MEDIUM · gas

Petronet LNG

2026-10-05 passive check: HTTP 405; TLS expires 2027-02-05; 5 headers absent on observed response.

petronetlng.combaseline scan 2026-04-27 · daily passive check 2026-10-05 · historical phase 2 assessment 2026-04-28

Daily passive check · 2026-10-05

score 20

Availability

HTTP 405

TLS

2027-02-05 · 123d

Headers

5 missing · 0 permissive

Email auth

SPF strict · DMARC reject

58

Baseline score · 2026-04-27

Watch

Historical findings · 2026-04-27

  • 01All 6 hardening headers missing (HTTP 405 response on root)
  • 02ADFS endpoint visible in CT logs
  • 03Strong email-auth controls (SPF strict, DMARC p=reject)
  • 04Cert expires September 2026

TLS security

pass

Issuer
GoDaddy.com
Expires
2027-02-05(123d)

Email authentication

SPF
strict
DKIM
present
DMARC
reject

Hardening headers

1 / 0 / 5present/permissive/missing

  • HSTSmissing
  • CSPmissing
  • X-Framemissing
  • X-Content-Typepresent
  • Referrer-Policymissing
  • Permissions-Policymissing

Lookalike domains

  • petronetlng.net→ 15.197.225.128 (AWS, entity-owned alternate)

Public topology · CT logs

6 total · 2 sensitive

petronetlng.com
Authentication
  • adfs.petronetlng.com
Infrastructure
  • smtpdahej.petronetlng.com
  • smtpdelhi.petronetlng.com

Certificate-transparency logs are immutable and public. Sensitive subdomains advertised here cannot be retracted; the mitigation is forward-only — new internal services route through a private CA that does not submit to public CT.

Historical active assessment · 2026-04-28 · open archive

Historical phase 2 assessment · 2026-04-28

This assessment is preserved as a dated record. Its attack paths and patch deadlines are not current findings; use the daily passive check above for current TLS, headers, availability, and email authentication.

Historical question from 2026-04-28

Is the ADFS metadata endpoint at adfs.petronetlng.com publicly accessible without authentication, and is MFA enforced on all user accounts?

Active fingerprints · per host

  • petronetlng.comEOL × 2

    Application server returning HTTP 405 on root; ADFS endpoint adfs.petronetlng.com; SMTP infra (smtpdahej, smtpdelhi)

    • ⚠ TLS expires 2026-09-12 (136 days)
    • ⚠ All 6 hardening headers MISSING on root response

Attack-path simulation

Mythos-class adversary analytical chain · paths ranked by exploitability × access value.

#1

Path A: ADFS metadata exposure → SAML token forgery / NTLM relay

effort days
detect medium
Entry
ADFS endpoint at adfs.petronetlng.com publicly named in CT; metadata at /FederationMetadata/2007-06/FederationMetadata.xml may be unauthenticated.
Pivot
Harvest signing certificates and token endpoints; craft forged SAML/OIDC tokens or initiate NTLM relay (CVE-2025-33073).
Objective
Unauthorised access to Petronet systems; impersonate employees; SAP / ERP access.
#2

Path B: NTLM relay targeting ADFS-backed Windows infrastructure

effort days
detect medium
Entry
Hybrid Azure AD with NTLM auth typical for corporate; attacker on network or via compromised app.
Pivot
Capture NTLM exchange; relay to ADFS or internal service without SMB signing.
Objective
Privilege escalation; MFA bypass if NTLM is primary factor.
#2

Path C: SMTP recon + sector-themed phishing

effort days
detect low (bad)
Entry
smtpdahej / smtpdelhi named in DNS; SPF strict / DMARC reject blocks direct spoofing but enables intel.
Pivot
Craft convincing internal-looking emails to Petronet employees with SideCopy-style oil-and-gas regulatory lures.
Objective
Initial compromise via email malware (CurlBack / Spark / Xeno RAT).
#3

Path D: Missing hardening headers → clickjacking + reflected XSS

effort hours
detect medium
Entry
0/6 hardening headers; HTTP 405 on root suggests app server with no header middleware.
Pivot
Frame login pages in iframe overlay; reflected XSS via user-input parameters.
Objective
Session hijacking; phishing amplification.

