Vulnerability Scan Result

Vulnerability description

We noticed that the Content-Security-Policy (CSP) header configured for the web application includes unsafe directives. The CSP header activates a protection mechanism implemented in web browsers which prevents exploitation of Cross-Site Scripting vulnerabilities (XSS) by restricting the sources from which content can be loaded or executed.

Recommendation

Remove the unsafe values from the directives, adopt nonces or hashes for safer inclusion of inline scripts if they are needed, and explicitly define the sources from which scripts, styles, images or other resources can be loaded.

Vulnerability description

We noticed that server software and technology details are exposed, potentially aiding attackers in tailoring specific exploits against identified systems and versions.

Recommendation

We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating system: HTTP server headers, HTML meta information, etc.

Vulnerability description

We found the robots.txt on the target server. This file instructs web crawlers what URLs and endpoints of the web application they can visit and crawl. Website administrators often misuse this file while attempting to hide some web pages from the users.

Recommendation

We recommend you to manually review the entries from robots.txt and remove the ones which lead to sensitive locations in the website (ex. administration panels, configuration files, etc).

Vulnerability description

Website is accessible.

Vulnerability description

We have noticed that the server is missing the security.txt file, which is considered a good practice for web security. It provides a standardized way for security researchers and the public to report security vulnerabilities or concerns by outlining the preferred method of contact and reporting procedures.

Recommendation

We recommend you to implement the security.txt file according to the standard, in order to allow researchers or users report any security issues they find, improving the defensive mechanisms of your server.

Vulnerability description

We found that the Sender Policy Framework (SPF) record for the domain is configured with ~all (soft fail), which indicates that emails from unauthorized IP addresses are not explicitly denied. Instead, the recipient mail server is instructed to treat these messages with suspicion but may still accept them. This configuration may not provide enough protection against email spoofing and unauthorized email delivery, leaving the domain more vulnerable to impersonation attempts.

Recommendation

We recommend changing the SPF record's ~all (soft fail) directive to -all (hard fail). The -all setting tells recipient mail servers to reject emails from any IP addresses not listed in the SPF record, providing stronger protection against email spoofing. Ensure that all legitimate IP addresses and services that send emails on behalf of your domain are properly included in the SPF record before implementing this change.

Vulnerability description

We found that the target uses p=none in the DMARC policy. The DMARC policy set to p=none means that the domain owner is not taking any action on emails that fail DMARC validation. This configuration effectively disables enforcement, allowing potentially spoofed or fraudulent emails to be delivered without any additional scrutiny.

Recommendation

We recommend changing the DMARC policy to p=quarantine or, ideally, p=reject to actively block or quarantine emails that fail DMARC validation. This will enhance the security of your domain against spoofing and phishing attacks by ensuring that only legitimate emails are delivered.

Vulnerability description

We found that the DMARC record for the domain is not configured with sp policy, meaning that no policy is enforced for subdomains. When a DMARC record does not include a subdomain policy (sp directive), subdomains are not explicitly covered by the main domain's DMARC policy. This means that emails sent from subdomains (e.g., sub.example.com) may not be subject to the same DMARC enforcement as the main domain (example.com). As a result, attackers could potentially spoof emails from subdomains without being blocked or flagged, even if the main domain has a strict DMARC policy.

Recommendation

To mitigate the risk, we recommend configuring the DMARC record with a subdomain policy by adding the sp=reject or sp=quarantine directive. This will extend DMARC enforcement to all subdomains, preventing spoofing attempts and maintaining consistent security across both the main domain and its subdomains.

Vulnerability description

We found that the DMARC record for the domain is not configured with ruf tag. A missing ruf (forensic reporting) tag in a DMARC record indicates that the domain owner has not enabled the collection of detailed failure reports. Forensic reports provide valuable insights into specific instances where emails fail DMARC authentication. Without the ruf tag, the domain administrator loses the ability to receive and analyze these reports, making it difficult to investigate individual email failures or identify targeted phishing or spoofing attacks that may be exploiting weaknesses in the email authentication setup.

Recommendation

We recommend configuring the ruf tag in the DMARC record. This tag specifies where forensic reports should be sent, providing the domain owner with detailed data on DMARC validation failures. Forensic reports allow administrators to analyze why certain emails failed authentication, making it easier to fine-tune DMARC policies or address potential vulnerabilities. Ensure that the ruf email address belongs to a secure and trusted location capable of handling sensitive email data.

Recommendation

We recommend reviewing all DNS records associated with the domain and identifying and removing unused or obsolete records.

Vulnerability description

OS detection couldn't determine the operating system.

Recommendation

Vulnerability checks are skipped for ports that redirect to another port. We recommend scanning the redirected port directly.

Recommendation

Vulnerability checks are skipped for ports that redirect to another port. We recommend scanning the redirected port directly.

Vulnerability description

We noticed that server software and technology details are exposed, potentially aiding attackers in tailoring specific exploits against identified systems and versions.

Recommendation

We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating system: HTTP server headers, HTML meta information, etc.