ZAP Full Scan Report - Githubissues

githubfoam / zap-full-githubactions

zap full githubactions

GNU General Public License v3.0

0 stars 0 forks source link

ZAP Full Scan Report #106

Open github-actions[bot] opened 2 years ago

github-actions[bot] commented 2 years ago

Site: http://public-firing-range.appspot.com
Site: https://public-firing-range.appspot.com New Alerts
- Anti-CSRF Tokens Check [20012] total: 5:
  - https://public-firing-range.appspot.com/angular/angular_body_raw_post/1.6.0
  - https://public-firing-range.appspot.com/angular/angular_form_parse/1.6.0
  - https://public-firing-range.appspot.com/reflected/parameter/form
  - https://public-firing-range.appspot.com/angular/angular_body_raw_post/1.6.0
  - https://public-firing-range.appspot.com/reflected/parameter/form
- Cross Site Scripting (Reflected) [40012] total: 68:
  - https://public-firing-range.appspot.com/reflected/contentsniffing/plaintext?q=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E
  - https://public-firing-range.appspot.com/angular/angular_body_attribute_ng/1.4.0?q=%22+onMouseOver%3D%22alert%281%29%3B
  - https://public-firing-range.appspot.com/angular/angular_body_attribute_non_ng/1.4.0?q=%22+onMouseOver%3D%22alert%281%29%3B
  - https://public-firing-range.appspot.com/angular/angular_body_attribute_non_ng_raw/1.4.0?q=%22+onMouseOver%3D%22alert%281%29%3B
  - https://public-firing-range.appspot.com/escape/serverside/escapeHtml/attribute_quoted?q=%22+onMouseOver%3D%22alert%281%29%3B
  - ..
- External Redirect [20019] total: 3:
  - https://public-firing-range.appspot.com/redirect/parameter/NOSTARTSWITHJS?url=7938801842755685782.owasp.org
  - https://public-firing-range.appspot.com/redirect/parameter?url=7938801842755685782.owasp.org
  - https://public-firing-range.appspot.com/urldom/redirect?url=7938801842755685782.owasp.org
- Open Redirect [10028] total: 1:
  - https://public-firing-range.appspot.com/urldom/redirect?url=http://example.com
- Remote File Inclusion [7] total: 3:
  - https://public-firing-range.appspot.com/redirect/parameter/NOSTARTSWITHJS?url=http%3A%2F%2Fwww.google.com%2F
  - https://public-firing-range.appspot.com/redirect/parameter?url=http%3A%2F%2Fwww.google.com%2F
  - https://public-firing-range.appspot.com/urldom/redirect?url=http%3A%2F%2Fwww.google.com%2F
- Source Code Disclosure - File Inclusion [43] total: 71:
  - https://public-firing-range.appspot.com/escape/serverside/encodeUrl/attribute_name?q=a
  - https://public-firing-range.appspot.com/escape/serverside/encodeUrl/attribute_quoted?q=a
  - https://public-firing-range.appspot.com/escape/serverside/encodeUrl/attribute_singlequoted?q=a
  - https://public-firing-range.appspot.com/escape/serverside/encodeUrl/attribute_unquoted?q=a
  - https://public-firing-range.appspot.com/escape/serverside/encodeUrl/body?q=a
  - ..
- .htaccess Information Leak [40032] total: 6:
  - https://public-firing-range.appspot.com/dom/toxicdom/external/localStorage/array/.htaccess
  - https://public-firing-range.appspot.com/dom/toxicdom/external/localStorage/function/.htaccess
  - https://public-firing-range.appspot.com/dom/toxicdom/external/localStorage/property/.htaccess
  - https://public-firing-range.appspot.com/dom/toxicdom/external/sessionStorage/array/.htaccess
  - https://public-firing-range.appspot.com/dom/toxicdom/external/sessionStorage/function/.htaccess
  - ..
- Bypassing 403 [40038] total: 1:
  - https://public-firing-range.appspot.com/reflected/parameter/body/403%20/
- CSP: Wildcard Directive [10055] total: 6:
  - https://public-firing-range.appspot.com/invalidframingconfig/frameancestorsnonenoxfodeny
  - https://public-firing-range.appspot.com/invalidframingconfig/frameancestorsnoxfoallowfrom
  - https://public-firing-range.appspot.com/invalidframingconfig/frameancestorsselfnoxfosameorigin
  - https://public-firing-range.appspot.com/invalidframingconfig/xfoallowfromnocoverdomain
  - https://public-firing-range.appspot.com/invalidframingconfig/xfodenynoframeancestorsnone
  - ..
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/index.html
  - https://public-firing-range.appspot.com/angular/index.html
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - https://public-firing-range.appspot.com/cors/index.html
  - ..
- Format String Error [30002] total: 1:
  - https://public-firing-range.appspot.com/flashinjection/callbackIsEchoedBack?callback=ZAP%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%25n%25s%0A
