Add some tips for another checks

juffalow / pentest-tool-lite

Test your page against basic security, html, wordpress, ... check lists

https://pentest-tool-lite.com/

MIT License

26 stars 10 forks source link

Open juffalow opened 6 years ago

juffalow commented 6 years ago

If you have some other things you check on your pages, please, share it.

ladislavmoravek commented 6 years ago

remove/change the "server" response header or at least remove the version number
also remove or change X-Generator or X-Powered-By etc. response headers, I'm sure there are tons of other ways to find out the CMS/framework or whatever is behind the generated code, but why not making it a little bit harder? :)
Also make sure to replace/remove the default host html. Point an nonexisting vhost/domain to your web server. It should probably return some 4-- error or a blank page, but not the default "It works!" kind of page.
Check session for jailbreak in case of session being stored on disk or for mysql injection in case of storing session in mysql and so on. Never trust the user :)

Kubik2000 commented 5 years ago

the items that would be great to have in the tool

triggering the test suite not only for one url but also for sitemap.xml
on index page is at least one H1
< meta name="Description" > is set
< title > is set
what will happens for noscript aka disabled all javascript if there is some text for it
site/robots.txt exists
favicon.ico exists
404 exists or redirects to homepage
lighthouse using the Node CLI ?
if possible list test results as they come in instead of waiting until everything has finished executing

Kubik2000 commented 5 years ago

Kubik2000 commented 5 years ago