External network penetration testing

Description

The remote access portal asks only for username and password. Account lockout works, so passwords cannot simply be guessed. But a password from a phishing mail or an old data leak at another website is enough to log in as that employee and read their mailbox and department files.

Steps to reproduce

1. Open https://vpn.admin-soehne.example and log in with the test account provided.
2. Observe that access is granted after the password alone, with no second step.
3. Check the portal settings with the client’s admin: two-factor authentication is available but switched off.

Login with test account: password only → "Connected"
Portal policy: MFA = disabled
lockout after 5 failed attempts = enabled
Access after login: own mailbox, department files

Business impact

Not a break-in on its own, but it removes a cheap safety net at the most common entry point. With one stolen password, an attacker reads one employee’s mail and files and can send mail in their name. Cyber insurers and NIS2 audits ask for MFA on all remote access.

Remediation

Turn on two-factor authentication for every remote access account, preferably with number matching or a security key. Alert the IT team on logins from unusual countries. Review once a year who needs remote access at all.