---
name: rt-exploit-osticket
description: "Authorized osTicket/helpdesk portal security testing skill covering public ticket flows, staff authentication, attachment handling, stored-content risk, rate limits, sensitive ticket data, and remediation."
---

# rt-exploit-osticket - Helpdesk Portal Security Testing

> Coordinate with helpdesk owners before any workflow, volume, or attachment testing. Public support portals often connect directly to operational staff.

## Overview

Helpdesk portals combine public input, file attachments, staff workflows, notification systems, and sensitive historical data. This skill evaluates osTicket-style deployments for application security and business process risk.

## Prerequisites

- Portal URL and staff panel scope.
- Test customer account if applicable.
- Approved attachment types and size limits.
- Approved rate limits.
- Helpdesk owner contact.
- Rules for testing stored content and notifications.

## Assessment Areas

| Area | Checks |
|---|---|
| Public Ticket Creation | CAPTCHA, rate limits, required fields, abuse protection. |
| Staff Authentication | MFA, lockout, password policy, exposed staff panel. |
| Authorization | Ticket ID enumeration, department separation, attachment access. |
| Attachment Handling | Type validation, malware scanning, storage location, direct serving. |
| Stored Content | Safe rendering of names, subject, message, and custom fields. |
| Data Retention | Sensitive credentials or PII in old tickets. |
| Notifications | Header injection, notification flooding, sensitive content in emails. |

## Workflow

1. Map public and staff endpoints.
2. Create test tickets with harmless markers.
3. Validate whether markers are rendered safely to staff.
4. Test attachment controls with benign files only.
5. Review access control around ticket IDs and attachments.
6. Review operational controls: rate limits, spam handling, staff MFA.
7. Document business impact and fixes.

## Evidence

Capture ticket IDs, timestamps, role used, rendered output screenshots, response headers, and redacted email notifications. Never upload real malware or active web shells.

## Remediation

- Enforce MFA for staff.
- Restrict `/scp/` staff panel.
- Add strict attachment allowlists and scanning.
- Encode all user-controlled fields in staff views and email templates.
- Add rate limiting and abuse monitoring.
- Reduce sensitive data retention in tickets.

## Autodoc

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-osticket --phase exploitation --cmd "helpdesk validation" --output "redacted portal findings"
```

