnerability

Description: gato identified a GitHub Actions workflow that uses unsanitized expression substitution (${{ }}) with attacker-controlled input (such as issue titles, PR bodies, or commit messages). This allows an attacker to inject arbitrary code that executes in the workflow runner context.

Impact: Workflow injection allows an attacker to execute arbitrary code in the CI/CD environment. This can lead to secret exfiltration (GitHub tokens, deployment keys, API credentials), supply chain compromise (modifying build artifacts), lateral movement to other repositories, and persistent access via self-hosted runner compromise.

Remediation: Use intermediate environment variables instead of direct expression substitution in workflow run steps. Replace ${{ github.event.issue.title }} with an env: block that assigns the value to an environment variable, then reference the variable in the script. Use actions/github-script with the github context object instead of shell interpolation.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1195.002 (Initial Access), T1059 (Execution)

NIST 800-53: SA-11, SI-7

PCI DSS 4: 6.2.4, 6.3.2

HIGH OSIFT-055 — GitHub Actions: Secret Exfiltration Path

Description: gato identified a workflow configuration where secrets are accessible to jobs or steps that process untrusted input. An attacker who can trigger the workflow (via PR, issue, or fork) may be able to exfiltrate secrets through environment variables, workflow artifacts, or out-of-band channels.

Impact: Secret exfiltration from CI/CD pipelines can expose deployment credentials, cloud provider keys, signing certificates, and API tokens. Compromised secrets enable lateral movement to production environments, supply chain attacks via signed releases, and persistent access to organizational infrastructure.

Remediation: Restrict secrets to specific jobs using environment-level scoping. Use OIDC tokens instead of long-lived credentials for cloud authentication. Require approval for workflows triggered by external contributors. Avoid passing secrets to steps that handle untrusted input.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1552.001 (Credential Access), T1195.002 (Initial Access)

NIST 800-53: SC-28, AC-6

PCI DSS 4: 3.5.1, 8.3.1

MEDIUM OSIFT-056 — GitHub Actions: Overly Permissive Permissions

Description: gato identified a GitHub Actions workflow with overly permissive GITHUB_TOKEN permissions (such as write-all, admin, or contents: write). Workflows should follow the principle of least privilege and request only the minimum permissions required for their function.

Impact: Overly permissive workflow tokens increase the blast radius if the workflow is compromised. A write-all token can modify repository contents, create releases, manage issues/PRs, push to protected branches, and modify repository settings. If combined with a workflow injection, an attacker gains full repository control.

Remediation: Apply least-privilege permissions to all workflows. Use the permissions: key at the workflow or job level to request only required scopes (e.g., contents: read, issues: write). Avoid write-all or admin permissions.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

MITRE ATT&CK: T1078.004 (Persistence)

NIST 800-53: AC-6

PCI DSS 4: 7.2.1

MEDIUM OSIFT-057 — GitHub Actions: Self-Hosted Runner Risk

Description: gato identified self-hosted GitHub Actions runners configured on a public repository. Self-hosted runners in public repos are dangerous because any user can submit a pull request that triggers a workflow run on the runner, potentially executing arbitrary code in the organization's infrastructure.

Impact: Self-hosted runners on public repos allow any GitHub user to execute code on the organization's infrastructure by submitting a crafted pull request. This can lead to lateral movement into internal networks, credential theft from the runner environment, persistence via runner modification, and access to other repositories that share the same runner group.

Remediation: Use ephemeral/disposable runners for public repositories. Restrict self-hosted runners to private repos only. If self-hosted runners must be used on public repos, enable the 'Require approval for all outside collaborators' setting and use separate runner groups with restricted repository access.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1195.002 (Initial Access)

NIST 800-53: AC-6, SC-7

PCI DSS 4: 7.2.1

INFO OSIFT-058 — GitHub Actions: Audit Complete — No Issues

Description: gato completed a security audit of the target organization's GitHub Actions workflows and found no injection vulnerabilities, secret exfiltration paths, excessive permissions, or self-hosted runner risks.

Impact: No security issues were identified in the GitHub Actions configuration. This is a positive finding indicating that CI/CD workflows follow security best practices for the areas audited.

Remediation: No remediation required. Continue to audit workflows periodically, especially when new workflows are added or existing ones are modified.

Effort: Easy

NIST 800-53: SA-11

HIGH OSIFT-059 — CDN/WAF Bypass: Origin IP Exposed

Description: hakoriginfinder discovered the origin server IP address behind the CDN/WAF. The origin IP responds to HTTP requests directly, bypassing all CDN/WAF protections (rate limiting, DDoS mitigation, WAF rules, geo-blocking, bot detection). The origin was confirmed by matching response characteristics to the target domain.

