admin.firstnationalbank.com

Web scan against port 443. Started 2026-08-26 04:56 UTC and finished in 3.2 seconds.

0
critical
1
high
2
medium
2
low
0
info

Engagement

Engagement id
dac35b55-4e0c-47ab-80dd-ad97e8da0272
Target
admin.firstnationalbank.com
Port
443
Scan type
Web scan
Started
2026-08-26 04:56 UTC
Completed
2026-08-26 04:56 UTC
Duration
3.18 s
Findings
5

Findings

HIGH Administrative path /admin answers without authentication 6e945217

A request to /admin on admin.firstnationalbank.com returned a login surface rather than a rejection. The administrative plane is reachable from the public internet with no network level gate in front of it.

Remediation. Move the administrative path behind an allow listed source range or a quantum safe tunnel, and require a second factor.

Categoryweb
NIST 800-53AC-3, AC-17, SC-7
CMMCAC.L2-3.1.12, AC.L2-3.1.14
ATT&CKT1190, T1539
MEDIUM Strict Transport Security header absent 98368d31

No Strict-Transport-Security header is returned by admin.firstnationalbank.com. A first visit over cleartext stays available to an interposed relay, which can strip the redirect before the browser ever sees it.

Remediation. Return Strict-Transport-Security with a max age of at least one year and include subdomains once every host is on TLS.

Categoryweb
NIST 800-53SC-8, SC-23
CMMCSC.L2-3.13.8
CNSA 2.0CNSA 2.0 Protocol Baseline
ATT&CKT1557
MEDIUM Content Security Policy header absent df3e3504

admin.firstnationalbank.com returns no Content-Security-Policy header, so the browser applies no origin restriction to script, frame or connect sources. Any injected node executes with full page authority.

Remediation. Publish a Content-Security-Policy in report only mode, review the collected violations, then enforce it.

Categoryweb
NIST 800-53SI-10, SC-18
CMMCSI.L2-3.14.6
ATT&CKT1190
LOW X-Frame-Options header absent b747d220

admin.firstnationalbank.com does not set X-Frame-Options or an equivalent frame ancestors directive, so the page can be embedded by a third party origin and used to capture interface actions.

Remediation. Set X-Frame-Options to DENY, or express the same rule through the frame ancestors directive of the content policy.

Categoryweb
NIST 800-53SC-18
CMMCSI.L2-3.14.6
ATT&CKT1190
LOW Server header discloses build version 8ff986db

The Server header returned by admin.firstnationalbank.com names the product and its build. That is enough to select a version specific exploit before a single request is sent against the application itself.

Remediation. Suppress the version token at the edge proxy and return a generic product name or no header at all.

Categoryweb
NIST 800-53SI-11, CM-6
CMMCSI.L2-3.14.6
ATT&CKT1592

MITRE ATT&CK techniques exercised

Full coverage view
TechniqueNameTacticMitigation
T1190 Exploit Public Facing Application Initial Access Remove unauthenticated administrative paths from the public origin and place a policy aware proxy in front of it.
T1539 Steal Web Session Cookie Credential Access Set Secure, HttpOnly and SameSite on every session cookie and scope the cookie to the narrowest path that works.
T1557 Adversary in the Middle Credential Access Pin the issuing authority and require hybrid key agreement so an interposed relay cannot substitute its own public key.
T1592 Gather Victim Host Information Reconnaissance Suppress server, framework and build version banners at the edge so reconnaissance yields no version specific target list.
Back to engagements Rerun this assessment