https://prep4u.vn/

What Was Observed

The response does not advertise Strict-Transport-Security.

Business Impact

If a victim first reaches the site over an insecure network, an attacker on the same path can attempt SSL stripping, forcing the victim onto HTTP and exposing login sessions or sensitive browsing activity.

Confidence & Evidence

Confidence: confirmed

Developer Notes & Remediation

Review TLS termination and force HTTPS-only delivery at the application or proxy layer before enabling a long-lived HSTS policy.

Recommended action: Enable HSTS with an appropriate max-age after validating HTTPS coverage.

What Was Observed

The application does not return a Content-Security-Policy header on the affected response.

Business Impact

If any XSS or third-party script compromise occurs, the browser has fewer built-in restrictions. In practice this can enable credential theft, fake payment forms, session hijacking, or malicious content injection on customer-facing pages.

Confidence & Evidence

Confidence: confirmed

Developer Notes & Remediation

Start with report-only mode, inventory allowed script/style origins, then move to an enforced policy with nonce/hash-based script control where possible.

Recommended action: Add a restrictive CSP and tune it per application behavior.

What Was Observed

Neither X-Frame-Options nor a CSP frame-ancestors policy was observed on the affected response.

Business Impact

Attackers can potentially embed the site in a malicious page and trick users into clicking hidden buttons or forms. In a real campaign this can lead to unauthorized profile changes, content publishing, or transaction actions.

Confidence & Evidence

Confidence: confirmed

Developer Notes & Remediation

Apply frame restrictions globally, then selectively allow known trusted embeds if the business case requires framing.

Recommended action: Set X-Frame-Options or define frame-ancestors in CSP.

What Was Observed

Browsers may MIME-sniff responses without the nosniff header.

Business Impact

In edge cases, browsers may interpret uploaded or proxied content as executable content rather than inert files. That can widen exploitation paths when combined with upload or content-type confusion flaws.

Confidence & Evidence

Confidence: confirmed

Developer Notes & Remediation

Set the header at the web server or framework middleware level so all static and dynamic responses inherit it consistently.

Recommended action: Return X-Content-Type-Options: nosniff on web responses.

What Was Observed

A common login route responded successfully from the public internet.

Business Impact

A clearly exposed login portal gives attackers a focused entry point for password spraying, credential stuffing, and phishing preparation even before a deeper application flaw is found.

Confidence & Evidence

Confidence: confirmed

Evidence: Confirmed route: https://prep4u.vn/login

Developer Notes & Remediation

Review authentication hardening on the exposed login path, including rate limiting, brute-force controls, MFA coverage, and credential stuffing defenses.

Recommended action: Confirm the login route is intended to be public and protect it with rate limits, MFA, and bot defenses.

What Was Observed

A common registration or invite route responded successfully from the public internet.

Business Impact

Visible registration or invite surfaces can be abused for fake-account creation, reconnaissance, or invite token testing if the underlying controls are weak.

Confidence & Evidence

Confidence: confirmed

Evidence: Confirmed route: https://prep4u.vn/register

Developer Notes & Remediation

Review spam prevention, invite token entropy, tenant isolation, and whether registration flows accidentally expose privileged onboarding paths.

Recommended action: Confirm whether open registration or invite acceptance is intended and monitor it for abuse.

What Was Observed

A common password reset route responded successfully from the public internet.

Business Impact

Public password reset flows are normal, but they give attackers a direct workflow to test for account enumeration, weak reset tokens, or social-engineering-friendly recovery behavior.

Confidence & Evidence

Confidence: confirmed

Evidence: Confirmed route: https://prep4u.vn/password/reset

Developer Notes & Remediation

Review user enumeration behavior, token lifetime, MFA interaction, and email/SMS recovery controls on the exposed reset path.

Recommended action: Verify the reset flow is intentional and enforce strong reset token, enumeration, and rate-limiting controls.

What Was Observed

The landing page does not define a Referrer-Policy header.

Business Impact

Without a Referrer-Policy, downstream sites may receive fuller URL data than intended. In practice this can leak internal paths, campaign parameters, or identifiers that help attackers and third parties profile user behavior.

Confidence & Evidence

Confidence: confirmed

Developer Notes & Remediation

Apply the policy globally at the framework or reverse-proxy layer and verify analytics, SSO, and third-party redirects still behave as expected.

Recommended action: Set a restrictive Referrer-Policy such as strict-origin-when-cross-origin or stricter as appropriate.

What Was Observed

The landing page does not define a Permissions-Policy header.

Business Impact

If third-party code or future features are introduced, unnecessary browser capabilities can remain open by default. That weakens defense-in-depth and can make camera, microphone, or sensor abuse easier to overlook.

Confidence & Evidence

Confidence: confirmed

Developer Notes & Remediation

Inventory the browser capabilities your application genuinely needs, then explicitly deny the rest to reduce future abuse paths and third-party script access.

Recommended action: Return a Permissions-Policy header that disables browser features not required by the application.

What Was Observed

The landing page discloses a Server header.

Business Impact

Server banners help attackers narrow down the likely technology stack and patch level, reducing the time needed to prioritize exploit research or fingerprinting.

Confidence & Evidence

Confidence: confirmed

Evidence: Server: cloudflare

Developer Notes & Remediation

Review reverse-proxy, CDN, and application server defaults to avoid revealing exact stack details unless operationally required.

Recommended action: Minimize or suppress detailed server banners where feasible.

What Was Observed

security.txt was present but did not include a Contact field.

Business Impact

When researchers or customers find a real vulnerability, a missing Contact field can delay responsible disclosure and increase the chance that a fixable issue turns into an incident or public disclosure gap.

Confidence & Evidence

Confidence: confirmed

Evidence: security.txt present without Contact field.

Developer Notes & Remediation

Publish a monitored security contact channel in security.txt, such as a mail alias or disclosure portal, and verify ownership regularly.

Recommended action: Add one or more Contact entries so external reporters know how to reach the security team.

What Was Observed

security.txt was present but its Expires field was missing, invalid, or already expired.

Business Impact

Expired or malformed disclosure metadata creates uncertainty about whether the published security channel is still trustworthy, which can slow inbound reporting when time matters.

Confidence & Evidence

Confidence: confirmed

Evidence: No valid Expires field found in security.txt.

Developer Notes & Remediation

Treat security.txt as maintained metadata: rotate the expiry date on a schedule and verify the published contact details remain active.

Recommended action: Add a valid future Expires value and keep it refreshed.

What Was Observed

robots.txt is accessible.

Business Impact

robots.txt itself is normal, but it can leak a roadmap of sensitive areas to attackers and accelerate reconnaissance toward admin panels, staging pages, or private content paths.

Confidence & Evidence

Confidence: confirmed

Evidence: HTTP 200 | Content-Type: text/plain

Developer Notes & Remediation

Review whether sensitive internal paths are unnecessarily advertised in robots.txt.

Recommended action: Keep robots.txt public if needed, but avoid listing sensitive administrative or private endpoints there.