Shadow IT to Customer Data at Northwind
A fictional external-to-internal breach for training
Northwind Logistics thought its attack surface was small. It wasn't. This fictional replay follows an attacker who starts with nothing but the company name, finds a forgotten staging subdomain in certificate-transparency logs, and chains a debug endpoint → a world-readable cloud backup → a leaked CI deploy key → a flat internal network, ending at the customer database. Every link is a routine ASM finding. Press play to watch a small oversight become a breach.
Fictional training scenario. Northwind Logistics is an invented company; all hosts, buckets, and timestamps are made up. It exists to show how an ordinary attack-surface gap — one forgotten subdomain — can chain all the way to customer data.
Break the Chain
You're the defender. Deploy up to 2 controls, then run the intrusion. Each control you place severs the attack chain at one point — the agent reaches everything up to it, and nothing beyond. Contain it as early as you can.
Deploy controls, then run to see how far the agent gets.
- Public internetCertificate transparencyforgotten subdomains
- Northwind perimeter↓forgotten hoststaging-payments.northwinddebug endpoint exposed
- Northwind cloud↓creds in debugBackup bucketworld-readable
- Northwind CI/CD↓deploy keyCI runnerleaked deploy key
- Northwind internal network↓runner in VPCInternal servicesflat network
- ↓flat networkCustomer databasePII
Defensive lessons
- 1Attack surface is what you forgot, not what you remember. staging-payments was a real host with a real certificate that nobody was watching — certificate-transparency monitoring would have flagged it the day it was issued.
- 2Debug endpoints that echo environment variables are credential leaks waiting to happen. Ship builds with debug disabled, and never put production credentials in a staging environment.
- 3A public storage bucket turns one leaked key into a data breach. Enforce block-public-access at the account level and treat every backup as if it contains the crown jewels — because it does.
- 4Long-lived deploy keys in backups chain cloud access into network access. Use short-lived, scoped credentials, and keep secrets out of anything that gets backed up in the clear.
- 5A flat network means one foothold equals full reach. Segment build infrastructure from production, and don't let a CI runner talk to the customer database.
- 6Every link here was a routine ASM finding — a forgotten subdomain, an open bucket, a reused credential. Continuous discovery catches these while they are still just findings, not incident timelines.