Audit enterprise VPN attack surface

Fingerprint and exploit pre-auth SSL VPN appliances across 7 vendor platforms

Perimeter testing when SSL VPN appliances are initial-access points.

• · VPN appliance URL or banner
• · optional target version

• · vendor/version identification
• · CVE exploit matrix with PoC patterns
• · authentication bypass or info-disclosure payload

• · curl
• · nuclei
• · public PoC exploits

External-scope appliance reachable; authorized engagement

DoS attacks (explicitly out-of-scope); disruptive CVEs listed but not executed

• · Vendor-specific fingerprint recipes (paths, headers, cookies)
• · 2018-2026 CVE timeline with PoC test commands