HTTP Status
200
Online
Response Time
1699ms
Last check
Uptime
100.0%
2 checks recorded
TLS
B
89 days
Headers
F
Score: 0/100
Critical Findings
1
1 high
Asset Details
| URL | https://vulnbank.org/ |
| Environment | Production |
| Exposure | Internet-facing |
| Importance | High |
| Technology | Docker 4.2.2 |
| Owner | shriram |
| Scan Auth. | ✓ Authorised |
| Last Checked | 22 Aug 2026 23:53:32 |
TLS / SSL Certificate
HTTPS
✓ Enabled
Certificate
✓ Valid
Hostname
✓ Match
HSTS
✕ Missing
HTTP→HTTPS
✕ Missing
Expires in
89 days (20 Nov 2026)
Security Headers — Grade: F
HSTSNot Detected
CSPNot Detected
X-Content-Type-OptionsNot Detected
Referrer-PolicyNot Detected
Permissions-PolicyNot Detected
X-Frame-OptionsNot Detected
Note: A missing header does not necessarily mean the site is vulnerable. Security headers reduce browser-side risk depending on the application's design.
IncidentsAll →
No incidents
Real-Time Security Findings & Vulnerabilities (5)
View all findings →
| Severity | Vulnerability / Finding | Source | Recommended Action |
|---|---|---|---|
| MEDIUM |
Clickjacking Vulnerability (Missing X-Frame-Options)
The response does not specify X-Frame-Options or CSP frame-ancestors, allowing the website to be embedded in an iframe …
|
Security Header Audit | Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN" header. |
| MEDIUM |
HTTP Strict Transport Security (HSTS) Not Enforced
The HSTS header is missing, allowing potential SSL Stripping / Man-In-The-Middle attacks.
|
Security Header Audit | Add "Strict-Transport-Security: max-age=31536000; includeSubDomains" header. |
| INFO |
Server Information Disclosure (cloudflare)
The web server advertises its internal software banner: "cloudflare". Attackers use this to identify target software ve…
|
Header Fingerprinting Engine | Disable HTTP Server banner disclosure in server settings (e.g. ServerTokens ProductOnly in Apache, server_tokens off in Nginx). |
| HIGH |
Missing or Unsafe Content-Security-Policy (CSP)
The website lacks a robust Content-Security-Policy header. This increases susceptibility to Cross-Site Scripting (XSS) …
|
Security Header Audit | Implement a strict CSP header (e.g., Content-Security-Policy: default-src 'self'; script-src 'self';). |
| CRITICAL |
VulnBank: Insecure Direct Object Reference (IDOR) & Transaction Bypass
Target identified as VulnBank financial application containing IDOR flaws in transaction endpoints and unauthenticated …
|
OWASP Benchmark Signature Engine | Implement robust server-side authorization checks on all account and transaction endpoints. |
Observatory Security Evaluation Breakdown
Grade: F (0/100)
| Test | Score | Reason | Recommendation |
|---|---|---|---|
| Content Security Policy (CSP) | -25 Failed | Content Security Policy (CSP) header is missing. | Implement a Content-Security-Policy header defining trusted script-src, style-src, and object-src directives. |
| Cookies | 0 Passed | No session cookies set by initial request. | None |
| Cross-Origin Resource Sharing (CORS) | -15 Warning | Wildcard Access-Control-Allow-Origin header set (*), exposing content cross-origin. | Restrict Access-Control-Allow-Origin to trusted origins. |
| Redirection | 0 Passed | Initial redirection is to HTTPS on the same host. | None |
| Referrer Policy | -5 Warning | Referrer-Policy header is missing or set to unsafe value. | Set Referrer-Policy header to strict-origin-when-cross-origin or no-referrer. |
| Strict Transport Security (HSTS) | -20 Failed | Strict-Transport-Security header missing or invalid. | Set Strict-Transport-Security header with max-age=31536000 and includeSubDomains. |
| Subresource Integrity (SRI) | 0 Info | Subresource Integrity (SRI) not evaluated on static HTML response. | Add integrity attributes to external CDN script and style tags for bonus security. |
| X-Content-Type-Options | -10 Failed | X-Content-Type-Options header is missing. | Set X-Content-Type-Options: nosniff on all HTTP responses. |
| X-Frame-Options | -15 Failed | X-Frame-Options header missing, allowing potential clickjacking. | Set X-Frame-Options: DENY or SAMEORIGIN (or frame-ancestors in CSP). |
| Cross Origin Resource Policy (CORP) | 0 Info | Cross Origin Resource Policy (CORP) not set. | Set Cross-Origin-Resource-Policy: same-origin or same-site. |