branches.firstnationalbank.com

Full scan against port 443. Started 2026-08-26 01:27 UTC and finished in 6.9 seconds.

1
critical
4
high
1
medium
2
low
0
info

Engagement

Engagement id
43385232-34ee-45e7-827e-123331c44a86
Target
branches.firstnationalbank.com
Port
443
Scan type
Full scan
Started
2026-08-26 01:27 UTC
Completed
2026-08-26 01:27 UTC
Duration
6.87 s
Findings
8
Open ports
80, 443

Negotiated session

Key exchange group
X25519 Classical
Certificate algorithm
RSA-2048
Protocol version
TLSv1.2
Server name
branches.firstnationalbank.com

Findings

CRITICAL Classical key exchange negotiated (X25519) 68785bba

The handshake on branches.firstnationalbank.com:443 settled on X25519, a purely classical group whose security rests on the elliptic curve discrete logarithm problem. Shor's algorithm recovers the session key from a recorded transcript, so confidentiality has a fixed expiry date rather than an open ended one.

Remediation. Enable the hybrid group X25519MLKEM768 and place it first in the group preference list so capable clients never fall back to X25519.

Categorycrypto
NIST 800-53SC-8, SC-12, SC-13
CMMCSC.L2-3.13.8, SC.L2-3.13.11
CNSA 2.0CNSA 2.0 Key Establishment
ATT&CKT1040, T1557
HIGH Harvest now decrypt later exposure on recorded sessions a655ebbe

Traffic protected by X25519 can be captured today and held until quantum capability arrives. Any session material on branches.firstnationalbank.com with a retention requirement past 2030 should be treated as already disclosed to a patient collector.

Remediation. Move the listener to hybrid key establishment and re key any long lived secret that was negotiated under the classical group.

Categorycrypto
NIST 800-53SC-8(1), SC-12, SC-28
CMMCSC.L2-3.13.8
CNSA 2.0CNSA 2.0 Transition Timeline
ATT&CKT1040
HIGH Certificate signed with RSA-2048 4a83a6f8

The leaf certificate presented by branches.firstnationalbank.com is signed with RSA-2048. The signature holds against classical factoring today, but the issuing key has no quantum safe successor staged, so a forged chain becomes possible on the same timeline as the key exchange break.

Remediation. Reissue the leaf and the issuing authority under ML-DSA-87, or run a composite chain while relying parties catch up.

Categorycrypto
NIST 800-53SC-12, SC-17, IA-5
CMMCIA.L2-3.5.2, SC.L2-3.13.10
CNSA 2.0CNSA 2.0 Digital Signature
ATT&CKT1557
HIGH Negotiated protocol version is TLSv1.2 b24d4901

branches.firstnationalbank.com:443 completed the handshake at TLSv1.2. That version has no path to hybrid key establishment, keeps renegotiation available and leaves cipher selection in the hands of the client.

Remediation. Require TLSv1.3 on the listener and retire the TLSv1.2 compatibility profile once client telemetry supports it.

Categorycrypto
NIST 800-53SC-8, SC-13, SC-23
CMMCSC.L2-3.13.8, SC.L2-3.13.11
CNSA 2.0CNSA 2.0 Protocol Baseline
ATT&CKT1040, T1557
HIGH Permissive cross origin resource sharing policy 2bf183e4

branches.firstnationalbank.com answers with an Access-Control-Allow-Origin wildcard alongside credentialed responses. Any origin can read authenticated content from a visitor's browser session.

Remediation. Replace the wildcard with an explicit origin allow list and drop the credentials flag on responses that do not need it.

Categoryweb
NIST 800-53AC-4, SC-7
CMMCAC.L2-3.1.3
ATT&CKT1190, T1539
MEDIUM Certificate chain carries no quantum safe signature path 7375ec2a

Every certificate from the leaf to the root on branches.firstnationalbank.com is signed with a classical algorithm. There is no composite or fallback path a relying party could pivot to during an incident.

Remediation. Stage an ML-DSA-87 root and cross sign the existing issuing authority so the chain can be switched without a reissue window.

Categorycrypto
NIST 800-53SC-12, SC-17
CMMCSC.L2-3.13.10
CNSA 2.0CNSA 2.0 Digital Signature
ATT&CKT1557
LOW Server header discloses build version dee1eea2

The Server header returned by branches.firstnationalbank.com names the product and its build. That is enough to select a version specific exploit before a single request is sent against the application itself.

Remediation. Suppress the version token at the edge proxy and return a generic product name or no header at all.

Categoryweb
NIST 800-53SI-11, CM-6
CMMCSI.L2-3.14.6
ATT&CKT1592
LOW Open port inventory recovered from sweep 415e84dc

A sweep of branches.firstnationalbank.com found 80, 443 answering. Each open port is a durable entry in an attacker's map of the estate.

Remediation. Confirm every open port has a named owner and a current justification, then close the remainder.

Categorynetwork
NIST 800-53CM-7, SC-7
CMMCCM.L2-3.4.7
ATT&CKT1046

MITRE ATT&CK techniques exercised

Full coverage view
TechniqueNameTacticMitigation
T1040 Network Sniffing Credential Access Establish sessions with a hybrid group so a recorded transcript cannot be unwound once quantum capability arrives.
T1046 Network Service Discovery Discovery Restrict management listeners to an allow listed source range and retire services that carry no current owner.
T1190 Exploit Public Facing Application Initial Access Remove unauthenticated administrative paths from the public origin and place a policy aware proxy in front of it.
T1539 Steal Web Session Cookie Credential Access Set Secure, HttpOnly and SameSite on every session cookie and scope the cookie to the narrowest path that works.
T1557 Adversary in the Middle Credential Access Pin the issuing authority and require hybrid key agreement so an interposed relay cannot substitute its own public key.
T1592 Gather Victim Host Information Reconnaissance Suppress server, framework and build version banners at the edge so reconnaissance yields no version specific target list.
Back to engagements Rerun this assessment