ZAP Full Scan Report - Githubissues

gamertense / zap-scan

0 stars 0 forks source link

ZAP Full Scan Report #2

Open github-actions[bot] opened 1 month ago

github-actions[bot] commented 1 month ago

Site: https://hack-yourself-first.com New Alerts
- Vulnerable JS Library [10003] total: 1:
  - https://hack-yourself-first.com/bundles/jquery?v=yMmPM1TxecYcoWtCWW3jYgH0fr9kiAasOfb-W5I001A1
- Strict-Transport-Security Header Not Set [10035] total: 12:
- Authentication Request Identified [10111] total: 11:
- Information Disclosure - Suspicious Comments [10027] total: 3:
- Re-examine Cache-control Directives [10015] total: 12:
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 18:
Site: http://hack-yourself-first.com New Alerts
- Cross Site Scripting (Reflected) [40012] total: 1:
  - http://hack-yourself-first.com/Search?searchTerm=%27%3Balert%281%29%3B%27
- Path Traversal [6] total: 3:
  - http://hack-yourself-first.com/Make/2?orderby=2
  - http://hack-yourself-first.com/Make/5?orderby=5
  - http://hack-yourself-first.com/Make/7?orderby=7
- SQL Injection - Microsoft SQL Server [40018] total: 1:
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V12
- SQL Injection - MsSQL [40027] total: 1:
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V12
- Source Code Disclosure - File Inclusion [43] total: 3:
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - http://hack-yourself-first.com/Make/5?orderby=supercarid
  - http://hack-yourself-first.com/Make/7?orderby=supercarid
- Absence of Anti-CSRF Tokens [10202] total: 11:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V10
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V6
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V8
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=W16
  - ..
- Anti-CSRF Tokens Check [20012] total: 28:
  - http://hack-yourself-first.com
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/Login?returnUrl=%2FSupercar%2F2
  - http://hack-yourself-first.com/Account/Login?returnUrl=%2FSupercar%2F2
  - ..
- Backup File Disclosure [10095] total: 2:
  - http://hack-yourself-first.com/database.bak
  - http://hack-yourself-first.com/database.zip
- Bypassing 403 [40038] total: 18:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/
  - ..
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V8
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=W16
  - http://hack-yourself-first.com/images/
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - ..
- HTTP to HTTPS Insecure Transition in Form Post [10041] total: 12:
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/Login?returnUrl=%2FSupercar%2F1
  - http://hack-yourself-first.com/Account/Login?returnUrl=%2FSupercar%2F10
  - http://hack-yourself-first.com/Account/Login?returnUrl=%2FSupercar%2F2
  - http://hack-yourself-first.com/Account/Login?returnUrl=%2FSupercar%2F3
  - ..
- Integer Overflow Error [30003] total: 3:
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - http://hack-yourself-first.com/Make/5?orderby=supercarid
  - http://hack-yourself-first.com/Make/7?orderby=supercarid
- Missing Anti-clickjacking Header [10020] total: 11:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V10
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V6
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V8
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=W16
  - ..
- Proxy Disclosure [40025] total: 86:
  - http://hack-yourself-first.com
  - http://hack-yourself-first.com/Account
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/Login?returnUrl=%2FSupercar%2F2
  - http://hack-yourself-first.com/Account/Register
  - ..
- Vulnerable JS Library [10003] total: 1:
  - http://hack-yourself-first.com/bundles/jquery?v=yMmPM1TxecYcoWtCWW3jYgH0fr9kiAasOfb-W5I001A1
- XSLT Injection [90017] total: 6:
  - http://hack-yourself-first.com/Account/Login?returnUrl=%3Cxsl%3Avalue-of+select%3D%22system-property%28%27xsl%3Avendor%27%29%22%2F%3E
