ZAP Full Scan Report

[github-actions[bot]]

• Site: http://demo.testfire.net New Alerts
  • Cross Site Scripting (Reflected) [40012] total: 2:
    • http://demo.testfire.net/search.jsp?query=%3C%2Fp%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cp%3E
    • http://demo.testfire.net/sendFeedback
  • Absence of Anti-CSRF Tokens [10202] total: 11:
    • http://demo.testfire.net/
    • http://demo.testfire.net/feedback.jsp
    • http://demo.testfire.net/feedback.jsp
    • http://demo.testfire.net/index.jsp
    • http://demo.testfire.net/index.jsp?content=business.htm
    • ..
  • Anti-CSRF Tokens Check [20012] total: 43:
    • http://demo.testfire.net
    • http://demo.testfire.net/
    • http://demo.testfire.net/cgi.exe
    • http://demo.testfire.net/default.jsp
    • http://demo.testfire.net/default.jsp?content=security.htm
    • ..
  • Content Security Policy (CSP) Header Not Set [10038] total: 11:
    • http://demo.testfire.net/
    • http://demo.testfire.net/feedback.jsp
    • http://demo.testfire.net/index.jsp
    • http://demo.testfire.net/index.jsp?content=business.htm
    • http://demo.testfire.net/index.jsp?content=inside.htm
    • ..
  • Insecure HTTP Method - PUT [90028] total: 63:
    • http://demo.testfire.net/admin/clients.xls/rrnnjpz5ri
    • http://demo.testfire.net/admin/fchp1zhorr
    • http://demo.testfire.net/cgi.exe/kltrymww26
    • http://demo.testfire.net/disclaimer.htm?url=http://www.microsoft.com/36qyfh8r4r
    • http://demo.testfire.net/Documents/2wqal4m02u
    • ..
  • Missing Anti-clickjacking Header [10020] total: 11:
    • http://demo.testfire.net/
    • http://demo.testfire.net/feedback.jsp
    • http://demo.testfire.net/index.jsp
    • http://demo.testfire.net/index.jsp?content=business.htm
    • http://demo.testfire.net/index.jsp?content=inside.htm
    • ..
  • Relative Path Confusion [10051] total: 73:
    • http://demo.testfire.net/admin/clients.xls
    • http://demo.testfire.net/cgi.exe
    • http://demo.testfire.net/default.jsp
    • http://demo.testfire.net/default.jsp?content=security.htm
    • http://demo.testfire.net/disclaimer.htm?url=http://www.microsoft.com
    • ..
  • Cookie Slack Detector [90027] total: 85:
    • http://demo.testfire.net
    • http://demo.testfire.net/
    • http://demo.testfire.net/admin
    • http://demo.testfire.net/admin/clients.xls
    • http://demo.testfire.net/cgi.exe
    • ..
  • Cookie without SameSite Attribute [10054] total: 2:
    • http://demo.testfire.net/
    • http://demo.testfire.net/robots.txt
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 1:
    • http://demo.testfire.net/index.jsp?content=personal_investments.htm
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 11:
    • http://demo.testfire.net/
    • http://demo.testfire.net/feedback.jsp
    • http://demo.testfire.net/index.jsp
    • http://demo.testfire.net/index.jsp?content=business.htm
    • http://demo.testfire.net/index.jsp?content=inside.htm
    • ..
  • Timestamp Disclosure - Unix [10096] total: 12:
    • http://demo.testfire.net/images/b_main.jpg
    • http://demo.testfire.net/images/home1.jpg
    • http://demo.testfire.net/images/home2.jpg
    • http://demo.testfire.net/images/inside6.jpg
    • http://demo.testfire.net/index.jsp?content=inside_press.htm
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 11:
    • http://demo.testfire.net/
    • http://demo.testfire.net/feedback.jsp
    • http://demo.testfire.net/index.jsp
    • http://demo.testfire.net/index.jsp?content=business.htm
    • http://demo.testfire.net/index.jsp?content=inside.htm
    • ..
  • Cookie Slack Detector [90027] total: 2:
    • http://demo.testfire.net/login.jsp
    • http://demo.testfire.net/survey_questions.jsp?step=d
  • Information Disclosure - Suspicious Comments [10027] total: 12:
    • http://demo.testfire.net/index.jsp?content=inside_jobs.htm
    • http://demo.testfire.net/index.jsp?content=inside_jobs.htm&job=CustomerServiceRepresentative:CustomerService
    • http://demo.testfire.net/index.jsp?content=inside_jobs.htm&job=ExecutiveAssistant:Administration
    • http://demo.testfire.net/index.jsp?content=inside_jobs.htm&job=Teller:ConsumaerBanking
    • http://demo.testfire.net/login.jsp
    • ..
  • Modern Web Application [10109] total: 7:
    • http://demo.testfire.net/disclaimer.htm?url=http://www.microsoft.com
    • http://demo.testfire.net/disclaimer.htm?url=http://www.netscape.com
    • http://demo.testfire.net/index.jsp?content=inside.htm
    • http://demo.testfire.net/index.jsp?content=inside_volunteering.htm
    • http://demo.testfire.net/index.jsp?content=personal_other.htm
    • ..
  • User Agent Fuzzer [10104] total: 56:
    • http://demo.testfire.net/admin
    • http://demo.testfire.net/admin
    • http://demo.testfire.net/admin
    • http://demo.testfire.net/admin
    • http://demo.testfire.net/admin
    • ..

View the following link to download the report. RunnerID:1991404855

[github-actions[bot]]

• Site: http://demo.testfire.net New Alerts
  • SQL Injection - SQLite [40024] total: 1:
    • http://demo.testfire.net/sendFeedback

View the following link to download the report. RunnerID:2168143155

[github-actions[bot]]

• Site: http://demo.testfire.net Resolved Alerts
  • SQL Injection - SQLite [40024] total: 1:

View the following link to download the report. RunnerID:2174412970

[github-actions[bot]]

• Site: http://demo.testfire.net New Alerts
  • SQL Injection - SQLite [40024] total: 1:
    • http://demo.testfire.net/index.jsp?content=inside_jobs.htm&job=MortgageLendingAccountExecutive:Sales

View the following link to download the report. RunnerID:2176425953

[github-actions[bot]]

• Site: http://demo.testfire.net Resolved Alerts
  • SQL Injection - SQLite [40024] total: 1:

View the following link to download the report. RunnerID:2176427497

[github-actions[bot]]

• Site: http://demo.testfire.net New Alerts
  • SQL Injection - SQLite [40024] total: 1:
    • http://demo.testfire.net/Documents/JohnSmith/index.jsp?content=personal.htm

View the following link to download the report. RunnerID:2176446606

[github-actions[bot]]

• Site: http://demo.testfire.net Resolved Alerts
  • SQL Injection - SQLite [40024] total: 1:

View the following link to download the report. RunnerID:2176481692

[github-actions[bot]]

• Site: http://demo.testfire.net New Alerts
  • SQL Injection - SQLite [40024] total: 1:
    • http://demo.testfire.net/sendFeedback

View the following link to download the report. RunnerID:2177793655

[github-actions[bot]]

• Site: http://demo.testfire.net Resolved Alerts
  • SQL Injection - SQLite [40024] total: 1:

View the following link to download the report. RunnerID:2225663746