A check counts as complete only when it finished and produced enough evidence to rely on. Where a check was limited, the absence of findings for it does not show the asset is free of those issues.
| Asset | Complete | Limited or missing |
|---|---|---|
| tcp://app.example.com | Certificate transparency, Port and service discovery, SNMP service, UDP amplification, CVE version lookup, Email domain security | None |
| tls://app.example.com:443 | Certificate validation, TLS configuration | ✗ TLS vulnerability tests — Did not complete |
| http://app.example.com | Template scan | ⚠ HTTP security headers — Output incomplete or truncated ✗ Content discovery — Did not complete ⚠ Web crawl — Crawler reached only 3 URLs ✗ Browser crawl (JavaScript) — Did not complete ⚠ Web application scan — Active testing limited to 2 rules |
| https://app.example.com | HTTP security headers | ✗ Content discovery — Did not complete ⚠ Template scan — Output incomplete or truncated ⚠ Web crawl — Crawler reached only 3 URLs ✗ Browser crawl (JavaScript) — Did not complete ⚠ Web application scan — Active testing limited to 2 rules |
TLS 1.0 is accepted (tls://app.example.com:443), TLS 1.1 is accepted (tls://app.example.com:443)Nginx: ssl_protocols TLSv1.2 TLSv1.3;
Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3
| Asset | Findings | Highest severity |
|---|---|---|
| tls://app.example.com:443 | 5 | Medium |
| http://app.example.com | 1 | Low |
| https://app.example.com | 9 | Low |
| tcp://app.example.com | 1 | Info |
| # | Finding | Endpoint | Severity | Found by | Assurance |
|---|---|---|---|---|---|
| 1 | TLS 1.0 is accepted | tls://app.example.com:443/ | Medium | TLS configuration | Observed |
| 2 | TLS 1.1 is accepted | tls://app.example.com:443/ | Medium | TLS configuration | Observed |
| 3 | TLS cipher suites without forward secrecy are offered | tls://app.example.com:443/ | Low | TLS configuration | Observed |
| 4 | TLS CBC-mode cipher suites are offered | tls://app.example.com:443/ | Low | TLS configuration | Observed |
| 5 | Server header reveals technology information | http://app.example.com/sitemap.xml +2 more |
Low | Web security scan (ZAP) | Observed |
| 6 | HTTP Strict Transport Security (HSTS) header missing | https://app.example.com/ +2 more |
Low | HTTP security headers Web security scan (ZAP) |
Corroborated by multiple tools |
| 7 | Content Security Policy (CSP) header missing | https://app.example.com/ | Low | HTTP security headers | Observed |
| 8 | Clickjacking protection missing | https://app.example.com/ | Low | HTTP security headers | Observed |
| 9 | X-Content-Type-Options header missing | https://app.example.com/ | Low | HTTP security headers | Observed |
| 10 | Unneeded HTTP methods are allowed | https://app.example.com/ | Low | HTTP security headers | Observed |
| 11 | Cross-origin resource sharing allows any origin | https://app.example.com/robots.txt +2 more |
Low | Web security scan (ZAP) | Observed |
| 12 | X-Powered-By header discloses the application framework | https://app.example.com/ +2 more |
Low | Web security scan (ZAP) | Observed |
| 13 | Anti-spoofing policy of the parent domain not yet verified | tcp://app.example.com/ | Info | Email domain security (SPF, DKIM, DMARC) | Observed |
| 14 | TLS 1.3 is not offered | tls://app.example.com:443/ | Info | TLS configuration | Observed |
| 15 | Referrer-Policy header missing | https://app.example.com/ | Info | HTTP security headers | Observed |
| 16 | Permissions-Policy header missing | https://app.example.com/ | Info | HTTP security headers | Observed |
The service completes handshakes using TLS 1.0, which was formally deprecated in 2021 (RFC 8996).
TLS 1.0 lacks modern cipher suites and has known weaknesses (BEAST, POODLE-class downgrades). Practical attacks need a privileged network position and a client that still negotiates TLS 1.0. The main consequence today is non-compliance: PCI DSS has prohibited it since 2018.
Disable TLS 1.0 and 1.1 and offer TLS 1.2 and 1.3 only.
Nginx: ssl_protocols TLSv1.2 TLSv1.3;
Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3
Confirm legacy clients that must connect support TLS 1.2 before the change.
CWE-327
CVSS 3.1: 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The service completes handshakes using TLS 1.1, which was formally deprecated in 2021 (RFC 8996).
TLS 1.1 offers no modern (AEAD) cipher suites. Direct attacks are impractical, but the protocol is non-compliant with PCI DSS and NIST SP 800-52r2.
Disable TLS 1.0 and 1.1 and offer TLS 1.2 and 1.3 only.
Nginx: ssl_protocols TLSv1.2 TLSv1.3;
Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3
Confirm legacy clients that must connect support TLS 1.2 before the change.