- Secure Pages Include Mixed Content (Including Scripts) [10040] total: 7:
  - https://public-firing-range.appspot.com/escape/serverside/encodeUrl/attribute_script?q=a
  - https://public-firing-range.appspot.com/escape/serverside/escapeHtml/attribute_script?q=a
  - https://public-firing-range.appspot.com/mixedcontent/index.html
  - https://public-firing-range.appspot.com/reflected/parameter/attribute_script?q=a
  - https://public-firing-range.appspot.com/remoteinclude/parameter/script?q=http://127.0.0.2/localhost_import.js
  - ..
- Sub Resource Integrity Attribute Missing [90003] total: 8:
  - https://public-firing-range.appspot.com/escape/serverside/encodeUrl/attribute_script?q=a
  - https://public-firing-range.appspot.com/escape/serverside/escapeHtml/attribute_script?q=a
  - https://public-firing-range.appspot.com/reflected/parameter/attribute_script?q=a
  - https://public-firing-range.appspot.com/remoteinclude/parameter/script?q=http://127.0.0.2/localhost_import.js
  - https://public-firing-range.appspot.com/remoteinclude/parameter/script?q=http://192.168.1.2/private_network_import.js
  - ..
- X-Frame-Options Header Not Set [10020] total: 11:
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/index.html
  - https://public-firing-range.appspot.com/angular/index.html
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - https://public-firing-range.appspot.com/cors/index.html
  - ..
- Absence of Anti-CSRF Tokens [10202] total: 4:
  - https://public-firing-range.appspot.com/angular/angular_body_raw_post/1.6.0
  - https://public-firing-range.appspot.com/reflected/parameter/form
  - https://public-firing-range.appspot.com/angular/angular_body_raw_post/1.6.0
  - https://public-firing-range.appspot.com/reflected/parameter/form
- Application Error Disclosure [90022] total: 2:
  - https://public-firing-range.appspot.com/reflected/parameter/body/500?q=a
  - https://public-firing-range.appspot.com/reflected/url/a
- Cookie Without Secure Flag [10011] total: 2:
  - https://public-firing-range.appspot.com/leakedcookie/leakedcookie
  - https://public-firing-range.appspot.com/leakedcookie/leakedinresource
- Cookie without SameSite Attribute [10054] total: 2:
  - https://public-firing-range.appspot.com/leakedcookie/leakedcookie
  - https://public-firing-range.appspot.com/leakedcookie/leakedinresource
- Cross Site Scripting Weakness (Reflected in JSON Response) [40012] total: 1:
  - https://public-firing-range.appspot.com/reflected/contentsniffing/json?q=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E
- Cross-Domain JavaScript Source File Inclusion [10017] total: 12:
  - https://public-firing-range.appspot.com/angular/angular_body/1.1.5?q=test
  - https://public-firing-range.appspot.com/angular/angular_body/1.2.0?q=test
  - https://public-firing-range.appspot.com/angular/angular_body/1.2.18?q=test
  - https://public-firing-range.appspot.com/angular/angular_body/1.2.19?q=test
  - https://public-firing-range.appspot.com/angular/angular_body/1.2.24?q=test
  - ..
- Dangerous JS Functions [10110] total: 12:
  - https://public-firing-range.appspot.com/address/location.hash/eval
  - https://public-firing-range.appspot.com/address/location/eval
  - https://public-firing-range.appspot.com/dom/toxicdom/document/cookie/eval
  - https://public-firing-range.appspot.com/dom/toxicdom/document/cookie_set/eval
  - https://public-firing-range.appspot.com/dom/toxicdom/document/referrer/eval
  - ..
- HTTPS Content Available via HTTP [10047] total: 289:
  - https://public-firing-range.appspot.com
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/baseURI/documentwrite
  - https://public-firing-range.appspot.com/address/documentURI/documentwrite
  - https://public-firing-range.appspot.com/address/index.html
  - ..
- Incomplete or No Cache-control Header Set [10015] total: 11:
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/index.html
  - https://public-firing-range.appspot.com/angular/index.html
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - https://public-firing-range.appspot.com/cors/index.html
  - ..
- Permissions Policy Header Not Set [10063] total: 11:
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/index.html
  - https://public-firing-range.appspot.com/angular/index.html
