ZAP Scan Baseline Report

github-actions[bot] commented 9 months ago

Site: https://lightbroker-webapp-dastpoctarget-eastus-001.azurewebsites.net New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 3:
- Strict-Transport-Security Header Not Set [10035] total: 3:
  Ignored Alerts
- Permissions Policy Header Not Set [10063] total: 3:
- Non-Storable Content [10049] total: 3:
- Sec-Fetch-Dest Header is Missing [90005] total: 2:
- Sec-Fetch-Mode Header is Missing [90005] total: 2:
- Sec-Fetch-Site Header is Missing [90005] total: 2:
- Sec-Fetch-User Header is Missing [90005] total: 2:

View the following link to download the report. RunnerID:7188519260

github-actions[bot] commented 9 months ago

Site: http://altoro.testfire.net New Alerts
- Absence of Anti-CSRF Tokens [10202] total: 11:
  - http://altoro.testfire.net
  - http://altoro.testfire.net/feedback.jsp
  - http://altoro.testfire.net/feedback.jsp
  - http://altoro.testfire.net/index.jsp
  - http://altoro.testfire.net/index.jsp?content=business.htm
  - ..
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
  - http://altoro.testfire.net
  - http://altoro.testfire.net/feedback.jsp
  - http://altoro.testfire.net/index.jsp
  - http://altoro.testfire.net/index.jsp?content=business.htm
  - http://altoro.testfire.net/index.jsp?content=inside.htm
  - ..
- Missing Anti-clickjacking Header [10020] total: 11:
  - http://altoro.testfire.net
  - http://altoro.testfire.net/feedback.jsp
  - http://altoro.testfire.net/index.jsp
  - http://altoro.testfire.net/index.jsp?content=business.htm
  - http://altoro.testfire.net/index.jsp?content=inside.htm
  - ..
- Sub Resource Integrity Attribute Missing [90003] total: 1:
  - http://altoro.testfire.net/index.jsp?content=personal_investments.htm
- Cookie without SameSite Attribute [10054] total: 3:
  - http://altoro.testfire.net
  - http://altoro.testfire.net/robots.txt
  - http://altoro.testfire.net/sitemap.xml
- Cross-Domain JavaScript Source File Inclusion [10017] total: 1:
  - http://altoro.testfire.net/index.jsp?content=personal_investments.htm
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 11:
  - http://altoro.testfire.net
  - http://altoro.testfire.net/feedback.jsp
  - http://altoro.testfire.net/index.jsp
  - http://altoro.testfire.net/index.jsp?content=business.htm
  - http://altoro.testfire.net/index.jsp?content=inside.htm
  - ..
- Timestamp Disclosure - Unix [10096] total: 2:
  - http://altoro.testfire.net/swagger/swagger-ui-bundle.js
  - http://altoro.testfire.net/swagger/swagger-ui-standalone-preset.js
- X-Content-Type-Options Header Missing [10021] total: 11:
  - http://altoro.testfire.net
  - http://altoro.testfire.net/feedback.jsp
  - http://altoro.testfire.net/index.jsp
  - http://altoro.testfire.net/index.jsp?content=business.htm
  - http://altoro.testfire.net/index.jsp?content=inside.htm
  - ..
- Information Disclosure - Suspicious Comments [10027] total: 15:
  - http://altoro.testfire.net/index.jsp?content=inside_jobs.htm
  - http://altoro.testfire.net/index.jsp?content=inside_jobs.htm&job=CustomerServiceRepresentative:CustomerService
  - http://altoro.testfire.net/index.jsp?content=inside_jobs.htm&job=ExecutiveAssistant:Administration
  - http://altoro.testfire.net/index.jsp?content=inside_jobs.htm&job=LoyaltyMarketingProgramManager:Marketing
  - http://altoro.testfire.net/index.jsp?content=inside_jobs.htm&job=MortgageLendingAccountExecutive:Sales
  - ..
- Modern Web Application [10109] total: 6:
  - http://altoro.testfire.net/disclaimer.htm?url=http://www.microsoft.com
  - http://altoro.testfire.net/disclaimer.htm?url=http://www.netscape.com
  - http://altoro.testfire.net/index.jsp?content=inside.htm
  - http://altoro.testfire.net/index.jsp?content=inside_volunteering.htm
  - http://altoro.testfire.net/index.jsp?content=personal_other.htm
  - ..
- Session Management Response Identified [10112] total: 4:
  - http://altoro.testfire.net
  - http://altoro.testfire.net
  - http://altoro.testfire.net/robots.txt
  - http://altoro.testfire.net/sitemap.xml
  Ignored Alerts
- Source Code Disclosure - SQL [10099] total: 1:
- Dangerous JS Functions [10110] total: 3:
- Permissions Policy Header Not Set [10063] total: 11:
- Base64 Disclosure [10094] total: 5:
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
- Sec-Fetch-Site Header is Missing [90005] total: 3:
- Sec-Fetch-User Header is Missing [90005] total: 3:
- Storable and Cacheable Content [10049] total: 11:

View the following link to download the report. RunnerID:7427147035

github-actions[bot] commented 9 months ago

Site: http://altoro.testfire.net Resolved Alerts
- Sub Resource Integrity Attribute Missing [90003] total: 1:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 1:
- Timestamp Disclosure - Unix [10096] total: 2:
- Modern Web Application [10109] total: 6:

View the following link to download the report. RunnerID:7427659327

github-actions[bot] commented 8 months ago

Site: https://lightbroker-webapp-dastpoctarget-eastus-001.azurewebsites.net New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 3:
- Strict-Transport-Security Header Not Set [10035] total: 3:
  Ignored Alerts
- Permissions Policy Header Not Set [10063] total: 3:
- Non-Storable Content [10049] total: 3:
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
- Sec-Fetch-Site Header is Missing [90005] total: 3:
- Sec-Fetch-User Header is Missing [90005] total: 3:

View the following link to download the report. RunnerID:7523194169

lightbroker / dast-poc

ZAP Scan Baseline Report #5