Neinvazivní pentest. Každý test se pokusí prolomit izolaci a reportuje výsledek. Vygenerováno 2026-08-27 12:28:19 · JSON
PASS 32 FAIL 1 WARN 8 INFO 12
| Verdict | Test | Detail |
|---|---|---|
| PASS | Process runs as unprivileged user | uid=1249 euid=1249 user=s_intevia.cloud_jail |
| PASS | Linux capabilities dropped | CapEff=0000000000000000 CapBnd=0000000000000000 |
| PASS | NoNewPrivs set (no setuid escalation) | NoNewPrivs=1 |
| PASS | Seccomp syscall filter active | Seccomp=2 (filtered(BPF)) |
| Verdict | Test | Detail |
|---|---|---|
| PASS | Cross-tenant path hidden: /srv/www/d_intevia.cz/s_www/wwwroot/wp-config.php | not visible in namespace |
| PASS | Cross-tenant path hidden: /srv/www/d_taxana.cz/s_www/wwwroot/wp-config.php | not visible in namespace |
| PASS | Cross-tenant path hidden: /storage/volume1/www/d_polna.cz | not visible in namespace |
| PASS | Cross-tenant path hidden: /srv/www/d_intevia.cloud/admin | not visible in namespace |
| PASS | Sensitive host path blocked: /etc/shadow | fopen(/etc/shadow): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /etc/ssh/sshd_config | fopen(/etc/ssh/sshd_config): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /etc/caddy/Caddyfile | fopen(/etc/caddy/Caddyfile): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /srv/scripts | fopen(/srv/scripts): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /root/.ssh/id_rsa | fopen(/root/.ssh/id_rsa): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /root/.bash_history | fopen(/root/.bash_history): Failed to open stream: Permission denied |
| INFO | /etc/passwd exposure (info) | readable — enumerates system users |
| PASS | Write blocked outside jail: /etc/_jail_probe_282057 | read-only / not present |
| PASS | Write blocked outside jail: /srv/www/d_intevia.cz/_jail_probe | read-only / not present |
| PASS | Write blocked outside jail: /usr/_jail_probe | read-only / not present |
| PASS | Write blocked outside jail: /var/_jail_probe | read-only / not present |
| INFO | Write allowed inside jail wwwroot (expected) | writable (expected) |
| PASS | Symlink out of jail cannot be dereferenced | symlink made but target unreadable (ns blocks it) |
| INFO | open_basedir setting (info) | not set (relying on kernel mount namespace instead) |
| Verdict | Test | Detail |
|---|---|---|
| PASS | No other-user processes visible (ProtectProc/hidepid) | only own pool PIDs visible (same uid, 9) |
| PASS | PrivateTmp isolates /tmp | /tmp entries: 0 |
| PASS | Device node absent: /dev/mem | not present |
| PASS | Device node absent: /dev/sda | not present |
| PASS | Device node absent: /dev/kmsg | not present |
| PASS | Device node absent: /dev/kcore | not present |
| INFO | Mount table (info) | visible mount lines: 86 |
| Verdict | Test | Detail |
|---|---|---|
| INFO | disable_functions coverage | disabled: exec,passthru,shell_exec,system,pcntl_exec,pcntl_fork,proc_nice,dl | still callable: popen,proc_open,mail |
| WARN | Shell reachable via proc_open (not in disable_functions) medium |
id => uid=1249(s_intevia.cloud_jail) gid=1258(s_intevia.cloud_jail) groups=1258(s_intevia.cloud_jail),1007(sftp-users) |
| PASS | exec()d child stays inside mount namespace | child sees only jail (ls /srv/www => 'd_intevia.cloud') |
| Verdict | Test | Detail |
|---|---|---|
| WARN | Egress — DNS/TCP to internet (1.1.1.1:53) medium |
CONNECTED — outbound egress permitted (SSRF/exfil surface) |
| WARN | Egress — HTTPS/TCP to internet (1.1.1.1:443) medium |
CONNECTED — outbound egress permitted (SSRF/exfil surface) |
| PASS | Cloud metadata endpoint unreachable | unreachable (Connection timed out (110)) |
| INFO | Internal service reachable — MySQL (127.0.0.1:3306) | closed (Connection refused (111)) |
| INFO | Internal service reachable — Postgres (127.0.0.1:5432) | closed (Connection refused (111)) |
| WARN | Internal service reachable — Redis (127.0.0.1:6379) high |
CONNECTED — reachable from jail (no PrivateNetwork) |
| WARN | Internal service reachable — Caddy admin API (127.0.0.1:2019) high |
CONNECTED — reachable from jail (no PrivateNetwork) |
| INFO | Internal service reachable — node_exporter (127.0.0.1:9100) | closed (Connection refused (111)) |
| WARN | Internal service reachable — Grafana (127.0.0.1:3000) medium |
CONNECTED — reachable from jail (no PrivateNetwork) |
| INFO | Internal service reachable — Loki (127.0.0.1:3100) | closed (Connection refused (111)) |
| PASS | Other tenants' PHP-FPM sockets not connectable | 87 foreign sockets visible but none connectable |
| INFO | DNS resolution (info) | resolves (104.20.23.154) |
| Verdict | Test | Detail |
|---|---|---|
| INFO | cgroup limits enforced (read-only, not stress-tested) | MemoryMax=n/a MemoryHigh=n/a TasksMax=n/a CPUQuota=n/a |
| INFO | PHP memory_limit | memory_limit=128M max_execution_time=30s |
| Verdict | Test | Detail |
|---|---|---|
| FAIL | Redis requires auth (no cross-tenant cache access) high |
PING => '+PONG' — UNAUTH access to shared Redis (cross-tenant cache/session read-write) |
| PASS | MySQL not reachable | closed (Connection refused) |
| WARN | Caddy admin API not usable from jail high |
reachable ('HTTP/1.0 403 Forbidden') — reconfig surface; move admin to a unix socket |
| PASS | No internal LAN reachability (SSRF depth) | sampled RFC1918 gateways unreachable |
| Verdict | Test | Detail |
|---|---|---|
| WARN | Environment variables free of secrets medium |
suspicious env keys: AUTH_TYPE |
| PASS | display_errors off (no verbose errors to client) | display_errors=0 |
| PASS | No FFI extension (native memory / exec bypass) | ffi not loaded (present: imagick) |