CWE-327
CVSS 3.1: 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The server accepts TLS 1.2 cipher suites that use static RSA key exchange.
If the server's private key is ever compromised, previously recorded traffic that used these suites can be decrypted. Modern clients prefer forward-secret suites, so exposure depends on which clients connect.
Remove static-RSA key exchange suites (TLS_RSA_WITH_*) and keep ECDHE suites only.
Use the Mozilla SSL Configuration Generator "intermediate" profile: https://ssl-config.mozilla.org/
CWE-326
The server accepts TLS 1.2 cipher suites that use CBC mode rather than authenticated encryption (AES-GCM, ChaCha20-Poly1305).
CBC suites have a history of padding-oracle attacks (Lucky13). Current TLS libraries mitigate these, so the risk is low; removing them is hardening.
Prefer AEAD suites and remove CBC suites once clients support them.
Use the Mozilla SSL Configuration Generator "intermediate" profile: https://ssl-config.mozilla.org/
CWE-327
The Server HTTP header discloses the web server software and/or version number, aiding attackers in fingerprinting the technology stack.
Knowing the exact server version helps attackers select targeted exploits and reduces the effort needed for reconnaissance.
Remove or genericize the Server header:
Nginx: server_tokens off;
Apache: ServerTokens Prod and ServerSignature Off
IIS: Use URL Rewrite to remove the header.
CWE-497 CWE-200
CVSS 3.1: 2 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
The server does not send the Strict-Transport-Security header. This header tells browsers to always connect via HTTPS, preventing protocol downgrade attacks.
Without HSTS, a user who reaches the site over plain HTTP (by typing the bare domain or following an old link) can be intercepted before the redirect to HTTPS. The attacker must be on the same network path.
Add to your web server or reverse proxy:
Nginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Test with: curl -sI https://<host>/ | grep -i strict
CWE-319
No Content-Security-Policy header is set. CSP restricts which resources the browser can load, providing a strong defense against XSS and data injection.
CSP limits which scripts a browser will run on the page. Without it, any cross-site scripting flaw is easier to exploit. Its absence is a missing defence-in-depth layer, not a vulnerability by itself, and it matters little for API-only responses.
Start with a restrictive policy and relax as needed:
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'
Use report-uri or report-to directives initially with Content-Security-Policy-Report-Only to test without breaking functionality.
CWE-693
Neither an X-Frame-Options header nor a Content-Security-Policy frame-ancestors directive is set, so any site can load these pages inside a frame.
An attacker can frame the application on a page they control and trick users into clicking hidden buttons, for example to change settings or confirm actions (clickjacking).
Prevent other sites from framing the application:
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
Send both for compatibility with older browsers.
CWE-1021
The X-Content-Type-Options: nosniff header is not set. Without it, browsers may MIME-sniff responses and interpret files as a different content type than declared.
An attacker could upload a file that the browser interprets as executable script, bypassing content type restrictions.
Add the header to all responses:
Nginx: add_header X-Content-Type-Options "nosniff" always;
Apache: Header always set X-Content-Type-Options "nosniff"
CWE-693
CVSS 3.1: 3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
The server advertises or accepts HTTP methods such as PUT, DELETE or PATCH on a path where they are not expected.
Accepted methods are only a risk if the application handles them without authorisation. They widen the surface that must be tested.
Allow only the methods each route needs (typically GET, HEAD, POST, OPTIONS) at the reverse proxy or framework router.
CWE-749
Responses include Access-Control-Allow-Origin: *, so scripts on any website may read them from a visitor's browser.
For public, unauthenticated content this is usually harmless. It becomes a data-exposure risk only if the same responses carry information that should be restricted to the application's own pages. Browsers never send cookies with wildcard CORS requests.
Confirm the affected responses contain only public data.
If they do not, return Access-Control-Allow-Origin only for the specific origins that need access, and add Vary: Origin.
CWE-264 CWE-942
CVSS 3.1: 3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Responses include an X-Powered-By header naming the framework or runtime that generated them.
The header narrows an attacker's search for known vulnerabilities. It carries no risk on its own.
Remove the X-Powered-By header at the application or reverse proxy.
Express: app.disable('x-powered-by')PHP: expose_php = Off
Nginx: proxy_hide_header X-Powered-By;
CWE-497 CWE-200
CVSS 3.1: 2 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
This host does not receive mail and publishes no SPF or DMARC record of its own. Receivers apply the parent domain's DMARC subdomain policy, which this capture did not record.
None if the parent domain publishes DMARC with sp=reject or p=reject. The next scheduled assessment checks the parent domain automatically.
No action needed if the parent domain enforces DMARC. Otherwise add sp=reject to the parent domain's DMARC record.
The service does not negotiate TLS 1.3.
No direct risk while TLS 1.2 is correctly configured. TLS 1.3 removes legacy options and speeds up connection setup.