Mythos compression

Discovery-time compression: pre-AI adversary vs Mythos-class adversary, per attack path.

Path A · ADFS metadata exposure → SAML token forgery / NTLM relay
factor ~10–20× (ADFS = crown jewel of Microsoft identity stack; LNG pricing/logistics is strategic IP)
pre-AI
ADFS metadata + NTLM relay → admin token forgery → SAP access
Mythos
Energy-company ADFS becomes attacker's authentication oracle; impersonate CFO; access LNG shipment schedules, pricing, supply agreements; pivot to OT via SAP-connected SCADA
Path C · SMTP recon + sector-themed phishing
factor ~2–4×
pre-AI
SMTP recon + crafted phishing → credential harvest before relay attempted
Mythos
Phishing low-cost; high ROI if employee training weak

The compression factor is reasoned, not measured. Mythos-class capability changes the tempo of attack-path traversal; the topology of the chain is unchanged.

Historical patch list · 2026-04-28

Tier 1 · within 7 days

  • critical

    Restrict ADFS metadata endpoint; require authentication

    Host
    adfs.petronetlng.com
    Fix
    PowerShell: Set-AdfsProperties -AllowAnonymousAccess $false. IIS URL Rewrite: block /FederationMetadata unless from whitelisted partner federation IPs.
    Owner
    Petronet Identity / ADFS Admin
    Validation
    curl /FederationMetadata returns 403 from external IP
  • critical

    Enforce MFA on all ADFS-backed accounts; disable legacy NTLM

    Host
    Petronet AD users
    CVE
    CVE-2024-21410, CVE-2025-33073
    Fix
    Azure AD Conditional Access → MFA required all users. ADFS auth providers → Forms + Microsoft Identity. Group Policy → 'Restrict NTLM: Incoming NTLM traffic' → Deny all.
    Owner
    Petronet IAM
    Validation
    Login without MFA rejected; NTLM auth attempts in event log show denials
  • critical

    Patch Windows DCs for CVE-2025-33073; enforce SMB signing

    Host
    Internal AD infra
    CVE
    CVE-2025-33073
    Fix
    Apply current Microsoft Security Update on all DCs. Group Policy SMB signing → Required.
    Owner
    Petronet Windows Admin
    Validation
    Get-SmbServerConfiguration | RequireSecuritySignature → True

Tier 2 · within 30 days

  • high

    Add all 6 hardening headers to petronetlng.com

    Host
    petronetlng.com
    Fix
    HSTS, CSP, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy.
    Owner
    Petronet Web Ops
    Validation
    securityheaders.com returns A+
  • high

    Document and harden SMTP infra (smtpdahej, smtpdelhi)

    Host
    smtpdahej.petronetlng.com / smtpdelhi.petronetlng.com
    Fix
    Restrict SMTP relay to authenticated internal users. Enforce SMTP TLS. nmap on 25/465/587 should show filtered or auth-required.
    Owner
    Petronet Mail / IT Ops
    Validation
    External SMTP test rejected; mxtoolbox shows no open relay
  • high

    TLS renewal scheduled for July 2026 (ahead of 2026-09-12 expiry)

    Host
    petronetlng.com
    Fix
    Calendar alert 2026-07-01. Generate CSR; submit to GoDaddy or alternate CA.
    Owner
    Petronet TLS Admin
    Validation
    openssl x509 -enddate post-renewal shows notAfter > 2027

Methodology is reproducible by any visitor with curl, dig, and openssl. Passive checks record observed HTTP, TLS, header, and DNS state, not proof of exploitation. Historical active assessments are dated and are not current operational guidance.

Sibling: Sanjaya — fuel data on the same Ministry portfolio. Sanjaya tracks energy data; Sanket tracks public security observations.