Please note that the following aspects were all fixed by free2z.cash admin.

FREE2Z.CASH Security Audit

Introduction

In 04/21/2022, I ran a security audit to detect if there's any vulnerabilities or security flaws that may lead to a successful attack against free2z.cash. as tools I used nmap, metasploit, vega and some other automated scripts.

HTTP Strict Transport Security

free2z.cash was forbidding HTTP communication by redirecting to HTTPS, yet disabling HTTP support is not sufficient to prevent attacks that downgrade web browsers to plain HTTP.

During an attack, it doesn’t matter whether the “real” server has disabled HTTP. If the client can be coaxed into initiating a plain HTTP connection – such as when a user clicks an http:// link, or types a URL into their browser manually – then a local attacker can respond to that connection attempt from their own server and establish their own connection.

HSTS specifically instructs web browsers to never initiate plain HTTP connections. If a user clicks an http:// link or types in an http:// URL, HSTS causes the browser to first rewrite the URL to use https:// before initiating the connection.

For this reason, HSTS is necessary to effectively prevent downgrade attacks, even if plain HTTP connections are unsupported on the server.

Outdated JavaScript libraries

free2z.cash was using some outdated JS libraries such as lodash and jQuery which have multiple vulnerabilities.

A JavaScript library that is missing security patches can make free2z.cash extremely vulnerable to various attacks, this is why keeping them up to date is essential.

Accessible Technologies' Versions

Free2z.cash had its web server version public, most web technologies, including server-side software such as web server, leave trails of evidence of their presence in websites' HTML code. This code is publicly accessible, which is necessary for browsers to render and display the page.

It may seem concerning that information about free2z.cash technology stack is exposed. After all, hackers often target platforms with known vulnerabilities all the time. However, simply knowing what software is in use is not enough to hack a website: there has to be a known, unpatched vulnerability to exploit.

Relying on secrecy as the main method of security is a practice widely rejected by security experts. However, a level of obscurity can help deter malicious hackers.

Firewall Rules

free2z.cash database was responsive while using metasploit, and I was able to run a small brute-force attack that was unsuccessful, Adding rules to the firewall to block inbound connections to database prevents unauthorized access to server ressources.