ZAP Full Scan Report - Githubissues

Abhi9699 / demo-site

Creative Commons Zero v1.0 Universal

0 stars 0 forks source link

ZAP Full Scan Report #2

Open github-actions[bot] opened 8 months ago

github-actions[bot] commented 8 months ago

Site: //www.mmebvba.com
Site: http://www.itsecgames.com New Alerts
- Bypassing 403 [40038] total: 4:
- Content Security Policy (CSP) Header Not Set [10038] total: 8:
- HTTP Only Site [10106] total: 1:
  - http://www.itsecgames.com
- Missing Anti-clickjacking Header [10020] total: 5:
- Sub Resource Integrity Attribute Missing [90003] total: 5:
- Permissions Policy Header Not Set [10063] total: 8:
- X-Content-Type-Options Header Missing [10021] total: 11:
- Base64 Disclosure [10094] total: 1:
  - http://www.itsecgames.com/downloads/bWAPP_intro.pdf
- Information Disclosure - Suspicious Comments [10027] total: 1:
  - http://www.itsecgames.com/js/html5.js
- Sec-Fetch-Dest Header is Missing [90005] total: 2:
  - http://www.itsecgames.com/
  - http://www.itsecgames.com/robots.txt
- Sec-Fetch-Mode Header is Missing [90005] total: 2:
  - http://www.itsecgames.com/
  - http://www.itsecgames.com/robots.txt
- Sec-Fetch-Site Header is Missing [90005] total: 2:
  - http://www.itsecgames.com/
  - http://www.itsecgames.com/robots.txt
- Sec-Fetch-User Header is Missing [90005] total: 2:
  - http://www.itsecgames.com/
  - http://www.itsecgames.com/robots.txt
- Storable and Cacheable Content [10049] total: 11:
- User Agent Fuzzer [10104] total: 48:

