New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ZAP Full Scan Report #3

Open

github-actions bot opened this issue Feb 5, 2024 · 1 comment

github-actions bot commented Feb 5, 2024

Site: https://testphp.vulnweb.com
Site: http://testphp.vulnweb.com
New Alerts
- Cross Site Scripting (DOM Based) [40026] total: 17:
  - [http://testphp.vulnweb.com/?name=abc#](http://testphp.vulnweb.com/?name=abc#)
  - [http://testphp.vulnweb.com/artists.php?artist=3?name=abc#](http://testphp.vulnweb.com/artists.php?artist=3?name=abc#)
  - [http://testphp.vulnweb.com/artists.php?name=abc#](http://testphp.vulnweb.com/artists.php?name=abc#)
  - [http://testphp.vulnweb.com/cart.php?name=abc#](http://testphp.vulnweb.com/cart.php?name=abc#)
  - [http://testphp.vulnweb.com/disclaimer.php#jaVasCript:/-//*\/'/"/**/(/* /oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e](http://testphp.vulnweb.com/disclaimer.php#jaVasCript:/*-/*`/*\`/*'/*"/**/(/ */oNcliCk=alert(5397) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(5397)//>\x3e)
  - ..
- Cross Site Scripting (Reflected) [40012] total: 14:
  - http://testphp.vulnweb.com/hpp/?pp=%22%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E
  - http://testphp.vulnweb.com/hpp/params.php?p=%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E&pp=12
  - http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E
  - http://testphp.vulnweb.com/listproducts.php?artist=%3Cimg+src%3Dx+onerror%3Dprompt%28%29%3E
  - http://testphp.vulnweb.com/listproducts.php?cat=%3Cimg+src%3Dx+onerror%3Dprompt%28%29%3E
  - ..
- Cross-Domain Misconfiguration - Adobe - Read [20016] total: 1:
  - http://testphp.vulnweb.com/crossdomain.xml
- SQL Injection [40018] total: 7:
  - http://testphp.vulnweb.com/artists.php?artist=5-2
  - http://testphp.vulnweb.com/listproducts.php?artist=3+AND+1%3D1+--+
  - http://testphp.vulnweb.com/listproducts.php?cat=3+AND+1%3D1+--+
  - http://testphp.vulnweb.com/product.php?pic=9-2
  - http://testphp.vulnweb.com/secured/newuser.php
  - ..
- SQL Injection - MySQL [40019] total: 4:
  - http://testphp.vulnweb.com/artists.php?artist=3
  - http://testphp.vulnweb.com/product.php?pic=7
  - http://testphp.vulnweb.com/secured/newuser.php
  - http://testphp.vulnweb.com/userinfo.php
- Source Code Disclosure - File Inclusion [43] total: 4:
  - http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12
  - http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12
  - http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg
  - http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160
- .htaccess Information Leak [40032] total: 7:
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/.htaccess
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/.htaccess
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/.htaccess
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/.htaccess
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/.htaccess
  - ..
- Absence of Anti-CSRF Tokens [10202] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - http://testphp.vulnweb.com/disclaimer.php
  - ..
- Anti-CSRF Tokens Check [20012] total: 23:
  - http://testphp.vulnweb.com
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/artists.php?artist=3
  - http://testphp.vulnweb.com/cart.php
  - ..
- Backup File Disclosure [10095] total: 14:
  - http://testphp.vulnweb.com/index.bak
  - http://testphp.vulnweb.com/index.zip
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1%20-%20Copy%20(2).html
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1%20-%20Copy%20(3).html
  - http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1%20-%20Copy.html
  - ..
- Content Security Policy (CSP) Header Not Set [10038] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- HTTP Only Site [10106] total: 1:
  - http://testphp.vulnweb.com/cart.php
- Missing Anti-clickjacking Header [10020] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- XSLT Injection [90017] total: 2:
  - http://testphp.vulnweb.com/showimage.php?file=%3Cxsl%3Avalue-of+select%3D%22document%28%27http%3A%2F%2Ftestphp.vulnweb.com%3A22%27%29%22%2F%3E
  - http://testphp.vulnweb.com/showimage.php?file=%3Cxsl%3Avalue-of+select%3D%22document%28%27http%3A%2F%2Ftestphp.vulnweb.com%3A22%27%29%22%2F%3E&size=160
- In Page Banner Information Leak [10009] total: 3:
  - http://testphp.vulnweb.com/high
  - http://testphp.vulnweb.com/robots.txt
  - http://testphp.vulnweb.com/sitemap.xml
- Permissions Policy Header Not Set [10063] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 12:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- X-Content-Type-Options Header Missing [10021] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- Authentication Request Identified [10111] total: 1:
  - http://testphp.vulnweb.com/secured/newuser.php
- Charset Mismatch (Header Versus Meta Content-Type Charset) [90011] total: 12:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- GET for POST [10058] total: 1:
  - http://testphp.vulnweb.com/cart.php
- Information Disclosure - Suspicious Comments [10027] total: 1:
  - http://testphp.vulnweb.com/AJAX/index.php
- Modern Web Application [10109] total: 9:
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/artists.php?artist=1
  - http://testphp.vulnweb.com/artists.php?artist=2
  - http://testphp.vulnweb.com/artists.php?artist=3
  - ..
- Storable and Cacheable Content [10049] total: 11:
  - http://testphp.vulnweb.com/
  - http://testphp.vulnweb.com/AJAX/index.php
  - http://testphp.vulnweb.com/artists.php
  - http://testphp.vulnweb.com/cart.php
  - http://testphp.vulnweb.com/categories.php
  - ..
- User Agent Fuzzer [10104] total: 223:
  - http://testphp.vulnweb.com/AJAX
  - http://testphp.vulnweb.com/AJAX
  - http://testphp.vulnweb.com/AJAX
  - http://testphp.vulnweb.com/AJAX
  - http://testphp.vulnweb.com/AJAX
  - ..
- User Controllable HTML Element Attribute (Potential XSS) [10031] total: 3:
  - http://testphp.vulnweb.com/guestbook.php
  - http://testphp.vulnweb.com/search.php?test=query
  - http://testphp.vulnweb.com/search.php?test=query

View the following link to download the report.
RunnerID:7780607204

The text was updated successfully, but these errors were encountered:

Author

github-actions bot commented Feb 15, 2024

Site: https://testphp.vulnweb.com
Site: http://testphp.vulnweb.com
Resolved Alerts
- SQL Injection - MySQL [40019] total: 4:

View the following link to download the report.
RunnerID:7915429072

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment