{ "run_id": "run-20261114-215136", "segments": [ { "hunter": "hunter-1", "focus": "Mein Portal + Liferay portals + Airlock IAM", "units": [ { "unit_id": "u3", "kind": "app", "label": "mein (baloise.de)", "hosts": [ "mein-portal.baloise.de", "mein-portal-registrierung.baloise.de", "acc-mein-portal.baloise.de", "test-mein-portal.baloise.de" ], "profile": { "findings": 1, "hostnames": 4, "live": 30, "paths": 3033, "requests": 6368, "services": 70, "summary": "CloudFront-origin-only alternate TLS listener for the Mein Portal Apache/Airlock Gateway and Airlock IAM application, using the same Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Apache HTTP Server", "Airlock IAM", "Airlock Gateway", "Jersey" ], "titles": [ "", "radio-checkbox_v2_border", "7FB2CE1D-7E9C-461A-9281-565396635665" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-mein-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-17612bde4a381fd90db3a8e4" }, { "asset_type": "DOMAIN", "identifier": "mein-portal-registrierung.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-7378551bd3030cef35c48a5d" }, { "asset_type": "DOMAIN", "identifier": "test-mein-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-80fb4037f8ed0cc9ca65df45" }, { "asset_type": "DOMAIN", "identifier": "mein-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-980fd681bf83d9459cba6611" } ] }, { "unit_id": "u6", "kind": "app", "label": "infoportal (baloise.de)", "hosts": [ "infoportal.baloise.de", "acc-infoportal.baloise.de", "test-infoportal.baloise.de" ], "profile": { "hostnames": 3, "live": 15, "paths": 1234, "requests": 3326, "services": 49, "summary": "CloudFront-origin-only alternate TLS listener for the Infoportal Apache/Airlock Gateway and Airlock IAM boundary, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "infoportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a2f51937871ee3fa41b3c159" }, { "asset_type": "DOMAIN", "identifier": "acc-infoportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-de15e076cfa962fabcb494db" }, { "asset_type": "DOMAIN", "identifier": "test-infoportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f6bc9d2168e464075ed3a51b" } ] }, { "unit_id": "u10", "kind": "app", "label": "maklerportal (baloise.de)", "hosts": [ "maklerportal.baloise.de", "acc-maklerportal.baloise.de", "test-maklerportal.baloise.de" ], "profile": { "hostnames": 3, "live": 11, "paths": 465, "requests": 1897, "services": 23, "summary": "CloudFront-origin-only alternate TLS listener for the Maklerportal Apache/Airlock Gateway and Airlock IAM boundary, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "maklerportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-2dfba5556ea43ea48d6b3393" }, { "asset_type": "DOMAIN", "identifier": "acc-maklerportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-711f6b95f848e45efcb6bf79" }, { "asset_type": "DOMAIN", "identifier": "test-maklerportal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-7f5f802724d2897fed89cbff" } ] }, { "unit_id": "u14", "kind": "app", "label": "si (baloise.de)", "hosts": [ "si-portal.baloise.de", "test-si-portal.baloise.de", "acc-si-portal.baloise.de" ], "profile": { "hostnames": 3, "live": 9, "paths": 197, "requests": 478, "services": 22, "summary": "CloudFront-origin-only alternate TLS listener for the SI Portal Apache/Airlock Gateway and Airlock IAM boundary, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-si-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-1a1ab2e6bd95b493f6d70eb4" }, { "asset_type": "DOMAIN", "identifier": "si-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-37bbac024a06b669848066e6" }, { "asset_type": "DOMAIN", "identifier": "test-si-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-4f7fc5233e92094ca3cb29f4" } ] }, { "unit_id": "u15", "kind": "app", "label": "vertriebsservice (baloise.de)", "hosts": [ "vertriebsservice.baloise.de", "acc-vertriebsservice.baloise.de", "test-vertriebsservice.baloise.de" ], "profile": { "hostnames": 3, "live": 9, "paths": 201, "requests": 445, "services": 22, "summary": "CloudFront-origin-only alternate TLS listener for the Vertriebsservice Apache/Airlock Gateway and Airlock IAM boundary, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-22b8bd914a7d8563f434555c" }, { "asset_type": "DOMAIN", "identifier": "acc-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-5ed6ace82f50a1ac65739382" }, { "asset_type": "DOMAIN", "identifier": "test-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-731747452022fc1a27c9c14b" } ] }, { "unit_id": "u16", "kind": "app", "label": "zeus (baloise.de)", "hosts": [ "zeus-portal.baloise.de", "acc-zeus-portal.baloise.de", "test-zeus-portal.baloise.de" ], "profile": { "hostnames": 3, "live": 9, "paths": 192, "requests": 411, "services": 21, "summary": "CloudFront-origin-only alternate TLS listener for the residual Zeus Apache/Airlock Gateway and Airlock IAM mapping, backed by the same Liferay Portal application and Jersey 3.1.10 REST layer as the canonical origin.", "technologies": [ "Airlock IAM", "Liferay Portal", "Airlock Gateway", "Apache HTTP Server", "Jersey" ], "titles": [ "" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-zeus-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-2ab31fc5aa864f0db1e6f4c2" }, { "asset_type": "DOMAIN", "identifier": "test-zeus-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-3b4554c9fdd3c3d82a068d66" }, { "asset_type": "DOMAIN", "identifier": "zeus-portal.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-710ab4e7af84871c7047290f" } ] } ] }, { "hunter": "hunter-2", "focus": "Guidewire + SAS analytics + internal service gateways", "units": [ { "unit_id": "u7", "kind": "app", "label": "ocs-vertriebsservice (baloise.de)", "hosts": [ "ocs-vertriebsservice.baloise.de", "acc-ocs-vertriebsservice.baloise.de", "int-ocs-vertriebsservice.baloise.de", "test-ocs-vertriebsservice.baloise.de" ], "profile": { "hostnames": 4, "live": 18, "paths": 372, "requests": 709, "services": 47, "summary": "CloudFront-origin-only alternate TLS listener for the canonical OCS Apache/Airlock Gateway boundary.", "technologies": [ "Apache HTTP Server", "Airlock Gateway" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "int-ocs-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-08c25055e66bfedbcc7b9a4f" }, { "asset_type": "DOMAIN", "identifier": "acc-ocs-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-dc562506fbe8a41c92a62e5c" }, { "asset_type": "DOMAIN", "identifier": "ocs-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-e9f8b9cbd1d2e8de1f071185" }, { "asset_type": "DOMAIN", "identifier": "test-ocs-vertriebsservice.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f8d18b8386000c6f7d5edda3" } ] }, { "unit_id": "u8", "kind": "app", "label": "va (baloise.de)", "hosts": [ "va.baloise.de", "test-va.baloise.de" ], "profile": { "hostnames": 2, "live": 12, "paths": 688, "requests": 1971, "services": 48, "summary": "CloudFront-origin-accessible alternate TLS listener for the VA Airlock IAM application and its Jersey 3.1.10 REST layer.", "technologies": [ "Airlock IAM", "SAS Visual Analytics", "Apache HTTP Server", "Airlock Gateway", "Jersey" ], "titles": [ "" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "va.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-808c39ceaf83203b77ae4027" }, { "asset_type": "DOMAIN", "identifier": "test-va.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-c2fc28a0c53638a9d953b739" } ] }, { "unit_id": "u9", "kind": "app", "label": "gwde (baloise.de)", "hosts": [ "gwde.baloise.de", "acc-gwde.baloise.de", "int-gwde.baloise.de", "test-gwde.baloise.de" ], "profile": { "hostnames": 4, "live": 12, "paths": 324, "requests": 911, "services": 48, "summary": "CloudFront-origin-only alternate TLS listener for the canonical GWDE Guidewire application.", "technologies": [ "Guidewire BillingCenter", "Airlock Gateway", "Apache HTTP Server", "Guidewire PolicyCenter", "Guidewire ClaimCenter" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "int-gwde.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-11437995cb747edd9d2360bc" }, { "asset_type": "DOMAIN", "identifier": "gwde.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-41ca77626b0267051b1a4a8e" }, { "asset_type": "DOMAIN", "identifier": "test-gwde.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-e2190f0aa1a4ef01db239e9d" }, { "asset_type": "DOMAIN", "identifier": "acc-gwde.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f2d50b0607208d1a9cf5451f" } ] }, { "unit_id": "u21", "kind": "app", "label": "taa (baloise.de)", "hosts": [ "taa.baloise.de", "int-taa.baloise.de", "acc-taa.baloise.de", "test-taa.baloise.de" ], "profile": { "hostnames": 4, "live": 1, "paths": 171, "requests": 382, "services": 46, "summary": "Unavailable alternate TLS listener for the historical TAA/BiPRO hostname.", "technologies": [ "Apache HTTP Server", "Airlock Gateway" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "int-taa.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-58bc3be30686a72a44c059c7" }, { "asset_type": "DOMAIN", "identifier": "taa.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-b0ca48a448a4d1fe29d66d60" }, { "asset_type": "DOMAIN", "identifier": "acc-taa.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-e4705c77e01ca5ef450f431c" }, { "asset_type": "DOMAIN", "identifier": "test-taa.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f5cbb671d4de7cdcca21597f" } ] }, { "unit_id": "u22", "kind": "app", "label": "mtls (baloise.de)", "hosts": [ "acc-mtls-api.baloise.de" ], "profile": { "hostnames": 1, "paths": 16, "requests": 182, "services": 16, "summary": "Unresolved scoped HTTP origin." }, "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-mtls-api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-f2e7d49de241b0450eaac47f" } ] }, { "unit_id": "u23", "kind": "app", "label": "sas (baloise.de)", "hosts": [ "sas.baloise.de", "acc-sas.baloise.de", "int-sas.baloise.de", "test-sas.baloise.de" ], "profile": { "hostnames": 4, "paths": 13, "requests": 138, "services": 7, "summary": "Unresolved scoped origin." }, "scope": [ { "asset_type": "DOMAIN", "identifier": "acc-sas.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-7dd83dee63aff503de2168e9" }, { "asset_type": "DOMAIN", "identifier": "sas.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-ae4c75ecd140e78b525a55ab" }, { "asset_type": "DOMAIN", "identifier": "int-sas.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-d48bcc488bc72f7975e8b67b" }, { "asset_type": "DOMAIN", "identifier": "test-sas.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-ed46b5bbe42ca7b5734a24ad" } ] }, { "unit_id": "u24", "kind": "app", "label": "c (baloise.de)", "hosts": [ "c24-www.baloise.de", "c24-acc-www.baloise.de" ], "profile": { "hostnames": 2, "paths": 10, "requests": 135, "services": 4, "summary": "Unconfigured production C24 hostname." }, "scope": [ { "asset_type": "DOMAIN", "identifier": "c24-acc-www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-4ca00e13f7b0279522e25ab1" }, { "asset_type": "DOMAIN", "identifier": "c24-www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-63e00ed9fb9bdfbfafe50809" } ] }, { "unit_id": "u25", "kind": "app", "label": "wifi (baloise.de)", "hosts": [ "wifi.baloise.de" ], "profile": { "hostnames": 1, "paths": 2, "requests": 166, "services": 2, "summary": "Currently unreachable plain-HTTP WiFi origin." }, "scope": [ { "asset_type": "DOMAIN", "identifier": "wifi.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-1b8b0e49b16fdbadbe81470f" } ] }, { "unit_id": "u26", "kind": "app", "label": "telog (baloise.de)", "hosts": [ "telog.baloise.de" ], "profile": { "hostnames": 1, "paths": 2, "requests": 145, "services": 2, "summary": "Unreachable HTTPS Telog origin as of 2026-11-13." }, "scope": [ { "asset_type": "DOMAIN", "identifier": "telog.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a136ab4ba7b3205753edd731" } ] } ] }, { "hunter": "hunter-3", "focus": "public web + campaigns + tracking", "units": [ { "unit_id": "u1", "kind": "app", "label": "baloise.de (root)", "hosts": [ "service.baloise.de", "baloise.de", "acc-www.baloise.de", "www.baloise.de", "int-www.baloise.de", "api.baloise.de", "api2.baloise.de", "acc-api.baloise.de", "int-api.baloise.de", "int-api2.baloise.de", "acc-api2.baloise.de", "acc-service.baloise.de", "test-api.baloise.de", "test-service.baloise.de", "int-service.baloise.de", "test-api2.baloise.de" ], "profile": { "findings": 2, "guarded": 29, "hostnames": 16, "live": 33, "paths": 2800, "requests": 7267, "services": 127, "summary": "CloudFront-origin-reachable alternate TLS listener for the Service Apache/Airlock Gateway virtual host.", "technologies": [ "Apache HTTP Server", "Apache Tomcat", "Layer7 API Gateway", "ASP.NET Web Forms", "WebBA Cleanup Service" ], "titles": [ "Status", "Baloise, Tarifrechner - Anmeldung", "Baloise, Tarifrechner" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "int-www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-06de2640bae6320391f68307" }, { "asset_type": "DOMAIN", "identifier": "acc-www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-1e61763c67dc251bfc6e88f9" }, { "asset_type": "DOMAIN", "identifier": "int-api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-2bda423deb9152e4866c34a9" }, { "asset_type": "DOMAIN", "identifier": "acc-api2.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-499edf963527eb9a6f9d1247" }, { "asset_type": "DOMAIN", "identifier": "www.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-55526330fb7c08507f896b29" }, { "asset_type": "DOMAIN", "identifier": "service.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-5c7884205a2948813c30511c" }, { "asset_type": "DOMAIN", "identifier": "api2.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-5e5548a6d9b75e43f9b2f6dc" }, { "asset_type": "DOMAIN", "identifier": "api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-6a9764ab121ab1445f102971" }, { "asset_type": "DOMAIN", "identifier": "baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-768ef5b016265a01ce68703b" }, { "asset_type": "DOMAIN", "identifier": "test-service.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-89e3cd7a0ecf2deb84e30d52" }, { "asset_type": "DOMAIN", "identifier": "acc-service.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-9d8412ab288cec80481b3868" }, { "asset_type": "DOMAIN", "identifier": "test-api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a959d4fca725d51d606d6a5a" }, { "asset_type": "DOMAIN", "identifier": "int-service.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a99c983b91450e58073f8547" }, { "asset_type": "DOMAIN", "identifier": "test-api2.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-c829e58c879f0e3ba872999c" }, { "asset_type": "DOMAIN", "identifier": "acc-api.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-cde0fec129d54477e950566d" }, { "asset_type": "DOMAIN", "identifier": "int-api2.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-e57cd9a758ea2a80c65d8291" } ] }, { "unit_id": "u2", "kind": "app", "label": "vario (baloise.de)", "hosts": [ "vario.baloise.de" ], "profile": { "hostnames": 1, "live": 18, "paths": 58839, "requests": 61609, "services": 25, "summary": "CloudFront-origin-only alternate TLS listener for the canonical Vario virtual host on LiteSpeed Web Server 6.3 Rev.", "technologies": [ "cPanel Webmail", "cPanel", "WHM", "cpsrvd", "PHP" ], "titles": [ "WebAdmin Console Disabled", "- LiteSpeed WebAdmin Console", "cPanel Login" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "vario.