Impact: Direct access to the origin server bypasses all CDN/WAF security controls. An attacker can launch DDoS attacks directly against the origin, exploit web application vulnerabilities without WAF interference, bypass rate limiting and bot detection, and circumvent geo-blocking or IP-based access controls. The origin server may also expose internal services or management interfaces not intended to be publicly accessible.

Remediation: Restrict the origin server firewall to accept connections only from CDN/WAF edge IP ranges. Use the CDN provider's published IP lists (e.g., Cloudflare IPs, AWS CloudFront IPs) in firewall rules. Block all direct access to the origin from non-CDN sources. Consider using authenticated origin pulls (mTLS between CDN and origin).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1590.005 (Reconnaissance)

NIST 800-53: SC-7, SC-5

PCI DSS 4: 1.3.1, 6.4.1

MEDIUM OSIFT-060 — CDN/WAF Bypass: Potential Origin IP

Description: hakoriginfinder identified an IP address that may be the origin server behind the CDN/WAF. The IP responded to HTTP requests with content that partially matches the target domain (e.g., 2xx/3xx status code with related content). Further verification is needed to confirm this is the actual origin.

Impact: If this IP is confirmed as the origin server, an attacker can bypass all CDN/WAF protections. Even as a candidate, it reveals infrastructure information that narrows the attack surface and may identify related services, staging environments, or development servers.

Remediation: Verify whether this IP is the actual origin server. If confirmed, restrict its firewall to accept connections only from CDN edge IPs. If it is a staging or development server, ensure it is not publicly accessible.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1590.005 (Reconnaissance)

NIST 800-53: SC-7

PCI DSS 4: 1.3.1

INFO OSIFT-061 — CDN/WAF Bypass: No Origin Exposure

Description: hakoriginfinder scanned for the origin server IP behind the CDN/WAF and found no exposed origin IPs. The CDN/WAF appears to properly protect the origin server from direct access.

Impact: The CDN/WAF is correctly protecting the origin server. No direct access paths were discovered during the scan.

Remediation: No remediation required. Continue to ensure origin server firewall restricts access to CDN edge IPs only.

Effort: Easy

NIST 800-53: SC-7

INFO OSIFT-062 — Historical Endpoints Discovered

Description: waymore discovered historical endpoints for the target domain across multiple web archive sources (Wayback Machine, Common Crawl, VirusTotal, URLScan.io, AlienVault OTX). These URLs represent the domain's historical web presence and may include endpoints that are no longer publicly linked but still accessible.

Impact: Historical endpoints can reveal previously accessible admin panels, configuration pages, backup files, development endpoints, and API routes. Even if removed from the current site, these endpoints may still respond to requests. Archived URLs also reveal the application's evolution, naming conventions, and internal structure.

Remediation: Review discovered endpoints and remove or restrict access to any that should not be publicly accessible. Implement proper authentication and authorization controls on all endpoints.

Effort: Moderate

CVSS Vector: N/A

OWASP API: API9:2023 Improper Inventory Management

MITRE ATT&CK: T1596.005 (Reconnaissance)

NIST 800-53: CM-8

MEDIUM OSIFT-063 — Sensitive Historical URL Discovered

Description: waymore discovered historical URLs matching security-sensitive patterns (admin, config, debug, backup, test, internal, setup, install, phpinfo, .env, wp-admin, phpmyadmin) in web archive data. These URLs may indicate administrative interfaces, configuration files, or backup resources that were previously accessible and may still respond to requests.

Impact: Sensitive historical URLs may reveal admin panels that still respond, configuration files with credentials, database backups, installation wizards that can be replayed, debug pages with verbose error output, and internal API documentation. These represent high-value targets for an attacker who can access them directly.

Remediation: Remove sensitive endpoints from production. Add authentication to admin panels. Delete backup and configuration files from web-accessible directories. Disable debug/install/setup endpoints in production. Request removal of sensitive cached pages from web archives where possible.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A01:2025 Broken Access Control

OWASP API: API9:2023 Improper Inventory Management

MITRE ATT&CK: T1596.005 (Reconnaissance), T1190 (Initial Access)

NIST 800-53: AC-6, CM-7

PCI DSS 4: 6.2.4, 6.4.1

LOW OSIFT-064 — Historical API Endpoint

Description: waymore discovered API endpoints in web archive data (/api/, /v1/, /v2/, /graphql, /rest/, /ws/, /webhook). These endpoints may represent current or deprecated API surfaces that can be probed for authentication bypasses, information disclosure, or injection vulnerabilities.

Impact: Historical API endpoints reveal the application's API structure, versioning scheme, and endpoint naming conventions. Deprecated API versions may lack security controls applied to current versions. API endpoints are high-value targets for authentication bypass, injection, and data exfiltration.