View the following link to download the report. RunnerID:8534054293

github-actions[bot] commented 8 months ago

Site: https://testphp.vulnweb.com
Site: http://testphp.vulnweb.com New Alerts
- Advanced SQL Injection - AND boolean-based blind - WHERE or HAVING clause [90018] total: 5:
  - http://testphp.vulnweb.com/AJAX/infoartist.php?id=2+AND+1715%3D3581
  - http://testphp.vulnweb.com/AJAX/infocateg.php?id=4+AND+6460%3D6860
  - http://testphp.vulnweb.com/artists.php?artist=3+AND+3245%3D9662
  - http://testphp.vulnweb.com/product.php?pic=7+AND+1583%3D9481
  - http://testphp.vulnweb.com/AJAX/infotitle.php
- Advanced SQL Injection - MySQL >= 5.0 boolean-based blind - Parameter replace [90018] total: 2:
  - http://testphp.vulnweb.com/listproducts.php?artist=%28SELECT+%28CASE+WHEN+%288222%3D9962%29+THEN+8222+ELSE+8222*%28SELECT+8222+FROM+INFORMATION_SCHEMA.CHARACTER_SETS%29+END%29%29
  - http://testphp.vulnweb.com/listproducts.php?cat=%28SELECT+%28CASE+WHEN+%287927%3D7740%29+THEN+7927+ELSE+7927*%28SELECT+7927+FROM+INFORMATION_SCHEMA.CHARACTER_SETS%29+END%29%29
- Advanced SQL Injection - MySQL >= 5.0.12 AND time-based blind (SELECT) [90018] total: 12:
  - http://testphp.vulnweb.com/AJAX/infoartist.php?id=2+AND+%28SELECT+*+FROM+%28SELECT%28SLEEP%285%29%29%29gBFd%29
  - http://testphp.vulnweb.com/AJAX/infocateg.php?id=4+AND+%28SELECT+*+FROM+%28SELECT%28SLEEP%285%29%29%29sfqu%29
  - http://testphp.vulnweb.com/artists.php?artist=3+AND+%28SELECT+*+FROM+%28SELECT%28SLEEP%285%29%29%29dsqA%29
  - http://testphp.vulnweb.com/listproducts.php?artist=3+AND+%28SELECT+*+FROM+%28SELECT%28SLEEP%285%29%29%29mWOz%29
  - http://testphp.vulnweb.com/listproducts.php?cat=3+AND+%28SELECT+*+FROM+%28SELECT%28SLEEP%285%29%29%29SjNK%29
  - ..
- Advanced SQL Injection - MySQL UNION query (NULL) - 1 to 10 columns [90018] total: 5:
  - http://testphp.vulnweb.com/listproducts.php?artist=3+UNION+ALL+SELECT+CONCAT%280x3a6c6a6a3a%2C0x4464796b4c5164474969%2C0x3a6977643a%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23
  - http://testphp.vulnweb.com/listproducts.php?cat=3+UNION+ALL+SELECT+CONCAT%280x3a6c6a6a3a%2C0x485373684f4b506d536f%2C0x3a6977643a%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23
  - http://testphp.vulnweb.com/search.php?test=query%27+UNION+ALL+SELECT+NULL%2CCONCAT%280x3a6c6a6a3a%2C0x68587442524a6b4c6447%2C0x3a6977643a%29%2CNULL%23
  - http://testphp.vulnweb.com/userinfo.php
  - http://testphp.vulnweb.com/userinfo.php
- Cross Site Scripting (DOM Based) [40026] total: 20:
  - [http://testphp.vulnweb.com#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
  - [http://testphp.vulnweb.com/?name=abc#](http://testphp.vulnweb.com/?name=abc#)
  - [http://testphp.vulnweb.com/artists.php#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com/artists.php#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
  - [http://testphp.vulnweb.com/artists.php?artist=3#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com/artists.php?artist=3#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
  - [http://testphp.vulnweb.com/cart.php#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com/cart.php#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
  - ..
- Cross Site Scripting (Reflected) [40012] total: 14:
  - http://testphp.vulnweb.com/hpp/?pp=%22%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E
  - http://testphp.vulnweb.com/hpp/params.php?p=%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E&pp=12
  - http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E
  - http://testphp.vulnweb.com/listproducts.php?artist=%3Cimg+src%3Dx+onerror%3Dprompt%28%29%3E
  - http://testphp.vulnweb.com/listproducts.php?cat=%3Cimg+src%3Dx+onerror%3Dprompt%28%29%3E
  - ..
- Cross-Domain Misconfiguration - Adobe - Read [20016] total: 1:
  - http://testphp.vulnweb.com/crossdomain.xml
- NoSQL Injection - MongoDB [40033] total: 2:
  - http://testphp.vulnweb.com/AJAX/showxml.php
  - http://testphp.vulnweb.com/AJAX/showxml.php
- SQL Injection [40018] total: 7:
  - http://testphp.vulnweb.com/AJAX/infoartist.php?id=4-2
  - http://testphp.vulnweb.com/AJAX/infocateg.php?id=6-2
  - http://testphp.vulnweb.com/artists.php?artist=5-2
  - http://testphp.vulnweb.com/product.php?pic=9-2
  - http://testphp.vulnweb.com/AJAX/infotitle.php
  - ..
- SQL Injection - MySQL [40018] total: 9:
  - http://testphp.vulnweb.com/listproducts.php?artist=%27
  - http://testphp.vulnweb.com/listproducts.php?cat=%27
  - http://testphp.vulnweb.com/secured/newuser.php
  - http://testphp.vulnweb.com/AJAX/infoartist.php?id=2
  - http://testphp.vulnweb.com/artists.php?artist=3
  - ..
- Source Code Disclosure - File Inclusion [43] total: 4:
  - http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12
  - http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12
  - http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg
  - http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160
- .htaccess Information Leak [40032] total: 7:
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/.htaccess
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/.htaccess
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/.htaccess
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/.htaccess
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/.htaccess
  - ..
- Absence of Anti-CSRF Tokens [10202] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - http://testphp.vulnweb.com/disclaimer.php
  - ..
- Anti-CSRF Tokens Check [20012] total: 24:
  - http://testphp.vulnweb.com
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/artists.php?artist=3
  - http://testphp.vulnweb.com/cart.php
  - ..
- Backup File Disclosure [10095] total: 14:
  - http://testphp.vulnweb.com/index.bak
  - http://testphp.vulnweb.com/index.zip
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1%20-%20Copy%20(2).html
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1%20-%20Copy%20(3).html
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1%20-%20Copy.html
  - ..
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- HTTP Only Site [10106] total: 1:
  - http://testphp.vulnweb.com/AJAX/infotitle.php
- Missing Anti-clickjacking Header [10020] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- Source Code Disclosure - PHP [10099] total: 3:
  - http://testphp.vulnweb.com/comment.php?aid=1
  - http://testphp.vulnweb.com/comment.php?aid=2
  - http://testphp.vulnweb.com/comment.php?aid=3
- XSLT Injection [90017] total: 2:
  - http://testphp.vulnweb.com/showimage.php?file=%3Cxsl%3Avalue-of+select%3D%22document%28%27http%3A%2F%2Ftestphp.vulnweb.com%3A22%27%29%22%2F%3E
  - http://testphp.vulnweb.com/showimage.php?file=%3Cxsl%3Avalue-of+select%3D%22document%28%27http%3A%2F%2Ftestphp.vulnweb.com%3A22%27%29%22%2F%3E&size=160
- In Page Banner Information Leak [10009] total: 3:
  - http://testphp.vulnweb.com/high
  - http://testphp.vulnweb.com/robots.txt
  - http://testphp.vulnweb.com/sitemap.xml
- Permissions Policy Header Not Set [10063] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- X-Content-Type-Options Header Missing [10021] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- Authentication Request Identified [10111] total: 2:
  - http://testphp.vulnweb.com/secured/newuser.php
  - http://testphp.vulnweb.com/secured/newuser.php
- Base64 Disclosure [10094] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - http://testphp.vulnweb.com/disclaimer.php
  - ..
- Charset Mismatch (Header Versus Meta Content-Type Charset) [90011] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- Cookie Slack Detector [90027] total: 2:
  - http://testphp.vulnweb.com/AJAX/infocateg.php?id=4
  - http://testphp.vulnweb.com/AJAX/infotitle.php
- GET for POST [10058] total: 3:
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/guestbook.php
  - http://testphp.vulnweb.com/search.php?test=query
- Information Disclosure - Suspicious Comments [10027] total: 1:
  - http://testphp.vulnweb.com/AJAX/index.php
- Modern Web Application [10109] total: 9:
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/artists.php?artist=1
  - http://testphp.vulnweb.com/artists.php?artist=2
  - http://testphp.vulnweb.com/artists.php?artist=3
  - ..
- Sec-Fetch-Dest Header is Missing [90005] total: 2:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/robots.txt
- Sec-Fetch-Mode Header is Missing [90005] total: 2:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/robots.txt
- Sec-Fetch-Site Header is Missing [90005] total: 2:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/robots.txt
- Sec-Fetch-User Header is Missing [90005] total: 2:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/robots.txt
- Storable and Cacheable Content [10049] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- User Agent Fuzzer [10104] total: 225:
  - http://testphp.vulnweb.com/AJAX
  - http://testphp.vulnweb.com/AJAX
  - http://testphp.vulnweb.com/AJAX
  - http://testphp.vulnweb.com/AJAX
  - http://testphp.vulnweb.com/AJAX
  - ..
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 4:
  - http://testphp.vulnweb.com/guestbook.php
  - http://testphp.vulnweb.com/guestbook.php
  - http://testphp.vulnweb.com/search.php?test=query
  - http://testphp.vulnweb.com/search.php?test=query

View the following link to download the report. RunnerID:8534173921

github-actions[bot] commented 8 months ago

Site: https://testphp.vulnweb.com
Site: http://testphp.vulnweb.com Resolved Alerts
- Source Code Disclosure - PHP [10099] total: 3:

View the following link to download the report. RunnerID:8535775142

github-actions[bot] commented 8 months ago

Site: https://testphp.vulnweb.com
Site: http://testphp.vulnweb.com New Alerts
- Source Code Disclosure - PHP [10099] total: 3:

View the following link to download the report. RunnerID:8549793572