Confidential  ·  Contains origin IP & attack-surface detail  ·  Restricted distribution  · 
Network Security Audit

bbnu.my — Audit Dashboard

Two-phase assessment: passive OSINT/DNS/CT/TLS reconnaissance, then owner-authorised active scanning of the Cloudflare edge and the origin server. No exploitable vulnerabilities identified.

Scan date 2026-09-13 Authorisation Owner-confirmed Edge Cloudflare Origin 203.106.243.49 Verdict Well hardened
✓

Overall posture: STRONG

The origin answers ICMP but exposes one TCP port out of 65,535 — and that port is SSH with password authentication disabled. Web ingress is Cloudflare-only. 10,725 vulnerability templates returned zero findings. All remaining items are hardening gaps, not breaches.

Findings by severity

0
Critical
No exploitable issue
0
High
None identified
4
Medium
Config & DNS hardening
7
Low
Headers, TLS, SSH polish
4
Informational
Context, no action risk
15
Total
0 requiring urgent fix

Attack surface — origin port exposure

Full TCP sweep · all 65,535 ports, SYN scan

1 open port
Filtered (firewalled)65,534
Open to internet1
Exposure ratio0.0015%
Scan duration117.55 s

Ports 80 443 22 3306 and all cPanel/RDP/DB ranges are filtered — confirming Cloudflare-only ingress.

Sole open service

Port6262/tcp
ServiceSSH — relocated off port 22
VersionOpenSSH 9.6p1 Ubuntu 3ubuntu13.19
Auth methodspublickey only password auth disabled
Brute-force riskNot viable no password path exists
CVE-2024-6387Patched newer than fix release 3ubuntu13.0
Host keysed25519, ecdsa-p256, ssh-rsa (legacy)

Asset inventory

Domainbbnu.my — created 2026-08-07, registrar Exabytes Network Sdn Bhd, registrant Pahang MY, expiry 2027-08-07
Authoritative DNSCloudflare (nelci / watson.ns.cloudflare.com) — DNSSEC unsigned
Public edge104.21.91.240, 172.67.182.39 + IPv6 2606:4700:3031::ac43:b627, 2606:4700:3030::6815:5bf0
Origin hostvps1.bbnu.my → 203.106.243.49 — SMART TRANSACT SDN BHD, Selangor; TM Net AS4788
Origin OSUbuntu 24.04 LTS
ApplicationStatic placeholder “BBNU — Dalam Pembinaan”, 3,794 bytes, lang=ms, noindex,nofollow
MailNone — no MX; mail/smtp/imap/pop/webmail/ftp/cpanel all NXDOMAIN
SubdomainsOnly www + vps1 — 20 common origin-leak names all NXDOMAIN

Verified effective controls

Network & host

  • 65,534 / 65,535 origin TCP ports filtered — Cloudflare-only ingress confirmed
  • Ports 80/443/22/3306 + cPanel/RDP/DB ranges all unreachable from the internet
  • SSH password authentication disabled — publickey only, brute force not viable
  • SSH relocated to non-standard port 6262, reducing automated noise
  • OpenSSH patched against CVE-2024-6387 (regreSSHion)
  • Origin IP correctly hidden on apex/www (Cloudflare proxy enabled)

Transport & application

  • TLS 1.0 / 1.1 rejected — only 1.2 and 1.3 negotiate
  • NULL / aNULL / eNULL / RC4 / 3DES / export cipher suites all rejected
  • Edge cert ECDSA P-256, ecdsa-with-SHA256; ECDHE uses X25519 (true PFS)
  • 90-day auto-renewing certificates; chain verifies clean
  • TRACE / PUT / DELETE / POST / OPTIONS all return 405 — no cross-site tracing
  • x-content-type-options: nosniff and referrer-policy present
  • HTTP→HTTPS 301 enforced on all paths
  • nuclei: 10,725 templates / ~12,300 requests → zero vulnerabilities
  • Cloudflare throttled the scanner while normal traffic stayed 200 in ~100 ms

