Red Teaming for a Reputable Private School with 1,000+ Students

Summary

A security-conscious US private school wanted to know how well its defenses would hold up against a realistic, targeted attack. It engaged INNERLUXES to run an all-around red team test. Working as real attackers would, with no prior knowledge of the school, the INNERLUXES team of Certified Ethical Hackers combined OSINT, black-box penetration testing, phishing, and vishing — surfacing 14 medium- and low-severity issues, confirming strong staff security awareness, and handing over detailed remediation guidance.

About the Client

The Client is a prestigious US private school with more than 1,000 students from kindergarten to 12th grade and a century-long history.

A Security-Conscious School Wanted to Test Its Defenses Against Real Attacks

Committed to a safe environment for its students, the school had already invested in security tools for its IT infrastructure, security-awareness training for its staff, and several vulnerability assessments and penetration tests. With cyberattacks on the US education sector — and K-12 schools in particular — on the rise, the school wanted to see how well its security would respond to a real, targeted attack. It looked for a vendor proficient in open-source intelligence, penetration testing, and social engineering to conduct full red team testing, and chose INNERLUXES, with its long cybersecurity track record, from among the candidates. The school entrusted the project to the INNERLUXES team of Certified Ethical Hackers, who began with no prior knowledge of the school or its infrastructure.

OSINT: Mapping the School's Public Footprint

To understand how they might infiltrate the school's infrastructure, the testers started with open-source intelligence — gathering information from online publications, social media, and other public sources. Using OSINT tools and analyzing their findings, they revealed 22 public-facing IPs (including 4 web applications), 76 employee emails, and 4 phone numbers, along with insight into internal activities that could make phishing emails and vishing calls more convincing.

Black-Box Penetration Testing: 14 Medium- and Low-Severity Issues

After scanning the components found during OSINT and attempting to exploit detected vulnerabilities, the testers identified 14 security issues of medium and low severity, including:

• Outdated web application components (a Java-based logging utility, a JavaScript library, an Apache web server, and a TLS protocol) with known vulnerabilities — which could let attackers run arbitrary code, steal cookie-based credentials, expose debugging information, cause connection failures, or observe traffic between the website and its visitors.
• Missing HTTP security headers (such as X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, and Strict-Transport-Security) that protect against cross-site scripting, clickjacking, and MIME-type sniffing.
• Weak IPsec VPN settings — aggressive mode enabled, allowing retrieval of the unencrypted authentication hash (pre-shared keys).
• A web application without an anti-automation mechanism to prevent brute-force attacks.
• A test account with weak credentials (username "test", password "test") that could be brute-forced easily.

INNERLUXES provided detailed remediation guidance, including upgrading the outdated components to the latest versions, implementing the missing security headers, avoiding IKE aggressive mode (or choosing a complex pre-shared key), adding CAPTCHA to login forms and configuring a web application firewall, and enforcing a strict password policy.

Phishing: The School's Anti-Phishing Tools and Staff Held Up

The team ran a bulk phishing campaign against the school's 76 employees using several scenarios — a notification about a sign-in from an unknown device, a curriculum-change notice with a review link, an invitation to a school concert with a registration link, and a warning about legitimate mail being marked as spam. The school's anti-phishing tool proved efficient: it flagged the emails as suspicious, so 80% of the targeted staff never opened them, and the remaining 20% did not click the links. The result was confirmation of a high level of security awareness among the staff.

Vishing: All Four Targeted Staff Stayed Vigilant

An INNERLUXES tester called four employees, posing as a tech-support worker checking that everything worked after recent network changes, and tried to talk them into exposing data useful for an attack — for instance, asking them to run the systeminfo command. All four were vigilant: they did not follow the instructions and quickly ended the call.

Validated Defenses and Fixed Overlooked Issues

The red team test gave the school proof that its security-management strategy was effective — high staff awareness and no critical infrastructure vulnerabilities. It also surfaced several issues that earlier security checkups had missed, and the detailed remediation guidance let the school's IT team fix them quickly and keep its assets protected.

Technologies and Tools

Metasploit, Nessus, Qualys, Burp Suite, OWASP ZAP, Nmap, Dirb, SSLScan.