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-9993e1a759d58b711217ef14" } ] }, { "unit_id": "u11", "kind": "app", "label": "cx (baloise.de)", "hosts": [ "cx.baloise.de", "willkommen-bei.baloise.de", "int-cx.baloise.de", "test-cx.baloise.de" ], "profile": { "hostnames": 4, "live": 15, "paths": 231, "requests": 667, "services": 17, "summary": "CloudFront-origin-only alternate TLS listener for the active BSI CX campaign application.", "technologies": [ "nginx", "BSI CX" ], "titles": [ "Basler Versicherungen Landingpage" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "cx.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-0285b3011195b220cd078e48" }, { "asset_type": "DOMAIN", "identifier": "willkommen-bei.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-633459ae921aa48b6a028c3c" }, { "asset_type": "DOMAIN", "identifier": "test-cx.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-718bcba98f50b8cb87d9109d" }, { "asset_type": "DOMAIN", "identifier": "int-cx.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-ae2cc3d69c34f85fcacad596" } ] }, { "unit_id": "u17", "kind": "app", "label": "ask (baloise.de)", "hosts": [ "ask.baloise.de" ], "profile": { "hostnames": 1, "live": 8, "paths": 369, "requests": 653, "services": 8, "summary": "CloudFront-origin-only alternate TLS listener for the Flixcheck 4.239.0 application on nginx 1.25.4.", "technologies": [ "nginx", "Flixcheck" ], "titles": [ "Flixcheck" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "ask.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-dcbbbb55eb80d37c82890a60" } ] }, { "unit_id": "u18", "kind": "app", "label": "fondschecker (baloise.de)", "hosts": [ "fondschecker.baloise.de" ], "profile": { "hostnames": 1, "live": 7, "paths": 323, "requests": 752, "services": 7, "summary": "CloudFront-origin-only alternate TLS listener for the Factsheetslive Fondschecker catalogue and anonymous portfolio-comparison application.", "technologies": [ "Symfony ErrorHandler", "PHP", "Factsheetslive", "Symfony", "Symfony HttpFoundation" ], "titles": [ "Baloise Lebensversicherung AG factsheets data" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "fondschecker.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-b547d3f742070befddd0e09d" } ] }, { "unit_id": "u20", "kind": "app", "label": "tracking (baloise.de)", "hosts": [ "tracking.baloise.de" ], "profile": { "hostnames": 1, "live": 7, "paths": 76, "requests": 368, "services": 7, "summary": "CloudFront-origin-only alternate TLS listener for the Google Tag Manager Server-Side ingestion application.", "technologies": [ "Google Tag Manager Server-Side" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "tracking.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-84f9f21e682b8b06ebbd509a" } ] } ] }, { "hunter": "hunter-4", "focus": "inSign + BASE + Exchange and IIS", "units": [ { "unit_id": "u4", "kind": "app", "label": "insign (baloise.de)", "hosts": [ "insign.baloise.de", "gw-insign.baloise.de", "acc-insign.baloise.de", "acc-gw-insign.baloise.de", "test-insign.baloise.de", "int-insign.baloise.de", "test-gw-insign.baloise.de", "int-gw-insign.baloise.de" ], "profile": { "findings": 6, "hostnames": 8, "live": 17, "paths": 2252, "requests": 11754, "services": 28, "summary": "CloudFront-origin-only alternate TLS listener for production inSign 3.81.11 build 1 on Java 17 and Apache Tomcat 10.1.55.", "technologies": [ "Apache Tika", "Spring Authorization Server", "Spring Framework", "Bouncy Castle", "Spring Security" ], "titles": [ "Open Source Bibliotheken", "inSign Login | Elektronische Unterschriftenl\u00f6sung made in Germany", "inSign elektronischer Unterschriftsprozess" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "int-gw-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-06d3087e9d6d8521e8fc25eb" }, { "asset_type": "DOMAIN", "identifier": "gw-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-098241ee0b9cc05cf8e60144" }, { "asset_type": "DOMAIN", "identifier": "acc-gw-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-0993e7fc2aa19090cb4ba256" }, { "asset_type": "DOMAIN", "identifier": "test-gw-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-18a2eb6f9f0bf24b333401c5" }, { "asset_type": "DOMAIN", "identifier": "insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-27a6e9d8fe3bc101faeb5198" }, { "asset_type": "DOMAIN", "identifier": "int-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-46e3b884857ade8d6f15a98f" }, { "asset_type": "DOMAIN", "identifier": "acc-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-b6eb495bf6e7887c0725b59b" }, { "asset_type": "DOMAIN", "identifier": "test-insign.