An open development site and an unenforced email policy put donor fraud within reach
Gray-box external red team against the live internet-facing estate, with no application credentials provided. Anonymized.
Who we worked with.
A nonprofit with a public website, an online course platform and embedded donation pages, run by a small team without a dedicated security function.
Anonymized. No client names, people, domains, addresses or locations are published.
The question we were asked.
What can an outsider with no credentials do against the organization's website, its development site, its course platform, its email domain and its donation pages, using live production systems?
Assessment modules used.
Authorized external red team, gray-box, against live production systems in a single assessment window.
External red team, gray-box
The live public website and a publicly reachable development copy of it, unauthenticated, with active probing.
Email authentication
The organization's mail domain: sender policy, signing and enforcement.
Course platform and checkout
The online course catalogue, cart and payment flow.
Donation embeds
Third-party donation pages embedded in the website.
Refutation lane
Higher-severity hypotheses actively tested and ruled out before anything was reported.
Severity, validated.
- HighA development copy of the website was reachable from the internet with no access gate, exposing staff account names, all media and content, and administrative paths.
- HighThe domain's email policy did not enforce authentication, so mail spoofing the organization's own address was delivered. Donor-fraud and credential-harvest phishing were viable with zero access.
- HighCross-origin requests carrying credentials were accepted from any web origin, on both production and the development copy.
- HighThe course checkout priced every course at zero on the server side, bypassing the payment integration.
- HighFour more High findings: unauthenticated media and content exposure on the development copy, and three outdated website components with published vulnerabilities, held for confirmation in an authenticated follow-up test.
What we recommended.
The most significant observation: an unenforced email policy plus an unprotected development site together gave an immediately exploitable path to donor fraud and full staff-account enumeration, without compromising any production system. Two low-effort changes collapse most of it: enforcing the email policy removes the zero-credential phishing chain, and gating the development site removes the unauthenticated surface behind two more chains.
Enforce the email policy in quarantine mode; gate the development site; restrict cross-origin access to an allowlist; update the three outdated components.
Move the email policy to reject after reviewing reports; confirm course pricing and validate the payment integration; add login rate limiting.
An authenticated test to confirm the three deferred component findings.
What the client received.
- 21 validated findings with evidence and remediation steps
- Five scored attack chains, ranked by exploitability today
- Refuted hypotheses: what was tested and ruled out
- Detection and response guidance for the organization's IT team
- Prioritized remediation roadmap with effort estimates
Prepared by TitanDef offensive security team
Find out what an adversary already sees.
Focused engagements run 5 to 7 business days, with a 72-hour first-findings commitment. Powered by frontier AI models; every finding validated by a senior human.