Enable TLS 1.3 alongside TLS 1.2 on the terminating server or load balancer.
No Referrer-Policy header is set. The browser may send the full URL (including query strings with sensitive data) to third-party sites in the Referer header.
Browsers already default to strict-origin-when-cross-origin, which removes paths and query strings from cross-site Referer headers. Setting the header explicitly documents the intent and protects older browsers.
Set a restrictive referrer policy:
Referrer-Policy: strict-origin-when-cross-origin
This sends only the origin (not the full URL) for cross-origin requests and the full URL for same-origin requests.
CWE-200
The Permissions-Policy (formerly Feature-Policy) header is not set. This header controls which browser features (camera, microphone, geolocation) can be used by the page and embedded content.
Embedded iframes or injected scripts could access sensitive browser APIs without restriction.
Add a restrictive Permissions-Policy:
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
This disables sensitive features by default. Enable specific features only as needed.
CWE-693
Frameworks referenced by findings in this assessment. This mapping is informational — it is not a compliance attestation.
ISO/IEC 27001:2022 references cover Annex A technological controls only. Certification also depends on organisational, people and physical controls outside the scope of a scan.
| Framework | Referenced controls | Findings |
|---|---|---|
| PCI DSS 4.0.1 | 4.2.1, 6.2.4 | 6 |
| OWASP | A02:2021, A05:2021 | 12 |
| ISO/IEC 27001:2022 | A.8.24, A.8.26, A.8.9 | 15 |
| NIST | SP 800-52r2 | 4 |
| Tool | Status | Findings | Notes |
|---|---|---|---|
| Certificate transparency lookup auditon-audit-v1 | ✓ | 0 | |
| Port scan (nmap) auditon-audit-v1 | ✓ | 0 | |
| Platform service probe auditon-audit-v1 | Skipped | 0 | Not applicable to target |
| SSH configuration audit auditon-audit-v1 | Skipped | 0 | Not applicable to target |
| SMB service probe auditon-audit-v1 | Skipped | 0 | Not applicable to target |
| SNMP service probe auditon-audit-v1 | ✓ | 0 | |
| UDP amplification check auditon-audit-v1 | ✓ | 0 | |
| CVE version lookup auditon-audit-v1 | ✓ | 0 | |
| Email domain security (SPF, DKIM, DMARC) auditon-audit-v1 | ✓ | 1 | |
| Certificate validation auditon-audit-v1 | ✓ | 0 | |
| TLS configuration auditon-audit-v1 | ✓ | 5 | |
| TLS configuration (testssl) auditon-audit-v1 | ✗ failed | 0 | Tool reported failure |
| Database service probe auditon-audit-v1 | Skipped | 0 | Not applicable to target |
| HTTP security headers auditon-audit-v1 | ⚠ | 7 | Output may be truncated; resolution disabled |
| Directory and file discovery auditon-audit-v1 | ✗ failed | 0 | Tool reported failure |
| Template scan (Nuclei) auditon-audit-v1 | ✓ | 0 | |
| Web endpoint discovery ZAP 2.16.1 | ✓ | 0 | |
| Web endpoint discovery ZAP 2.16.1 | ✓ | 0 | |
| Web endpoint discovery ZAP 2.16.1 | ✓ | 0 | |
| Web endpoint discovery ZAP 2.16.1 | ✗ failed | 0 | Tool reported failure |
| Web endpoint discovery web-v1 | Skipped | 0 | Not applicable to target |
| Web endpoint discovery ZAP 2.16.1 | ✓ | 0 | |
| Web endpoint discovery web-v1 | Skipped | 0 | Not applicable to target |
| Web security scan (ZAP) ZAP 2.16.1 | ✓ | 4 | |
| HTTP security headers auditon-audit-v1 | ✓ | 7 | |
| Directory and file discovery auditon-audit-v1 | ✗ failed | 0 | Tool reported failure |
| Template scan (Nuclei) auditon-audit-v1 | ⚠ | 0 | Output may be truncated; resolution disabled |
| Web endpoint discovery ZAP 2.16.1 | ✓ | 0 | |
| Web endpoint discovery ZAP 2.16.1 | ✓ | 0 | |
| Web endpoint discovery ZAP 2.16.1 | ✓ | 0 | |
| Web endpoint discovery ZAP 2.16.1 | ✗ failed | 0 | Tool reported failure |
| Web endpoint discovery web-v1 | Skipped | 0 | Not applicable to target |
| Web endpoint discovery ZAP 2.16.1 | ✓ | 0 | |
| Web endpoint discovery web-v1 | Skipped | 0 | Not applicable to target |
| Web security scan (ZAP) ZAP 2.16.1 | ✓ | 4 | |
| Credential check auditon-audit-v1 | Skipped | 0 | Not applicable to target |
| Log analysis auditon-audit-v1 | Skipped | 0 | Not applicable to target |