ZAP Full Scan Report

[github-actions[bot]]

• Site: http://localhost:50080 New Alerts
  • Weak Authentication Method [10105] total: 3:
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • Cookie Slack Detector [90027] total: 4:
    • http://localhost:50080
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • Cookie without SameSite Attribute [10054] total: 3:
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • Loosely Scoped Cookie [90033] total: 4:
    • http://localhost:50080/
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • Non-Storable Content [10049] total: 3:
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • Session Management Response Identified [10112] total: 4:
    • http://localhost:50080/
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • User Agent Fuzzer [10104] total: 48:
    • http://localhost:50080
    • http://localhost:50080
    • http://localhost:50080
    • http://localhost:50080
    • http://localhost:50080
    • ..

View the following link to download the report. RunnerID:9563034690

---

ZAP is supported by the Crash Override Open Source Fellowship

[github-actions[bot]]

• Site: http://localhost:50080 New Alerts
  • Cross Site Scripting (DOM Based) [40026] total: 3:
    • [http://localhost:50080/greeting#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://localhost:50080/greeting#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
    • [http://localhost:50080/greeting?username=stw?name=abc#](http://localhost:50080/greeting?username=stw?name=abc#)
    • [http://localhost:50080/greeting#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://localhost:50080/greeting#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
  • Cross Site Scripting (Reflected) [40012] total: 1:
    • http://localhost:50080/greeting?username=%3C%2Fp%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cp%3E
  • Bypassing 403 [40038] total: 2:
    • http://localhost:50080/greeting
    • http://localhost:50080/logout
  • Content Security Policy (CSP) Header Not Set [10038] total: 7:
    • http://localhost:50080
    • http://localhost:50080/
    • http://localhost:50080/greeting
    • http://localhost:50080/greeting?username=stw
    • http://localhost:50080/login
    • ..
  • Sub Resource Integrity Attribute Missing [90003] total: 2:
    • http://localhost:50080/login
    • http://localhost:50080/logout
  • Vulnerable JS Library [10003] total: 1:
    • http://localhost:50080/webjars/jquery/3.3.1-1/jquery.min.js
  • Dangerous JS Functions [10110] total: 1:
    • http://localhost:50080/webjars/jquery/3.3.1-1/jquery.min.js
  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 1:
    • http://localhost:50080/logout
  • Permissions Policy Header Not Set [10063] total: 10:
    • http://localhost:50080
    • http://localhost:50080/
    • http://localhost:50080/greeting
    • http://localhost:50080/greeting?username=stw
    • http://localhost:50080/login
    • ..
  • Authentication Request Identified [10111] total: 2:
    • http://localhost:50080/login
    • http://localhost:50080/login
  • Base64 Disclosure [10094] total: 2:
    • http://localhost:50080/login
    • http://localhost:50080/logout
  • GET for POST [10058] total: 1:
    • http://localhost:50080/greeting
  • Information Disclosure - Sensitive Information in URL [10024] total: 1:
    • http://localhost:50080/greeting?username=stw
  • Information Disclosure - Suspicious Comments [10027] total: 3:
    • http://localhost:50080/webjars/bootstrap/5.0.0/js/bootstrap.bundle.min.js
    • http://localhost:50080/webjars/bootstrap/5.0.0/js/bootstrap.min.js
    • http://localhost:50080/webjars/jquery/3.3.1-1/jquery.min.js
  • Sec-Fetch-Dest Header is Missing [90005] total: 3:
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • Sec-Fetch-Mode Header is Missing [90005] total: 3:
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • Sec-Fetch-Site Header is Missing [90005] total: 3:
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • Sec-Fetch-User Header is Missing [90005] total: 3:
    • http://localhost:50080/
    • http://localhost:50080/robots.txt
    • http://localhost:50080/sitemap.xml
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 1:
    • http://localhost:50080/greeting

View the following link to download the report. RunnerID:9579715169