warshamanage
commented
4 months ago -
Site: http://www.edncp.lk
-
Site: https://www.edncp.lk New Alerts
- Cross Site Scripting (Reflected) [40012] total: 9:
- https://www.edncp.lk/ht/divi.php?id=%27%3Balert%281%29%3B%27&name=Polonnaruwa
- https://www.edncp.lk/ht/school/newsitm.php?id=%3Balert%281%29
- https://www.edncp.lk/ht/school/zdivi.php?id=%3C%2Fscript%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cscript%3E
- https://www.edncp.lk/ht/school/zsch.php?divi=Thamankaduwa&id=%3C%2Fcenter%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Ccenter%3E&zo=Polonnaruwa
- https://www.edncp.lk/ht/ex_zone.php
- ..
- SQL Injection [40018] total: 12:
- https://www.edncp.lk/ht/galenbindunuwewa.php?zone=Galenbindunuwewa%27+AND+%271%27%3D%271
- https://www.edncp.lk/ht/hingurakgoda.php?zone=Hingurakgoda%27+AND+%271%27%3D%271
- https://www.edncp.lk/ht/kebithigollewa.php?zone=Kebithigollewa%27+AND+%271%27%3D%271
- https://www.edncp.lk/ht/kekirawa.php?zone=Kekirawa%27+AND+%271%27%3D%271
- https://www.edncp.lk/ht/polonnaruwa.php?zone=Polonnaruwa%27+AND+%271%27%3D%271
- ..
- SQL Injection - MySQL [40018] total: 4:
- Absence of Anti-CSRF Tokens [10202] total: 11:
- Anti-CSRF Tokens Check [20012] total: 81:
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
- Directory Browsing [0] total: 19:
- Insecure HTTP Method - TRACE [90028] total: 1542:
- Missing Anti-clickjacking Header [10020] total: 11:
- Relative Path Confusion [10051] total: 76:
- Sub Resource Integrity Attribute Missing [90003] total: 11:
- https://www.edncp.lk/ht/divi.php?id=Ipalogama&name=Kekirawa
- https://www.edncp.lk/ht/divi.php?id=Kekirawa&name=Kekirawa
- https://www.edncp.lk/ht/divi.php?id=Mahavilachchiya&name=Anuradhapura
- https://www.edncp.lk/ht/divi.php?id=Nachchaduwa&name=Anuradhapura
- https://www.edncp.lk/ht/divi.php?id=Nochchiyagama&name=Anuradhapura
- ..
- Vulnerable JS Library [10003] total: 1:
- Web Cache Deception [40039] total: 19:
- XSLT Injection [90017] total: 1:
- Big Redirect Detected (Potential Sensitive Information Leak) [10044] total: 9:
- Cookie No HttpOnly Flag [10010] total: 1:
- Cookie Without Secure Flag [10011] total: 1:
- Cookie without SameSite Attribute [10054] total: 1:
- Cross-Domain JavaScript Source File Inclusion [10017] total: 11:
- https://www.edncp.lk/ht/divi.php?id=Ipalogama&name=Kekirawa
- https://www.edncp.lk/ht/divi.php?id=Kekirawa&name=Kekirawa
- https://www.edncp.lk/ht/divi.php?id=Mahavilachchiya&name=Anuradhapura
- https://www.edncp.lk/ht/divi.php?id=Nachchaduwa&name=Anuradhapura
- https://www.edncp.lk/ht/divi.php?id=Nochchiyagama&name=Anuradhapura
- ..
- Dangerous JS Functions [10110] total: 1:
- HTTPS Content Available via HTTP [10047] total: 1125:
- Permissions Policy Header Not Set [10063] total: 12:
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 12:
- Strict-Transport-Security Header Not Set [10035] total: 12:
- Timestamp Disclosure - Unix [10096] total: 5:
- X-Content-Type-Options Header Missing [10021] total: 11:
- Base64 Disclosure [10094] total: 12:
- Cookie Slack Detector [90027] total: 1582:
- GET for POST [10058] total: 7:
- Information Disclosure - Suspicious Comments [10027] total: 11:
- Modern Web Application [10109] total: 11:
- Non-Storable Content [10049] total: 1:
- Re-examine Cache-control Directives [10015] total: 11:
- Sec-Fetch-Dest Header is Missing [90005] total: 4:
- Sec-Fetch-Mode Header is Missing [90005] total: 4:
- Sec-Fetch-Site Header is Missing [90005] total: 4:
- Sec-Fetch-User Header is Missing [90005] total: 4:
- Session Management Response Identified [10112] total: 6:
- Storable and Cacheable Content [10049] total: 10:
- User Agent Fuzzer [10104] total: 1080:
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 12:
- https://www.edncp.lk/ht/anuradhapura.php?zone=anuradhapura
- https://www.edncp.lk/ht/dimbulagala.php?zone=dimbulagala
- https://www.edncp.lk/ht/divi.php?id=Mahavilachchiya&name=Anuradhapura
- https://www.edncp.lk/ht/divi.php?id=Nachchaduwa&name=Anuradhapura
- https://www.edncp.lk/ht/divi.php?id=Nochchiyagama&name=Anuradhapura
- ..
- Cross Site Scripting (Reflected) [40012] total: 9:
View the following link to download the report. RunnerID:9817938665
Site: https://testphp.vulnweb.com
Site: http://testphp.vulnweb.com New Alerts
/*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com/#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)/*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com/artists.php#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)/*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com/artists.php?artist=3#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)/*\/'/"/*/(/ /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com/categories.php#jaVasCript:/-/`/`/'/"/*/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)View the following link to download the report. RunnerID:9817614446
ZAP is supported by the Crash Override Open Source Fellowship