The contents of this document have been developed by SancLogic. SancLogic considers the contents of this document to be proprietary and business confidential information. This information is to be used only in the performance of its intended use. This document may not be released to another vendor, business partner or contractor without prior written consent from SancLogic. Additionally, no portion of this document may be communicated, reproduced, copied or distributed without the prior consent of SancLogic.
The contents of this document do not constitute legal advice. SancLogic's offer of services that relate to compliance, litigation or other legal interests are not intended as legal counsel and should not be taken as such.
MahCyberDefense (on behalf of Kerning City Dental, "Kerning City Dental" herein) contracted SancLogic to perform a full-scope red team assessment of Kerning City Dental's externally facing web infrastructure to identify security weaknesses, determine the impact to Kerning City Dental, document all findings in a clear and repeatable manner, and provide remediation recommendations.
3.1 Approach
SancLogic performed testing under a "Black Box" approach on 12 February 2026 without credentials or any advance knowledge of Kerning City Dental's externally facing environment with the goal of identifying unknown weaknesses. Testing was performed from a non-evasive standpoint with the goal of uncovering as many misconfigurations and vulnerabilities as possible. Testing was performed remotely from SancLogic's assessment infrastructure via ProtonVPN. Each weakness identified was documented and manually investigated to determine exploitation possibilities and escalation potential. SancLogic sought to demonstrate the full impact of every vulnerability, up to and including data exfiltration and command and control establishment.
3.2 Scope
The scope of this assessment was the external web application and underlying web server infrastructure.
Host/URL/IP Address
Description
kerningcitydental.ca
Primary web application
KCD-Web (172.16.1.4)
Windows Server 2022 (DMZ)
ADDC01
Active Directory Domain Controller — Not Reachable (DMZ Isolation)
KCD-EXCH01
Exchange Server — Not Reachable (DMZ Isolation)
KCD-FS01
File Server — Not Reachable (DMZ Isolation)
Network Architecture
Out of Scope: Denial of Service (DoS) attacks, third-party infrastructure
3.3 Assessor Infrastructure
The following infrastructure was used to conduct the assessment. This information is provided to assist Kerning City Dental in distinguishing penetration test activity from any unrelated or malicious traffic occurring during the assessment window.
Component
Detail
Notes
Assessor Location
Remote
Testing conducted remotely throughout
VPN Provider
ProtonVPN
All traffic egressed via ProtonVPN
Egress IP
Documented at time of testing
Available on request for log correlation
C2 Infrastructure
sync.cloud-endpoint.net
Cloudflare Tunnel — used for Sliver C2 during Phase 6 only
C2 Port
8443 (HTTPS)
Outbound from KCD-Web to C2 listener
Assessment OS
Kali Linux
Primary assessment platform
Assessment Window
12 February 2026, 09:14 – 10:15
Total active testing: ~61 minutes
Any traffic originating from ProtonVPN exit nodes or the domain cloud-endpoint.net during the above window should be attributed to this authorised assessment.
3.3 Assessment Overview and Recommendations
During the penetration test against Kerning City Dental, SancLogic identified 11 findings that threaten the confidentiality, integrity, and availability of Kerning City Dental's information systems. The findings were categorised by severity level, with 5 of the findings being assigned a critical-risk rating, 1 high-risk, 3 medium-risk, and 2 low risk.
The assessment demonstrated that an external attacker could fully compromise the web server, access all patient records (including Social Insurance Numbers), harvest credentials, and establish command and control access. This represents a significant breach of PIPEDA compliance obligations.
SANCLOGIC
Kerning City Dental should create a remediation plan based on the Remediation Summary section of this report, addressing all critical and high findings as soon as possible according to the needs of the business. Kerning City Dental should also consider performing periodic vulnerability assessments if they are not already being performed.
Key recommendations include:
Immediate rotation of all exposed credentials (SQL, SMTP, API keys, staff accounts)
Removal or restriction of the diagnostic.aspx page
Implementation of parameterised queries to prevent SQL injection
Encryption of patient health information at rest
PIPEDA compliance review due to PHI exposure
SANCLOGIC
4 Penetration Test Assessment Summary
SancLogic began all testing activities from the perspective of an unauthenticated user on the internet. The client provided only the target domain; no additional information such as operating system or configuration details was provided.
4.1 Summary of Findings
During the course of testing, SancLogic uncovered a total of 11 findings that pose a material risk to Kerning City Dental's information systems. The below chart provides a summary of the findings by severity level.
In the course of this penetration test: 5 Critical, 1 High, 3 Medium, 2 Low vulnerabilities were identified:
Below is a high-level overview of each finding identified during testing:
#
Severity Level
Finding Name
Page
1
9.8 (Critical)
OS Command Injection (Remote Code Execution)
12
2
9.8 (Critical)
SQL Injection — Authentication Bypass
13
3
9.1 (Critical)
Plaintext Credential Storage
14
4
9.1 (Critical)
Protected Health Information Exposure
15
5
8.8 (Critical)
Antivirus Bypass via Custom Tooling
16
6
7.5 (High)
Sensitive Information in robots.txt
17
7
5.3 (Medium)
Verbose Error Messages
17
8
5.3 (Medium)
Server Information Disclosure
18
9
5.3 (Medium)
Directory Browsing Enabled
18
10
3.7 (Low)
Missing Security Headers
19
11
3.7 (Low)
Debug Mode Enabled
19
SANCLOGIC
5 Attack Path Walkthrough
During the course of the assessment, SancLogic gained a foothold via the external web application, access all patient records, harvest credentials, and establish command and control access on the web server. The steps below demonstrate the path taken from initial reconnaissance to full compromise.
