ZAP Full Scan Report

[github-actions[bot]]

• Site: http://127.0.0.1:8000 New Alerts
  • Absence of Anti-CSRF Tokens [10202] total: 3:
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/accounts/google/login/?process=login
    • http://127.0.0.1:8000/accounts/password/reset/
  • Bypassing 403 [40038] total: 1:
    • http://127.0.0.1:8000/accounts/google/login/
  • Content Security Policy (CSP) Header Not Set [10038] total: 11:
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/django/core/handlers/base.py,
    • ..
  • Format String Error [30002] total: 1:
    • http://127.0.0.1:8000/accounts/signup/
  • Integer Overflow Error [30003] total: 2:
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/accounts/signup/
  • Source Code Disclosure - Python [10099] total: 1:
    • http://127.0.0.1:8000/accounts/password/reset/
  • Application Error Disclosure [90022] total: 5:
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/robots.txt
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/accounts/google/login/?process=login
    • http://127.0.0.1:8000/accounts/password/reset/
  • Cookie No HttpOnly Flag [10010] total: 9:
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/accounts/google/login/?process=login
    • http://127.0.0.1:8000/accounts/login/
    • http://127.0.0.1:8000/accounts/password/reset/
    • http://127.0.0.1:8000/accounts/signup/
    • ..
  • Permissions Policy Header Not Set [10063] total: 11:
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/django/core/handlers/base.py,
    • http://127.0.0.1:8000/opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/django/core/handlers/exception.py,
    • http://127.0.0.1:8000/register
    • ..
  • Private IP Disclosure [2] total: 5:
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/robots.txt
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/accounts/google/login/?process=login
    • http://127.0.0.1:8000/accounts/password/reset/
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 10:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/broken_access_control
    • http://127.0.0.1:8000/cmd
    • http://127.0.0.1:8000/injection
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 9:
    • http://127.0.0.1:8000/static/css/dark-theme.css
    • http://127.0.0.1:8000/static/css/home.css
    • http://127.0.0.1:8000/static/css/playground.css
    • http://127.0.0.1:8000/static/Lab/icons/pygoat-mini.png
    • http://127.0.0.1:8000/static/Lab/icons/pygoat-mini.svg
    • ..
  • Authentication Request Identified [10111] total: 2:
    • http://127.0.0.1:8000/accounts/login/
    • http://127.0.0.1:8000/login/
  • Cookie Slack Detector [90027] total: 104:
    • http://127.0.0.1:8000/2021
    • http://127.0.0.1:8000/2021/A8
    • http://127.0.0.1:8000/a10
    • http://127.0.0.1:8000/a9
    • http://127.0.0.1:8000/accounts
    • ..
  • GET for POST [10058] total: 1:
    • http://127.0.0.1:8000/register
  • Modern Web Application [10109] total: 7:
    • http://127.0.0.1:8000/cryptographic_failure
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/register
    • http://127.0.0.1:8000/robots.txt
    • http://127.0.0.1:8000/accounts/google/login/
    • ..
  • Non-Storable Content [10049] total: 9:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/broken_access_control
    • http://127.0.0.1:8000/cmd
    • http://127.0.0.1:8000/injection
    • ..
  • Session Management Response Identified [10112] total: 7:
    • http://127.0.0.1:8000/accounts/google/login/
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/login/
    • http://127.0.0.1:8000/register
    • ..
  • Storable and Cacheable Content [10049] total: 2:
    • http://127.0.0.1:8000/login
    • http://127.0.0.1:8000/sitemap.xml
  • User Agent Fuzzer [10104] total: 780:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • ..
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 9:
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/accounts/signup/
    • http://127.0.0.1:8000/accounts/signup/
    • ..

View the following link to download the report. RunnerID:11988851422

---

ZAP by Checkmarx

[github-actions[bot]]

• Site: http://127.0.0.1:8000 Resolved Alerts
  • Format String Error [30002] total: 1:

View the following link to download the report. RunnerID:12029412389

[github-actions[bot]]

• Site: http://127.0.0.1:8000 Resolved Alerts
  • Integer Overflow Error [30003] total: 4:
  • Source Code Disclosure - Python [10099] total: 1:

View the following link to download the report. RunnerID:12030981645

[github-actions[bot]]

• Site: http://127.0.0.1:8000 New Alerts
  • Source Code Disclosure - SQL [10099] total: 2:
    • http://127.0.0.1:8000/injection
    • http://127.0.0.1:8000/sql
  • Information Disclosure - Debug Error Messages [10023] total: 1:
    • http://127.0.0.1:8000/debug

View the following link to download the report. RunnerID:12031709560