DAST Scan

[github-actions[bot]]

• Site: http://altoro.testfire.net New Alerts

  • Cross Site Scripting (DOM Based) [40026] total: 3:
    • [http://altoro.testfire.net#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://altoro.testfire.net#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
    • [http://altoro.testfire.net/login.jsp#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://altoro.testfire.net/login.jsp#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
    • [http://altoro.testfire.net/doLogin#jaVasCript:/-//*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://altoro.testfire.net/doLogin#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
  • Absence of Anti-CSRF Tokens [10202] total: 4:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
    • http://altoro.testfire.net/login.jsp
    • http://altoro.testfire.net/login.jsp
  • Anti-CSRF Tokens Check [20012] total: 3:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/login.jsp
    • http://altoro.testfire.net/login.jsp
  • Content Security Policy (CSP) Header Not Set [10038] total: 3:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
    • http://altoro.testfire.net/login.jsp
  • Missing Anti-clickjacking Header [10020] total: 3:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
    • http://altoro.testfire.net/login.jsp
  • Relative Path Confusion [10051] total: 1:
    • http://altoro.testfire.net/login.jsp
  • Cookie Slack Detector [90027] total: 2:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/doLogin
  • Cookie without SameSite Attribute [10054] total: 2:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 4:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
    • http://altoro.testfire.net/login.jsp
    • http://altoro.testfire.net/doLogin
  • X-Content-Type-Options Header Missing [10021] total: 3:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
    • http://altoro.testfire.net/login.jsp
  • Cookie Slack Detector [90027] total: 1:
    • http://altoro.testfire.net/login.jsp
  • GET for POST [10058] total: 1:
    • http://altoro.testfire.net/doLogin
  • Information Disclosure - Suspicious Comments [10027] total: 2:
    • http://altoro.testfire.net/login.jsp
    • http://altoro.testfire.net/login.jsp
  • Possible Username Enumeration [40023] total: 1:
    • http://altoro.testfire.net/doLogin
  • Session Management Response Identified [10112] total: 3:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
    • http://altoro.testfire.net/doLogin

  • User Agent Fuzzer [10104] total: 17:

    • http://altoro.testfire.net/login.jsp
    • http://altoro.testfire.net/login.jsp
    • http://altoro.testfire.net/login.jsp
    • http://altoro.testfire.net/login.jsp
    • http://altoro.testfire.net/login.jsp
    • ..

    Ignored Alerts

  • Permissions Policy Header Not Set [10063] total: 3:
  • Base64 Disclosure [10094] total: 1:
  • Non-Storable Content [10049] total: 1:
  • Sec-Fetch-Dest Header is Missing [90005] total: 3:
  • Sec-Fetch-Mode Header is Missing [90005] total: 3:
  • Sec-Fetch-Site Header is Missing [90005] total: 3:
  • Sec-Fetch-User Header is Missing [90005] total: 3:
  • Storable and Cacheable Content [10049] total: 3:

View the following link to download the report. RunnerID:7807722066

[github-actions[bot]]

• Site: http://altoro.testfire.net New Alerts
  • Permissions Policy Header Not Set [10063] total: 3:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
    • http://altoro.testfire.net/login.jsp
  • Base64 Disclosure [10094] total: 1:
    • http://altoro.testfire.net/login.jsp
  • Non-Storable Content [10049] total: 1:
    • http://altoro.testfire.net/doLogin
  • Storable and Cacheable Content [10049] total: 3:
    • http://altoro.testfire.net
    • http://altoro.testfire.net/
    • http://altoro.testfire.net/login.jsp

View the following link to download the report. RunnerID:7850348754

[github-actions[bot]]

• Site: http://altoro.testfire.net Resolved Alerts
  • Base64 Disclosure [10094] total: 1:
  • Information Disclosure - Suspicious Comments [10027] total: 2:

View the following link to download the report. RunnerID:8071382584

[github-actions[bot]]

• Site: http://altoro.testfire.net Resolved Alerts
  • GET for POST [10058] total: 1:

View the following link to download the report. RunnerID:8071509083