payments.firstnationalbank.com
Full scan against port 443. Started 2026-08-26 06:14 UTC and finished in 7.4 seconds.
Engagement
- Engagement id
- d2d393de-723e-4d33-95f2-54779a812d23
- Target
- payments.firstnationalbank.com
- Port
- 443
- Scan type
- Full scan
- Started
- 2026-08-26 06:14 UTC
- Completed
- 2026-08-26 06:14 UTC
- Duration
- 7.42 s
- Findings
- 7
- Open ports
- 22, 80, 443
Negotiated session
- Key exchange group
-
X25519Classical - Certificate algorithm
RSA-2048- Protocol version
TLSv1.3- Server name
- payments.firstnationalbank.com
Findings
The handshake on payments.firstnationalbank.com:443 settled on X25519, a purely classical group whose security rests on the elliptic curve discrete logarithm problem. Shor's algorithm recovers the session key from a recorded transcript, so confidentiality has a fixed expiry date rather than an open ended one.
Remediation. Enable the hybrid group X25519MLKEM768 and place it first in the group preference list so capable clients never fall back to X25519.
Traffic protected by X25519 can be captured today and held until quantum capability arrives. Any session material on payments.firstnationalbank.com with a retention requirement past 2030 should be treated as already disclosed to a patient collector.
Remediation. Move the listener to hybrid key establishment and re key any long lived secret that was negotiated under the classical group.
The leaf certificate presented by payments.firstnationalbank.com is signed with RSA-2048. The signature holds against classical factoring today, but the issuing key has no quantum safe successor staged, so a forged chain becomes possible on the same timeline as the key exchange break.
Remediation. Reissue the leaf and the issuing authority under ML-DSA-87, or run a composite chain while relying parties catch up.
A request to /admin on payments.firstnationalbank.com returned a login surface rather than a rejection. The administrative plane is reachable from the public internet with no network level gate in front of it.
Remediation. Move the administrative path behind an allow listed source range or a quantum safe tunnel, and require a second factor.
No Strict-Transport-Security header is returned by payments.firstnationalbank.com. A first visit over cleartext stays available to an interposed relay, which can strip the redirect before the browser ever sees it.
Remediation. Return Strict-Transport-Security with a max age of at least one year and include subdomains once every host is on TLS.
Listeners on payments.firstnationalbank.com return banners naming the product and build on connect. A sweep collects a version inventory without sending a single application request.
Remediation. Blank or generalise the banner on every listener and confirm the change with a follow up sweep.
A sweep of payments.firstnationalbank.com found 22, 80, 443 answering. Each open port is a durable entry in an attacker's map of the estate.
Remediation. Confirm every open port has a named owner and a current justification, then close the remainder.
MITRE ATT&CK techniques exercised
Full coverage view| Technique | Name | Tactic | Mitigation |
|---|---|---|---|
T1040 |
Network Sniffing | Credential Access | Establish sessions with a hybrid group so a recorded transcript cannot be unwound once quantum capability arrives. |
T1046 |
Network Service Discovery | Discovery | Restrict management listeners to an allow listed source range and retire services that carry no current owner. |
T1190 |
Exploit Public Facing Application | Initial Access | Remove unauthenticated administrative paths from the public origin and place a policy aware proxy in front of it. |
T1539 |
Steal Web Session Cookie | Credential Access | Set Secure, HttpOnly and SameSite on every session cookie and scope the cookie to the narrowest path that works. |
T1557 |
Adversary in the Middle | Credential Access | Pin the issuing authority and require hybrid key agreement so an interposed relay cannot substitute its own public key. |