There is a website with no HTTPS certificate on it and i have checked it is transmitting username password in clear text.
I scanned the system and application using IBM Appscan and Nexpose
IBM Appscan (Web Vulnerability Scanner) detects no HTTPS which i can confirm by opening link on browser
Nepose (Vulnerability Scanning tool) detected that self signed certificate is implemented on port 443 it tried to open webpage with port https://url:443 but page redirects to normal http (no certificate) nexpose also detects TLS 1.0 is implemented
Application vendor says that on back end TLS is implemented
How can i verify that TLS is implemented on back end ? Nexpose confimred it but is there any other way