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - https://public-firing-range.appspot.com/cors/index.html
  - ..
- Private IP Disclosure [2] total: 2:
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - https://public-firing-range.appspot.com/remoteinclude/parameter/script?q=http://192.168.1.2/private_network_import.js
- Strict-Transport-Security Header Not Set [10035] total: 11:
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/index.html
  - https://public-firing-range.appspot.com/angular/index.html
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - https://public-firing-range.appspot.com/cors/index.html
  - ..
- X-Content-Type-Options Header Missing [10021] total: 11:
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/index.html
  - https://public-firing-range.appspot.com/angular/index.html
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - https://public-firing-range.appspot.com/cors/index.html
  - ..
- Cookie Slack Detector [90027] total: 2:
  - https://public-firing-range.appspot.com/leakedcookie/leakedcookie
  - https://public-firing-range.appspot.com/leakedcookie/leakedinresource
- GET for POST [10058] total: 2:
  - https://public-firing-range.appspot.com/angular/angular_body_raw_post/1.6.0
  - https://public-firing-range.appspot.com/reflected/parameter/form
- Information Disclosure - Suspicious Comments [10027] total: 6:
  - https://public-firing-range.appspot.com/reverseclickjacking/multipage/ParameterInFragment/InCallback/WithoutXFO/
  - https://public-firing-range.appspot.com/reverseclickjacking/multipage/ParameterInFragment/InCallback/WithXFO/
  - https://public-firing-range.appspot.com/reverseclickjacking/multipage/ParameterInFragment/OtherParameter/WithoutXFO/
  - https://public-firing-range.appspot.com/reverseclickjacking/multipage/ParameterInFragment/OtherParameter/WithXFO/
  - https://public-firing-range.appspot.com/reverseclickjacking/singlepage/ParameterInFragment/InCallback/
  - ..
- Modern Web Application [10109] total: 12:
  - https://public-firing-range.appspot.com/address/location.hash/assign
  - https://public-firing-range.appspot.com/address/location.hash/documentwrite
  - https://public-firing-range.appspot.com/address/location.hash/documentwriteln
  - https://public-firing-range.appspot.com/address/location.hash/eval
  - https://public-firing-range.appspot.com/angular/angular_body/1.1.5?q=test
  - ..
- Retrieved from Cache [10050] total: 12:
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/index.html
  - https://public-firing-range.appspot.com/angular/index.html
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - ..
- Storable and Cacheable Content [10049] total: 11:
  - https://public-firing-range.appspot.com/
  - https://public-firing-range.appspot.com/address/index.html
  - https://public-firing-range.appspot.com/angular/index.html
  - https://public-firing-range.appspot.com/badscriptimport/index.html
  - https://public-firing-range.appspot.com/cors/index.html
  - ..
- User Agent Fuzzer [10104] total: 28:
  - https://public-firing-range.appspot.com/leakedcookie/leakedcookie
  - https://public-firing-range.appspot.com/leakedcookie/leakedcookie
  - https://public-firing-range.appspot.com/leakedcookie/leakedcookie
  - https://public-firing-range.appspot.com/leakedcookie/leakedcookie
  - https://public-firing-range.appspot.com/leakedcookie/leakedcookie
  - ..
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 9:
  - https://public-firing-range.appspot.com/angular/angular_body_attribute_ng/1.4.0?q=test
  - https://public-firing-range.appspot.com/angular/angular_body_attribute_non_ng_raw/1.4.0?q=test
  - https://public-firing-range.appspot.com/redirect/meta?q=/
  - https://public-firing-range.appspot.com/remoteinclude/parameter/object/application_x-shockwave-flash?q=https://google.com
  - https://public-firing-range.appspot.com/remoteinclude/parameter/object_raw?q=https://google.com
  - ..
- User Controllable JavaScript Event (XSS) [10043] total: 3:
  - https://public-firing-range.appspot.com/reflected/escapedparameter/js_eventhandler_quoted/DOUBLE_QUOTED_ATTRIBUTE?q=a
  - https://public-firing-range.appspot.com/reflected/escapedparameter/js_eventhandler_singlequoted/SINGLE_QUOTED_ATTRIBUTE?q=a
  - https://public-firing-range.appspot.com/reflected/escapedparameter/js_eventhandler_unquoted/UNQUOTED_ATTRIBUTE?q=a

View the following link to download the report. RunnerID:1503427912