blabla1337 / skf-flask

Security Knowledge Framework (SKF) Python Flask / Angular project
https://www.securityknowledgeframework.org
Apache License 2.0
806 stars 308 forks source link

SKF Training Questionnaire forms contain multiple visual/typo issues #812

Open Quadr0N opened 1 year ago

Quadr0N commented 1 year ago

Missing "Question" word in Questionnaires

Steps: Training > Hacking web & API > Competent > Authentication testing > Test for weak lock-out mechanism > Start Questionnaire

Steps: Training > Hacking web & API > Advanced > Authentication Testing > Test for bypassing authentication schema > Start Questionnaire

Steps: Training > Hacking web & API > EASY > Configuration and Deployment Management Testing > Test HTTP Strict Transport Security > Start Questionnaire

image

Questionnaire - answer is provided in the question already

Steps: Training > Secure Development > Competent > Sending output > Content Security Policy (CSP) image

image

image

Questionnaire form missplitting of Question/Answers

Steps: Training > Hacking web & API > EASY > Session Management Testing > Test for session timeout > Start Questionnaire image

image

image

image

Empty Page in Questionnaires

image

Rest of the empty page in other questionnaires: Steps: Training > Secure Development > EASY > Input Validation > Secure Defaults and Secure Startup > Start Questionnaire Steps: Training > Secure Development > EASY > Input Validation > Consider Availability on All Inputs > Start Questionnaire Steps: Training > Secure Development > Competent > Sending Output > Minimize Feedback/Information Expose > Start Questionnaire Steps: Training > Secure Development > Advanced >Vulnerability Disclosures> Assurance Cases > Start Questionnaire Steps: Training > Secure Development >Advanced >Vulnerability Disclosures> Distributing, Fielding/Deploying, Operations and Disposal > Start Questionnaire Steps: Training > Secure Development > Advanced >Vulnerability Disclosures> Formal Methods & Levels> Start Questionnaire Steps: Training > Hacking web & API > EASY > Information Gathering > Map execution paths application > Start Questionnaire Steps: Training >Hacking web & API > EASY > Information Gathering > Fingerprint application framework > Start Questionnaire Steps: Training > Hacking web & API > EASY > Configuration and Deployment Management Testing > Sensitive files & backups > Start Questionnaire Steps: Training >Hacking web & API > EASY > Configuration and Deployment Management Testing > Admin Interface enumerations > Start Questionnaire Steps: Training > Hacking web & API > EASY > Identify management testing >Test role definitions > Start Questionnaire Steps: Training > Hacking web & API > EASY > Authorization testing > Test for directory traversal / file inclusion> Start Questionnaire Steps: Training > Hacking web & API > EASY > Session Management Testing > Test for cookie attributes > Start Questionnaire Steps: Training > Hacking web & API > EASY > Session Management Testing > Test for session fixation > Start Questionnaire Steps: Training > Hacking web & API > EASY > Session Management Testing > Test for cross site requiest forgery > Start Questionnaire Steps: Training > Hacking web & API > EASY > Session Management Testing > Test for cross site requiest forgery > Start Questionnaire Steps: Training >Hacking web & API > EASY > Session Management Testing > Test for logout functionality > Start Questionnaire Steps: Training > Hacking web & API > EASY > Session Management Testing > Test for session timeout > Start Questionnaire Steps: Training >Hacking web & API > EASY > Input Validation Testing > Test for reflected cross site scripting > Start Questionnaire Steps: Training > Hacking web & API > EASY > Input Validation Testing > Test for stored cross site scripting > Start Questionnaire Steps: Training > Hacking web & API > EASY > Input Validation Testing > Test for SQL Injection > Start Questionnaire Steps: Training > Hacking web & API > EASY > Input Validation Testing > Test for XML Injection > Start Questionnaire Steps: Training > Hacking web & API > EASY > Input Validation Testing > Test for file inclusion > Start Questionnaire Steps: Training > Hacking web & API > EASY > Input Validation Testing > Test for HTTP Incoming requests > Start Questionnaire Steps: Training > Hacking web & API > EASY > Error handling testing >Test for improper error handling > Start Questionnaire Steps: Training > Hacking web & API > EASY > Weak Cryptography Testing > Test for weak transport layer security > Start Questionnaire Steps: Training > Hacking web & API > EASY > Weak Cryptography Testing > Test for sensitive information sent unencrypted > Start Questionnaire Steps: Training > Hacking web & API > EASY > Businnes logic Testing > Test for upload of malicious files > Start Questionnaire Steps: Training > Hacking web & API > EASY > Client-side Testing >Test for HTML injection > Start Questionnaire Steps: Training > Hacking web & API > EASY > Client-side Testing > Test for Client Side URL redirect > Start Questionnaire Steps: Training > Hacking web & API > EASY > Client-side Testing > Test for Clickjacking > Start Questionnaire Steps: Training > Hacking web & API > Competent > Configuration and Deployment Management Testing > Test file permission > Start Questionnaire Steps: Training > Hacking web & API > Competent > Authentication testing > Test for weak security question > Start Questionnaire Steps: Training > Hacking web & API > Competent > Authentication testing > Test for weak password change or reset flow > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for SQL injection approach Oracle > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for SQL injection approach MySQL > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for