Findings register

Remediation — in priority order

  1. Restrict origin port 6262 to trusted admin IPs or require a VPN/Zero Trust tunnel. It is the only world-open port on the origin.
    ~15 min
  2. Remove or proxy vps1.bbnu.my and switch the origin to a Cloudflare Origin CA certificate. CT logs currently leak the origin IP to anyone.
    ~30 min
  3. Add HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Closes the first-visit SSL-strip window.
    ~10 min
  4. Add CAA records restricting issuance to letsencrypt.org (and digicert.com for Cloudflare). Prevents rogue certificate issuance.
    ~10 min
  5. Publish null MX + SPF v=spf1 -all + DMARC p=reject. No mail is sent today, so the domain is trivially spoofable for phishing.
    ~20 min
  6. Before launch: scoped CSP, X-Frame-Options: DENY, Permissions-Policy, and restrict the current access-control-allow-origin: *.
    ~45 min
  7. Enable DNSSEC in the Cloudflare dashboard — one toggle for Cloudflare-managed DNS.
    ~5 min
  8. Retire the legacy ssh-rsa host key on port 6262 once all clients support ed25519.
    ~15 min

Methodology

Phase 1 — Passive · no packets sent to target

WHOIS/RDAP, DNS record enumeration, DNSSEC validation, Certificate Transparency log mining (crt.sh, CertSpotter), passive subdomain correlation (subfinder, RapidDNS), TLS chain and protocol fingerprinting, HTTP header and redirect analysis.

Phase 2 — Active (owner-authorised): full 65,535-port SYN sweep of the origin, top-1000 sweep of the Cloudflare edge, service/version detection on the single open port, SSH banner and auth-method enumeration, TLS cipher and protocol acceptance matrix, HTTP method probing, and nuclei template scanning.

Corrections & false positives avoided

  • Cipher test corrected. Initial run reported NULL/aNULL as accepted — OpenSSL’s -cipher applies only to TLS ≤1.2, so the server negotiated 1.3 and ignored it. Re-tested with -no_tls1_3: all weak suites properly rejected.
  • No SSLv3 exposure. OpenSSL prints New, SSLv3 for some handshakes — a legacy record-layer label; the actual protocol is TLSv1.2.
  • Origin-leak finding downgraded. Passive recon implied Critical Cloudflare bypass; active scanning disproved it. Reclassified Critical → Medium.
  • Rate-limit false negatives ruled out. A slow re-verification pass on high-value ports confirmed the filtered results were genuine, not throttling artefacts.

Deliberately excluded: credential brute-forcing, SSH connection-exhaustion DoS, and exploit exploitation — unnecessary given the findings and risky for availability. Scanning caused no service impact; post-scan health check returned 200/301 at ~100 ms.

Key evidence

# Origin full TCP sweep — sole open port
$ nmap -sS -T4 --min-rate 900 -Pn -p- --open 203.106.243.49
Nmap scan report for vps1.bbnu.my (203.106.243.49)
PORT     STATE SERVICE
6262/tcp open  unknown
MAC Address: 00:16:3E:XX:XX:XX (Xen Source)
Nmap done: 1 IP address (1 host up) scanned in 117.55 seconds

# SSH auth surface — no password path
$ ssh -p 6262 -o PreferredAuthentications=none 203.106.243.49
Permission denied (publickey).

# Weak cipher rejection (corrected methodology)
$ openssl s_client -connect bbnu.my:443 -no_tls1_3 -cipher 'NULL:eNULL:aNULL:RC4:DES-CBC3-SHA'
no cipher match  # handshake fails — suites correctly refused

Full raw logs: nmap_origin_full.txt, nmap_edge.txt, nuclei_edge.txt, bbnu_home.html. Complete narrative report: bbnu-security-audit-2026-09-13.pdf (5 pages).