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-c85143106d4b86c148d1c1f4" } ] }, { "unit_id": "u5", "kind": "app", "label": "base (baloise.de)", "hosts": [ "base.baloise.de", "acc-base.baloise.de", "int-base.baloise.de" ], "profile": { "findings": 2, "hostnames": 3, "live": 15, "paths": 1179, "requests": 7744, "services": 16, "summary": "CloudFront-origin-only alternate TLS listener for the production BASE 1.19.0 build 76 application: Java 21, Spring Boot, Spring Framework 6.2.0 or newer, Spring Security 6.4.0 or newer, and Angular behind Apache and Airlock Gateway.", "technologies": [ "Java", "Spring Boot", "Spring Framework", "Airlock Gateway", "Spring Security" ], "titles": [ "Please sign in", "Helvetia BASE Tarifrechner" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "int-base.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-0f418a9bb45e48394de55442" }, { "asset_type": "DOMAIN", "identifier": "base.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-1b2dbde30916b89dc526579b" }, { "asset_type": "DOMAIN", "identifier": "acc-base.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-9236bc7479c2f8564eb091b4" } ] }, { "unit_id": "u12", "kind": "app", "label": "autodiscover (baloise.de)", "hosts": [ "autodiscover.baloise.de" ], "profile": { "findings": 1, "hostnames": 1, "live": 7, "paths": 579, "requests": 1813, "services": 8, "summary": "CloudFront-origin-only alternate TLS listener for the Microsoft Exchange Server Subscription Edition 15.2.2562.56 frontend on IIS 10 and ASP.NET Framework 4.0.30319.", "technologies": [ "Microsoft Internet Information Services", "Microsoft Exchange Server Subscription Edition", "Microsoft HTTP Server API", "ASP.NET Framework" ], "titles": [ "Outlook", "Outlook - Sign out" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "autodiscover.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-736f0d60b80c1bb2010e4fe2" } ] }, { "unit_id": "u13", "kind": "app", "label": "mietkaution (baloise.de)", "hosts": [ "mietkaution.baloise.de" ], "profile": { "hostnames": 1, "live": 8, "paths": 669, "requests": 1412, "services": 8, "summary": "Alternate HTTPS listener for the IIS 10 Baloise Mietkaution application.", "technologies": [ "Glimpse MVC4", "Microsoft IIS", "ASP.NET Framework", "Glimpse ASP.NET", "ASP.NET Core" ], "titles": [ "Kautionsverwaltung \u00e0 la Baloise", "Baloise Mietkaution Testseite", "title" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "mietkaution.baloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-93ccc60bab04a6f5bcadf606" } ] }, { "unit_id": "u19", "kind": "app", "label": "autodiscover (qsbaloise.de)", "hosts": [ "autodiscover.qsbaloise.de" ], "profile": { "hostnames": 1, "live": 7, "paths": 99, "requests": 446, "services": 8, "summary": "CloudFront-origin-only alternate TLS listener for the QS Microsoft Exchange Server Subscription Edition 15.2.2562.56 frontend on IIS 10 and ASP.NET Framework 4.0.30319.", "technologies": [ "Microsoft Internet Information Services", "Microsoft Exchange Server Subscription Edition", "Microsoft HTTP Server API", "ASP.NET Framework" ], "titles": [ "Outlook", "Outlook - Sign out" ] }, "scope": [ { "asset_type": "DOMAIN", "identifier": "autodiscover.qsbaloise.de", "max_bounty": 3000.0, "max_severity": "critical", "scope_item_id": "asset-a6686c171daf65cc8172b699" } ] } ] } ] }