5.1 Detailed Walkthrough
SancLogic performed the following to fully compromise the KCD-Web server:
Passive reconnaissance identified infrastructure (Cloudflare, IIS 10.0, Windows Server 2022, M365 mail)
Subdomain enumeration via crt.sh revealed mail and wildcard certificates
robots.txt disclosed sensitive paths including /tools/diagnostic.aspx
OS command injection achieved via ping field (127.0.0.1 & whoami)
curl output: robots.txt disclosing sensitive paths including /admin/, /backup/, /tools/diagnostic.aspx
The /tools/diagnostic.aspx page was publicly accessible and exposed server information including hostname, OS version, and application paths.
SANCLOGIC
Phase 3: Initial Access — Command Injection
The diagnostic.aspx page contained network troubleshooting tools (ping, nslookup, traceroute) that passed user input directly to cmd.exe without sanitisation.
Payload:
127.0.0.1 & whoami
Server Executed:
cmd.exe /c ping -n 2 127.0.0.1 & whoami
Result: Arbitrary command execution confirmed. The whoami command returned iis apppool\defaultapppool.
RCE via command injection — whoami output
Phase 4: Post-Exploitation Enumeration
Using command injection, SancLogic enumerated the system:
The SeImpersonatePrivilege token enables privilege escalation via "potato" attacks (PrintSpoofer, GodPotato, JuicyPotatoNG). These were blocked by Defender, SancLogic pivoted to custom tooling instead.
Server information and privilege enumeration
Phase 5: Credential Harvesting
The web.config file was readable via command injection:
type C:\inetpub\kerningcitydental\web.config
Credentials Discovered:
Service
Username
Password
SQL Server (KCD-SQL01)
sa
SQLAdmin2024!
SMTP
—
EmailKCD2024!
Backup API
—
sk-kcd-a8f29b4c1d3e5f6g7h8i9j0k
Terminal output: cat patients.csv showing 25 patient records with PII
Phase 8: Command & Control
Known privilege escalation tools (PrintSpoofer, GodPotato, JuicyPotatoNG) were detected and quarantined by Windows Defender. A custom Nim-based stager with in-memory shellcode execution was deployed, successfully evading static detection:
Sessions were terminated by Defender behavioural analysis after approximately 2 minutes.
Sliver C2 session callbacks
SANCLOGIC
6 Remediation Summary
As a result of this assessment there are several opportunities for Kerning City Dental to strengthen its security posture. Remediation efforts are prioritised below starting with those that will likely take the least amount of time and effort to complete. Kerning City Dental should ensure that all remediation steps and mitigating controls are carefully planned and tested to prevent any service disruptions or loss of data.
6.1 Short Term
Rotate all credentials: SQL (sa), SMTP, backup API key, all staff accounts
Remove or restrict access to /tools/diagnostic.aspx
Implement parameterised queries on /admin/login.aspx
User input is concatenated directly into system commands without sanitisation, enabling arbitrary command execution as the IIS application pool identity.
Impact
Full server compromise, data exfiltration, lateral movement capability, persistent access via webshell or C2.
Remediation
Remove diagnostic.aspx from production or restrict access via authentication. Implement input validation using allowlists (IP address regex). Use parameterised commands, not string concatenation.
X-Server-Info: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
curl -I output showing IIS/10.0, ASP.NET 4.0.30319, Cloudflare headers
9. Directory Browsing Enabled - Medium
CWE
CWE-548: Exposure of Information Through Directory Listing
CVSS 3.1
5.3
Location
/admin/
Root Cause
IIS directory browsing enabled on administrative directory.
Impact
File structure exposure, discovery of additional attack vectors.
Remediation
Set <directoryBrowse enabled="false"/> in web.config.
SANCLOGIC
10. Missing Security Headers - Low
CWE
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
CVSS 3.1
3.7
Location
Application-wide
Root Cause
HttpOnly and Secure flags not set on session cookies.
Impact
Session hijacking via XSS attacks if combined with other vulnerabilities.
Remediation
Set <httpCookies httpOnlyCookies="true" requireSSL="true"/> in web.config.
11. Debug Mode Enabled - Low
CWE
CWE-489: Active Debug Code
CVSS 3.1
3.7
Location
web.config
Root Cause
<compilation debug="true"/> enabled in production web.config.
Impact
Performance degradation, additional information disclosure, larger attack surface.
Remediation
Disable debug mode in production deployments.
SANCLOGIC
8 Positive Observations
The following security controls were observed functioning effectively during the assessment:
P1: DMZ Network Segmentation
The web server was properly isolated in a DMZ segment (172.16.1.4/29). Internal network resources (Active Directory, Exchange, file servers) were not reachable from the compromised host. This segmentation prevented lateral movement into the corporate network and limited the blast radius of the compromise.
P2: Windows Defender Behavioural Detection
While static analysis was bypassed with custom tooling, Windows Defender's behavioural analysis successfully detected and terminated C2 sessions within approximately 2 minutes of execution. Known privilege escalation tools (PrintSpoofer, GodPotato, JuicyPotatoNG) were also blocked on initial delivery. This demonstrates that Defender provided meaningful defense-in-depth despite the bypass.
SANCLOGIC
A Appendix
A.1 Finding Severities
Each finding has been assigned a severity rating of critical, high, medium, low or info. The rating is based off of an assessment of the priority with which each finding should be viewed and the potential impact each has on the confidentiality, integrity, and availability of Kerning City Dental's data.
