BanoQabil — Vulnerability Assessment

Author: Daniyal Rashid
Date: September 2025
Repo: External vulnerability assessment for banoqabil.pk.

---

📌 Executive Summary

This vulnerability assessment evaluates the security posture of banoqabil.pk’s web applications.
Findings indicate a moderate risk level with issues in dependency management, TLS, and missing headers.

🔎 High-level findings:

• Outdated JavaScript dependency (ua-parser-js)
• Missing security headers (X-Frame-Options, CSP, etc.)
• Weak TLS cipher suites

The accompanying remediation playbook provides step-by-step fixes.

---

📂 Files

• Banoqabil-Vulnerability-Assessment-Report.pdf — full PDF report

---

🛠️ Scope & Methodology

• Scope: Public-facing assets of banoqabil.pk
• Tools used: Nmap, Nessus, OWASP ZAP, manual validation
• Approach: Automated scanning + manual verification

---

✅ Key Findings

• Vulnerable dependency: ua-parser-js (known CVE)
• Insecure TLS configuration (enabled weak ciphers, no HSTS)
• Missing secure headers (X-XSS-Protection, Content-Security-Policy)

---

🔧 Remediation Highlights

• Update JS dependency to patched version
• Enforce modern TLS protocols (TLS 1.2/1.3 only)
• Add HSTS & CSP headers site-wide

➡️ Full steps: see remediation_playbook.md

---

📜 License

• Report PDF & documentation: CC BY-NC 4.0 — attribution required, non-commercial use only
• Remediation snippets/code (if any): MIT License

---

⚠️ Disclaimer

This repository contains a redacted version of the assessment.
Sensitive information (internal IPs, credentials, raw logs) has been removed for security reasons.