Remediation: Decommission deprecated API versions. Ensure all API endpoints require proper authentication and authorization. Maintain an up-to-date API inventory and remove endpoints that are no longer needed.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

MITRE ATT&CK: T1596.005 (Reconnaissance)

NIST 800-53: CM-8

PCI DSS 4: 6.3.2

LOW OSIFT-065 — Document Metadata: Internal Username Leaked

Description: exiftool extracted an internal username from the Author or Creator metadata field of a publicly accessible document. This username may correspond to an internal Active Directory account, email address, or application login credential.

Impact: Leaked usernames enable targeted phishing, credential stuffing, and password spraying attacks. Internal usernames often follow predictable patterns (first.last, flast) that allow enumeration of additional accounts. Combined with other OSINT, usernames can be used for social engineering or to identify high-value targets (executives, administrators).

Remediation: Strip metadata from all documents before publishing. Use document management policies that automatically remove Author, Creator, and other identifying metadata fields. Configure document creation tools to use generic or organizational names instead of personal usernames.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1589.003 (Reconnaissance), T1592.004 (Reconnaissance)

NIST 800-53: SI-12, AC-6

PCI DSS 4: 3.4.1

INFO OSIFT-066 — Document Metadata: Software Version Disclosed

Description: exiftool extracted the software name and version from the Creator or Producer metadata field of a publicly accessible document. This reveals the specific applications used to create or modify the document, including version numbers that may be checked against known vulnerability databases.

Impact: Software version disclosure enables targeted vulnerability research. An attacker who knows the exact version of Microsoft Office, Adobe Acrobat, or other document creation tools can search for version-specific CVEs, craft targeted exploits, and identify outdated software that may be vulnerable to known attacks.

Remediation: Strip metadata from documents before publishing. This is informational and does not require urgent remediation.

Effort: Easy

CVSS Vector: N/A

MITRE ATT&CK: T1592.004 (Reconnaissance)

NIST 800-53: CM-8

LOW OSIFT-067 — Document Metadata: Internal File Path Leaked

Description: exiftool extracted an internal file system path (such as C:\Users\jsmith\Documents\... or /home/admin/reports/...) from a publicly accessible document's metadata. This reveals the internal directory structure, operating system, and potentially the username of the document creator.

Impact: Internal file paths reveal the organization's operating system, directory structure, username conventions, and internal project names. This information assists in crafting targeted phishing payloads, identifying high-value targets, and planning post-exploitation activities. Path structures can also reveal development vs. production environments.

Remediation: Strip metadata from all documents before publishing. Use metadata removal tools (exiftool -all=, mat2) as part of the document publishing workflow. Configure document templates to avoid embedding local file paths.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1592.004 (Reconnaissance)

NIST 800-53: SI-12

PCI DSS 4: 3.4.1

INFO OSIFT-068 — Document Metadata: Email Address Leaked

Description: exiftool extracted an email address from the metadata of a publicly accessible document. This email may belong to the document's author, reviewer, or the organization's document management system.

Impact: Email addresses extracted from document metadata can be used for targeted phishing, social engineering, and email-based attacks. They may also reveal internal email naming conventions that allow enumeration of additional email addresses across the organization.

Remediation: Strip metadata from documents before publishing. This is informational — email addresses may already be publicly available through other channels.

Effort: Easy

CVSS Vector: N/A

MITRE ATT&CK: T1589.002 (Reconnaissance)

NIST 800-53: SI-12

MEDIUM OSIFT-069 — Document Metadata: GPS Coordinates Leaked

Description: exiftool extracted GPS coordinates from the EXIF metadata of a publicly accessible image or document. This reveals the physical location where the photo was taken or the document was created, which may include office locations, employee residences, or sensitive facility coordinates.

Impact: GPS coordinates in publicly accessible documents can reveal office locations, data center addresses, employee home locations, and other sensitive physical locations. This information enables physical surveillance, social engineering, and targeted attacks against specific facilities. For individuals, leaked GPS data from personal photos represents a privacy violation.

Remediation: Strip EXIF GPS data from all images and documents before publishing. Configure mobile devices and cameras to disable GPS tagging. Use metadata removal tools (exiftool -gps:all=, mat2) as part of the content publishing workflow.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1591.001 (Reconnaissance)

NIST 800-53: SI-12, MP-5

PCI DSS 4: 3.4.1

INFO OSIFT-070 — Document Metadata: Audit Summary

Description: exiftool completed a metadata audit of publicly accessible documents found during reconnaissance. This finding summarizes the total number of documents analyzed, metadata fields extracted, and categories of information discovered across all scanned documents.

Impact: This is a summary finding providing an overview of the document metadata analysis. Individual findings for specific metadata disclosures (usernames, software versions, file paths, GPS data) are reported separately.

Remediation: Review individual document metadata findings for specific remediation actions. Implement organization-wide metadata stripping policies for all publicly published documents.

Effort: Easy

NIST 800-53: SI-12