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=%3Cxsl%3Avalue-of+select%3D%22system-property%28%27xsl%3Avendor%27%29%22%2F%3E
  - http://hack-yourself-first.com/Make/2?orderby=%3Cxsl%3Avalue-of+select%3D%22system-property%28%27xsl%3Avendor%27%29%22%2F%3E
  - http://hack-yourself-first.com/Make/5?orderby=%3Cxsl%3Avalue-of+select%3D%22system-property%28%27xsl%3Avendor%27%29%22%2F%3E
  - http://hack-yourself-first.com/Make/7?orderby=%3Cxsl%3Avalue-of+select%3D%22system-property%28%27xsl%3Avendor%27%29%22%2F%3E
  - ..
- Cookie No HttpOnly Flag [10010] total: 1:
  - http://hack-yourself-first.com/
- Cookie Slack Detector [90027] total: 72:
  - http://hack-yourself-first.com
  - http://hack-yourself-first.com/Account
  - http://hack-yourself-first.com/Account/Login?returnUrl=%2FSupercar%2F2
  - http://hack-yourself-first.com/Account/Register
  - http://hack-yourself-first.com/Account/ResetPasswordComplete
  - ..
- Cookie without SameSite Attribute [10054] total: 1:
  - http://hack-yourself-first.com/
- Information Disclosure - Debug Error Messages [10023] total: 1:
  - http://hack-yourself-first.com/Supercar/q
- Permissions Policy Header Not Set [10063] total: 11:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V8
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=W16
  - http://hack-yourself-first.com/images/
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - ..
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 12:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V8
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=W16
  - http://hack-yourself-first.com/images/
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - ..
- X-AspNet-Version Response Header [10061] total: 10:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - http://hack-yourself-first.com/Make/5?orderby=supercarid
  - ..
- X-Content-Type-Options Header Missing [10021] total: 11:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V6
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V8
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=W16
  - http://hack-yourself-first.com/favicon.ico
  - ..
- Cookie Slack Detector [90027] total: 12:
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/ResetPassword
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - http://hack-yourself-first.com/Make/5?orderby=supercarid
  - http://hack-yourself-first.com/Make/7?orderby=supercarid
  - ..
- Information Disclosure - Suspicious Comments [10027] total: 3:
  - http://hack-yourself-first.com/bundles/bootstrap?v=NE-C7tK4A7Qr22gKpUJS59z6HQS1tlZdBjgam_8c3I01
  - http://hack-yourself-first.com/bundles/jquery?v=yMmPM1TxecYcoWtCWW3jYgH0fr9kiAasOfb-W5I001A1
  - http://hack-yourself-first.com/bundles/jqueryval?v=kO9SZjRLUEvNZbFlwaT1hsJ0t0ngQHk32HeNdumCbRM1
- Non-Storable Content [10049] total: 9:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/CarsByCylinders?Cylinders=V8
  - http://hack-yourself-first.com/images/
  - http://hack-yourself-first.com/Make/2?orderby=supercarid
  - http://hack-yourself-first.com/Make/5?orderby=supercarid
  - ..
- Retrieved from Cache [10050] total: 12:
  - http://hack-yourself-first.com/favicon.ico
  - http://hack-yourself-first.com/Images/Cars/1/thumb.jpg
  - http://hack-yourself-first.com/Images/Cars/2/thumb.jpg
  - http://hack-yourself-first.com/Images/Cars/3/thumb.jpg
  - http://hack-yourself-first.com/Images/Cars/5/thumb.jpg
  - ..
- Session Management Response Identified [10112] total: 4:
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/
  - http://hack-yourself-first.com/
- Storable and Cacheable Content [10049] total: 2:
  - http://hack-yourself-first.com/robots.txt
  - http://hack-yourself-first.com/sitemap.xml
- User Agent Fuzzer [10104] total: 346:
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/Login
  - http://hack-yourself-first.com/Account/Login
  - ..

View the following link to download the report. RunnerID:10882316980

ZAP is supported by the Crash Override Open Source Fellowship