SQL injection approach SQL Server > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for SQL injection approach SQL PostgreSQL > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for SQL injection approach MS Access > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for SQL injection approach NoSQL > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for SQL injection approach Client-side > Start Questionnaire Steps: Training >Hacking web & API > Competent > Input Validation Testing > Test for SSI injection > Start Questionnaire Steps: Training >Hacking web & API > Competent > Input Validation Testing > Test for IMAP SMTP injection > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for code injection > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for command injection > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for HTTP splitting & smuggling > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for host header injection > Start Questionnaire Steps: Training > Hacking web & API > Competent > Input Validation Testing > Test for server side template injection > Start Questionnaire Steps: Training > Hacking web & API > Competent >Businnes Logic Testing > What are businnes logic vulnerabilities > Start Questionnaire Steps: Training > Hacking web & API > Competent >Businnes Logic Testing > Test businnes logic data validation > Start Questionnaire Steps: Training > Hacking web & API > Competent >Businnes Logic Testing > Test fo file extention types > Start Questionnaire Steps: Training > Hacking web & API > Competent > Client-side Testing > Test for Cross Origin Resource Sharing > Start Questionnaire Steps: Training > Hacking web & API > Competent > Client-side Testing > Test for browser storage > Start Questionnaire Steps: Training > Hacking web & API > Competent > Client-side Testing > Test for Cross site scripting inclusion > Start Questionnaire Steps: Training > Hacking web & API > Competent > Reporting pentesting >Reporting of findings > Start Questionnaire Steps: Training > Hacking web & API > Advanced > Information Gathering > Map application architecture > Start Questionnaire Steps: Training > Hacking web & API > Advanced > Configuration and Deployment Management Testing > Test Cloud Storage> Start Questionnaire Steps: Training > Hacking web & API > Advanced >Authentication >Test for weaker authentication in alternative flows > Start Questionnaire Steps: Training >Hacking web & API > Advanced >Authorization > Test for OATUH weaknesses > Start Questionnaire Steps: Training > Hacking web & API > Advanced >Authorization > Test for OAUTH authorization server weaknesses > Start Questionnaire Steps: Training >Hacking web & API > Advanced >Authorization > Test for OAUTH client weaknesses > Start Questionnaire Steps: Training > Hacking web & API > Advanced >Session Management Testing > Test for session management schema > Start Questionnaire Steps: Training > Hacking web & API > Advanced >Session Management Testing > Test for exposed session variables > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Session Management Testing > Test for session puzzling > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Input Validation Testing > Test for Xpath injection > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Input Validation Testing > Test for SQL injection approach ORM > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Input Validation Testing > Test for LDAP injection> Start Questionnaire Steps: Training > Hacking web & API > Advancced > Input Validation Testing > Test for format string injection > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Input Validation Testing > Test for incubated vulnerability > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Input Validation Testing > Test for mass assignment > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Weak Crpytography Testing > Test for padding Oracle > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Weak Crpytography Testing > Test for weak encryption > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Business logic Testing > Test ability to forge requests > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Business logic Testing > Test for integrity checks > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Business logic Testing > Test for processs timing > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Business logic Testing > Test for function max use limit > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Business logic Testing > Test for circumvent of work flows > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Business logic Testing > Test for defense against app misuse > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Business logic Testing > Test for abuse of payment functionality > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Client-side Testing > Test for DOM based Cross site scripting > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Client-side Testing > Test for Self DOM based Cross site scripting > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Client-side Testing > Test for javascript execution > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Client-side Testing > Test for CSS Injection > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Client-side Testing > Test for client-side resource manipulation > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Client-side Testing > Test for Cross site flashing > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Client-side Testing > Test for Websocket > Start Questionnaire Steps: Training > Hacking web & API > Advancced > Client-side Testing > Test for web messaging > Start Questionnaire Steps: Training > Hacking web & API > Advancced > API Testing > Test for GraphQL API > Start Questionnaire