Case Study · Systems & Integrations

Detecting exposed data OSINT and penetration testing for a logistics company

Partner project by Innowise

Project profile

CustomerNot named
PartnerInnowise
IndustryLogistics / warehousing

Challenge

A US warehousing company suspected that sensitive information was unintentionally publicly accessible. Its existing security processes were not defined clearly enough. The aim was to make external data exposure and weaknesses in the internal safeguards visible.

Solution

Looking at several sources together

Innowise combined OSINT research with authorized penetration testing. The scope covered publicly reachable information, code repositories and indications of exposed credentials.

Technology and everyday practice considered together

The findings showed how both development processes and careless publications by employees can give information away. Indications of weak password practices were also found. This level of detail is sufficient for the website; credentials and exploitable details stay outside the description.

Connecting external traces into one risk picture

Public sources: Information → OSINT & testing: Assess findings; Code repositories: Exposed content → OSINT & testing: Assess findings; Leak indications: Credentials → OSINT & testing: Assess findings; OSINT & testing: Assess findings → Risk picture: Technology & processes; Risk picture: Technology & processes → Safeguards: Client implementation.

Technologies

Maltego / SpiderFoot / Shodan
Gitleaks / TruffleHog
Nmap / Burp Suite

Results

The assessment identified data leaks and organizational weaknesses. On that basis the client was able to improve its security practices. The source contains no dependable percentage risk reduction and no specific time saving.

Public data exposure identified
Password practices reviewed
Technical and organizational measures derived