Reconnaissance Report

1. Engagement Scope

This reconnaissance was conducted under authorization from Northgate Freight Lines Ltd. The scope is strictly limited to the following two hosts. No other systems were probed, scanned, or interacted with.

Excluded hosts: 77.91.123.159, 45.92.170.247 (out of scope, not touched).

2. Methodology

All activities were strictly limited to passive and active reconnaissance. No exploitation, credential testing, or system modifications were performed during this phase.

3. Host 1 — Web Application Server

3.1 Open Ports & Services

3.2 HTTP Response Headers

3.3 Security Observations

• Minimal attack surface: Only 2 TCP ports exposed (SSH + HTTP). No UDP services detected.
• HTTP without TLS: All web traffic transmitted in cleartext. Credentials and session tokens vulnerable to interception.
• Missing security headers: No X-Frame-Options, CSP, HSTS, or X-Content-Type-Options headers configured.
• Current software: OpenSSH 9.6p1 and Apache 2.4.58 are recent, patched versions.
• PHP application: FleetLink logistics portal identified. Technology stack: Apache + PHP on Ubuntu.

4. Host 2 — Domain Controller

4.1 Open Ports & Services

Note: 6 additional ephemeral/dynamic ports (52284, 52285, 52291, 52300, 52337, 59415, 59416) were detected but could not be fingerprinted. These are standard Windows RPC dynamic port allocations.

4.2 RDP NTLM Information

Extracted via nmap --script=rdp-ntlm-info:

5. Active Directory Enumeration

5.1 Domain Information

5.2 SMB Share Enumeration

Anonymous/null session login was accepted, but all shares returned access denied:

5.3 LDAP Enumeration

• Anonymous rootDSE: Accessible — returned 5 naming contexts, server capabilities, and supported SASL mechanisms.
• Data queries: Require authenticated bind. Anonymous queries return Operations error.
• SASL mechanisms: GSSAPI, GSS-SPNEGO, DIGEST-MD5.
• Global Catalog: Ready on port 3268 (confirmed via rootDSE).

5.4 DNS Enumeration

• Zone transfer (AXFR): Blocked — transfer failed.
• SRV records: Confirm sole DC, PDC, and Global Catalog on 185.69.123.75.
• MX records: None configured (no mail server on this DC).
• NS records: Self-referential (185.69.123.75).
• Recursion: Enabled — open DNS resolver vulnerability.

5.5 Services Not Detected

6. Security Posture Assessment

6.1 Domain Controller Hardening

6.2 Web Server Hardening

7. Security Findings

The following findings were identified during reconnaissance. No exploitation was performed.

8. Network Topology

                    Internet
                       |
          +------------+------------+
          |                         |
  185.69.122.185            185.69.123.75
  (Linux / Ubuntu)         (Windows Server 2022)
  ┌─────────────────┐      ┌──────────────────────────┐
  │ 22/tcp  SSH     │      │ 53/tcp   DNS             │
  │ 80/tcp  HTTP    │      │ 88/tcp   Kerberos        │
  │                 │      │ 135/tcp  MSRPC           │
  │ Apache 2.4.58   │      │ 139/tcp  NetBIOS         │
  │ OpenSSH 9.6p1   │      │ 389/tcp  LDAP            │
  │ PHP FleetLink   │      │ 445/tcp  SMB 3.1.1       │
  │                 │      │ 464/tcp  kpasswd5         │
  └─────────────────┘      │ 593/tcp  RPC/HTTP        │
                           │ 636/tcp  LDAPS           │
                           │ 3268/tcp GC LDAP         │
                           │ 3269/tcp GC LDAPS        │
                           │ 3389/tcp RDP (NLA)       │
                           │ 5985/tcp WinRM HTTP      │
                           │ 5986/tcp WinRM HTTPS [F] │
                           │ 9389/tcp ADWS            │
                           │ +5 ephemeral MSRPC ports  │
                           └──────────────────────────┘
                           Domain: northgatefreight.ca
                           NetBIOS: NORTHGATE
                           Role: Sole DC / PDC / GC
  

9. Caveats & Limitations

• Reconnaissance only: This report covers external reconnaissance findings exclusively. No exploitation, credential testing, or authenticated enumeration was performed during this phase.
• UDP scanning: Full UDP port scanning was not performed due to time constraints. UDP services (e.g., SNMP on 161, NTP on 123) may exist but were not probed.
• Security products: No antivirus, EDR, or endpoint protection agents were identified from external scanning. This does not confirm their absence — they may be running but are not externally visible. Internal enumeration would be required to confirm.
• Password policy: Domain password policy could not be enumerated anonymously. Requires authenticated access to determine minimum length, complexity, lockout threshold, and lockout duration.
• Domain SID: The domain SID could not be obtained via null session due to hardened configuration. Requires authenticated LDAP or SMB access.
• Internal network: No internal network mapping was possible from the external perspective. Additional hosts, segments, or VLANs may exist behind the firewall.
• Ephemeral ports: Dynamic RPC ports on the DC change between scans. The specific port numbers listed are valid at time of scan only.
• LDAPS certificates: Ports 636 and 3269 returned tcpwrapped, preventing certificate inspection from the external perspective.
• WinRM HTTPS: Port 5986 is filtered externally. It may be accessible from the internal network.