Neinvazivní pentest. Každý test se pokusí prolomit izolaci a reportuje výsledek. Vygenerováno 2026-09-01 16:20:42 · JSON
PASS 34 FAIL 0 WARN 4 INFO 15
| Verdict | Test | Detail |
|---|---|---|
| PASS | Process runs as unprivileged user | uid=1249 euid=1249 user=s_intevia.cloud_jail |
| PASS | Linux capabilities dropped | CapEff=0000000000000000 CapBnd=0000000000000000 |
| PASS | NoNewPrivs set (no setuid escalation) | NoNewPrivs=1 |
| PASS | Seccomp syscall filter active | Seccomp=2 (filtered(BPF)) |
| Verdict | Test | Detail |
|---|---|---|
| PASS | Cross-tenant path hidden: /srv/www/d_intevia.cz/s_www/wwwroot/wp-config.php | not visible in namespace |
| PASS | Cross-tenant path hidden: /srv/www/d_taxana.cz/s_www/wwwroot/wp-config.php | not visible in namespace |
| PASS | Cross-tenant path hidden: /storage/volume1/www/d_polna.cz | not visible in namespace |
| PASS | Cross-tenant path hidden: /srv/www/d_intevia.cloud/admin | not visible in namespace |
| PASS | Sensitive host path blocked: /etc/shadow | fopen(/etc/shadow): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /etc/ssh/sshd_config | fopen(/etc/ssh/sshd_config): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /etc/caddy/Caddyfile | fopen(/etc/caddy/Caddyfile): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /srv/scripts | fopen(/srv/scripts): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /root/.ssh/id_rsa | fopen(/root/.ssh/id_rsa): Failed to open stream: Permission denied |
| PASS | Sensitive host path blocked: /root/.bash_history | fopen(/root/.bash_history): Failed to open stream: Permission denied |
| INFO | /etc/passwd exposure (info) | readable — enumerates system users |
| PASS | Write blocked outside jail: /etc/_jail_probe_265901 | read-only / not present |
| PASS | Write blocked outside jail: /srv/www/d_intevia.cz/_jail_probe | read-only / not present |
| PASS | Write blocked outside jail: /usr/_jail_probe | read-only / not present |
| PASS | Write blocked outside jail: /var/_jail_probe | read-only / not present |
| INFO | Write allowed inside jail wwwroot (expected) | writable (expected) |
| PASS | Symlink out of jail cannot be dereferenced | symlink made but target unreadable (ns blocks it) |
| INFO | open_basedir setting (info) | not set (relying on kernel mount namespace instead) |
| Verdict | Test | Detail |
|---|---|---|
| PASS | No other-user processes visible (ProtectProc/hidepid) | only own pool PIDs visible (same uid, 8) |
| PASS | PrivateTmp isolates /tmp | /tmp entries: 0 |
| PASS | Device node absent: /dev/mem | not present |
| PASS | Device node absent: /dev/sda | not present |
| PASS | Device node absent: /dev/kmsg | not present |
| PASS | Device node absent: /dev/kcore | not present |
| INFO | Mount table (info) | visible mount lines: 86 |
| Verdict | Test | Detail |
|---|---|---|
| INFO | disable_functions coverage | disabled: exec,passthru,shell_exec,system,pcntl_exec,pcntl_fork,proc_nice,dl | still callable: popen,proc_open,mail |
| WARN | Shell reachable via proc_open (not in disable_functions) medium |
id => ? |
| PASS | exec()d child stays inside mount namespace | child sees only jail (ls /srv/www => '') |
| Verdict | Test | Detail |
|---|---|---|
| WARN | Egress — DNS/TCP to internet (1.1.1.1:53) medium |
CONNECTED — outbound egress permitted (SSRF/exfil surface) |
| WARN | Egress — HTTPS/TCP to internet (1.1.1.1:443) medium |
CONNECTED — outbound egress permitted (SSRF/exfil surface) |
| PASS | Cloud metadata endpoint unreachable | unreachable (Connection timed out (110)) |
| INFO | Internal service reachable — MySQL (127.0.0.1:3306) | closed (Connection timed out (110)) |
| INFO | Internal service reachable — Postgres (127.0.0.1:5432) | closed (Connection timed out (110)) |
| INFO | Internal service reachable — Redis (127.0.0.1:6379) | closed (Connection timed out (110)) |
| INFO | Internal service reachable — Caddy admin API (127.0.0.1:2019) | closed (Connection timed out (110)) |
| INFO | Internal service reachable — node_exporter (127.0.0.1:9100) | closed (Connection timed out (110)) |
| INFO | Internal service reachable — Grafana (127.0.0.1:3000) | closed (Connection timed out (110)) |
| INFO | Internal service reachable — Loki (127.0.0.1:3100) | closed (Connection timed out (110)) |
| PASS | Other tenants' PHP-FPM sockets not connectable | 88 foreign sockets visible but none connectable |
| INFO | DNS resolution (info) | resolves (172.66.147.243) |
| Verdict | Test | Detail |
|---|---|---|
| INFO | cgroup limits enforced (read-only, not stress-tested) | MemoryMax=n/a MemoryHigh=n/a TasksMax=n/a CPUQuota=n/a |
| INFO | PHP memory_limit | memory_limit=128M max_execution_time=30s |
| Verdict | Test | Detail |
|---|---|---|
| PASS | Redis not reachable | closed (Connection timed out) |
| PASS | MySQL not reachable | closed (Connection timed out) |
| PASS | Caddy admin API not reachable | closed (Connection timed out) |
| PASS | No internal LAN reachability (SSRF depth) | sampled RFC1918 gateways unreachable |
| Verdict | Test | Detail |
|---|---|---|
| WARN | Environment variables free of secrets medium |
suspicious env keys: AUTH_TYPE |
| PASS | display_errors off (no verbose errors to client) | display_errors=0 |
| PASS | No FFI extension (native memory / exec bypass) | ffi not loaded (present: imagick) |