MagnoHost-pentest
pentest on MagnoHost hosting provider & MeteorCloud infrastructure. Findings: MariaDB exposed on 6 servers (CVSS 9.8), OmniDialer default creds full access, Wings CVE-2024-27102 (9.9), Grafana exposed, DMARC spoofing. Only curl_cffi + Python. Zero automated scanners.
| Field | Detail |
|---|
| Domain | magnohost.com.br / meteorcloud.com.br |
| ASN | AS210554 — Meteor Cloud LTDA |
| WAF | Cloudflare (parcial) |
| Stack | nginx, Laravel, Next.js, Pterodactyl, Grafana |
| Database | MariaDB 10.11.x (múltiplos servidores) |
| Servers mapped | 15+ |
| Test Date | May 3–4, 2026 |
| Pentester | wyllow |
| Authorized by | Gabriel C. — COO, MagnoHost |
scope
- Full external black box assessment
- Subdomain enumeration & infrastructure mapping
- Cloudflare WAF bypass via TLS fingerprint
- Port scanning & banner grabbing
- API endpoint fuzzing
- Default credential testing
- CVE identification on exposed services
- Cookie & header security analysis
- OSINT (DNS, DMARC, SPF, URLScan, IPInfo)
Zero automated scanners. Pure manual hacking. Termux on Android.
findings summary
critical
F01 — MariaDB Exposed on Internet (Port 3306)
Description: MariaDB was directly reachable from the internet on port 3306 across 6 servers with no firewall restriction, allowing unauthenticated connection attempts directly against the database engine.
Proof of Concept:
nc -zv 72.61.33.85 3306
# Banner: MariaDB 10.11.14-0ubuntu0.24.04.1# Magnohost-Vulnerabilities-pentest
Details intentionally limited to protect the infrastructure
wyllowsec/magnohost-vulnerabilities-pentest
