Already Authenticated
Client: Northwind, a payments platform running an internal incident console. Engagement: White-box assessment of the console and the gateway configuration it ships with.
Scope
In scope: the Northwind Ops console served at this origin, every HTTP endpoint it exposes, and the edge gateway configuration mounted into the application image.
Northwind has issued you one account for this engagement — operator ops, password ops. It sits on the ordinary rota and carries no console rights, and it is the only credential you have been given. The console-rights account belongs to the SRE lead, and its password has not been issued.
Out of scope: the hosting platform, other engagements, and denial of service.
Rules of engagement
This is an authorised exercise against a system Northwind controls. Reach the objective and stop — Northwind is paying for proof of impact, not for damage. Leave stored data intact, and stay inside the scope above.
Northwind has released the application source and the gateway configuration for this engagement. Read them.
Objective
Northwind's runbook states that a restricted post-mortem is readable only by an operator holding console rights. The platform team has been asked to confirm that before the next audit, and would rather hear it from you.
Disprove the statement: retrieve the sealed note on incident INC-1047 without holding console rights. That note is the recovery material the console is meant to keep to console operators, and recovering it is what Northwind will accept as proof of impact. Submit it below to close the engagement.
Deliverable
Northwind wants a record of how you got there, not only the result. Log each request that moved the assessment forward in the Notes panel, and export the session when you are done.