Ensure that the web browser's XSS filter is enabled, by setting the X-XSS-Protection HTTP response header to '1'.
\nThe X-XSS-Protection HTTP response header allows the web server to enable or disable the web browser's XSS protection mechanism. The following values would attempt to enable it:
X-XSS-Protection: 1; mode=block
X-XSS-Protection: 1; report=http://www.example.com/xss
The following values would disable it:
X-XSS-Protection: 0
The X-XSS-Protection HTTP response header is currently supported on Internet Explorer, Chrome and Safari (WebKit).
Note that this alert is only raised if the response body could potentially contain an XSS payload (with a text-based content type, with a non-zero length).
\nThe X-XSS-Protection HTTP response header allows the web server to enable or disable the web browser's XSS protection mechanism. The following values would attempt to enable it:
X-XSS-Protection: 1; mode=block
X-XSS-Protection: 1; report=http://www.example.com/xss
The following values would disable it:
X-XSS-Protection: 0
The X-XSS-Protection HTTP response header is currently supported on Internet Explorer, Chrome and Safari (WebKit).
Note that this alert is only raised if the response body could potentially contain an XSS payload (with a text-based content type, with a non-zero length).
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/font/\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/controller/\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-new-payee.html\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html?topic=/help/topic3.html\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/ext/\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-summary.html\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/themes/\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/index.html\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements-for-account.html\nMethod: POST\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=1\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/online-banking.html\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/view/\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/transfer-funds-verify.html\nMethod: POST\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=2\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=3\nMethod: GET\nParam: X-XSS-Protection\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"90027.1","title":"Cookie Slack Detector","desc":"Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.","impact":0.3,"tags":{"nist":["SC-8","Rev_4"],"cweid":"200","wascid":"45","sourceid":"1","confidence":"1","riskdesc":"Informational (Low)","check":"\nDropping this cookie appears to have invalidated the session: [JSESSIONID] A follow-on request with all original cookies still had a different response than the original request.
\nDropping this cookie appears to have invalidated the session: [JSESSIONID] A follow-on request with all original cookies still had a different response than the original request.
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=4\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/sitemap.xml\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/login.html?login_error=true\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity-find-transactions.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-new-payee.html\nMethod: POST\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity-show-transactions.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html?topic=/help/topic2.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/sendFeedback.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/auth\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/forgotten-password-send.html\nMethod: POST\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/logout.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: POST\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-purchase-currency.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/forgot-password.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-summary.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/transfer-funds-verify.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"90027.2","title":"Cookie Slack Detector","desc":"Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.","impact":0.3,"tags":{"nist":["SC-8","Rev_4"],"cweid":"200","wascid":"45","sourceid":"1","confidence":"1","riskdesc":"Low (Low)","check":"\nNOTE: Because of its name this cookie may be important, but dropping it appears to have no effect: [JSESSIONID]
Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.
These cookies affected the response:
These cookies did NOT affect the response: JSESSIONID
\nNOTE: Because of its name this cookie may be important, but dropping it appears to have no effect: [JSESSIONID]
Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.
These cookies affected the response:
These cookies did NOT affect the response: JSESSIONID
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-get-payee-details.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-conversion-rate-for-currency.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/index.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/transfer-funds-verify.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/auth/security-check.html?user_token=8c797e39-7ab3-41d2-a53a-2a6449f13866\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/auth/accept-certs.html?user_token=8c797e39-7ab3-41d2-a53a-2a6449f13866\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/money-map-get-spendings-by-type.html?_dc=1544043856896\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/redirect.html?url=account-summary.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/auth\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements-for-account.html\nMethod: GET\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"40025.1","title":"Proxy Disclosure","desc":"1 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine - A list of targets for an attack against the application. - Potential vulnerabilities on the proxy servers that service the application. - The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated. ","impact":0.7,"tags":{"nist":["SC-8","Rev_4"],"cweid":"200","wascid":"45","sourceid":"1","confidence":"2","riskdesc":"High (Medium)","check":"Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server.
Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing).
Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages.
Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers.
\nUsing the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between OWASP ZAP and the application/web server:
- Apache/2.2.6 (Win32) mod_ssl/2.2.6 OpenSSL/0.9.8e mod_jk/1.2.40
The following web/application server has been identified:
- Unknown
The 'TRACE' method is enabled on one or more of the proxy servers, or on the origin server. This method leaks all information submitted from the web browser and proxies back to the user agent. This may facilitate 'Cross Site Tracing' attacks.
\nUsing the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between OWASP ZAP and the application/web server:
- Apache/2.2.6 (Win32) mod_ssl/2.2.6 OpenSSL/0.9.8e mod_jk/1.2.40
The following web/application server has been identified:
- Unknown
The 'TRACE' method is enabled on one or more of the proxy servers, or on the origin server. This method leaks all information submitted from the web browser and proxies back to the user agent. This may facilitate 'Cross Site Tracing' attacks.
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/index.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity-show-transactions.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements-for-account.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/transfer-funds-verify.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-purchase-currency.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/redirect.html?url=account-summary.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/auth/security-check.html?user_token=230c3296-ed16-4c56-b15a-21dec9a0b296\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/favicon.ico\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html?topic=/help/topic2.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-get-payee-details.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/money-map.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/money-map-get-spendings-by-type.html?_dc=1544043856896\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: GET\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"10021","title":"X-Content-Type-Options Header Missing","desc":"The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.","impact":0.3,"tags":{"nist":["unmapped"],"cweid":"16","wascid":"15","sourceid":"3","confidence":"2","riskdesc":"Low (Medium)","check":"Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.
If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
\nThis issue still applies to error type pages (401, 403, 500, etc) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.
At \"High\" threshold this scanner will not alert on client or server error responses.
\nThis issue still applies to error type pages (401, 403, 500, etc) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.
At \"High\" threshold this scanner will not alert on client or server error responses.
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-get-payee-details.html\nMethod: POST\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-conversion-rate-for-currency.html\nMethod: POST\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/js/jquery-1.6.4.min.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/view/DetailedReport.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/transfer-funds.html\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/feedback.html\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/index.html\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/js/jquery-1.7.2.min.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/themes/images/gray/tools/tool-sprites.gif\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/store/ReportOutFlow.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-new-payee.html\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/view/Report.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/css/ext-all-gray.css\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/online-banking.html\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/model/DetailedReport.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/view/SummaryReport.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/model/Report.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/extjs/app/view/Viewport.js\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/resources/css/jquery-ui-1.8.16.custom.css\nMethod: GET\nParam: X-Content-Type-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"40024","title":"SQL Injection - SQLite","desc":"SQL injection may be possible","impact":0.7,"tags":{"nist":["SI-10","Rev_4"],"cweid":"89","wascid":"19","sourceid":"1","confidence":"2","riskdesc":"High (Medium)","check":"Do not trust client side input, even if there is client side validation in place.
In general, type check all data on the server side.
If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'
If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.
If database Stored Procedures can be used, use them.
Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!
Do not create dynamic SQL queries using simple string concatenation.
Escape all data received from the client.
Apply a 'whitelist' of allowed characters, or a 'blacklist' of disallowed characters in user input.
Apply the privilege of least privilege by using the least privileged database user possible.
In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.
Grant the minimum database access that is necessary for the application.
\nThe query time is controllable using parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [449] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [449] milliseconds, when the original unmodified query with value [query] took [13] milliseconds.
\nThe query time is controllable using parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [449] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [449] milliseconds, when the original unmodified query with value [query] took [13] milliseconds.
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/forgotten-password-send.html\nMethod: GET\nParam: query\nAttack: case randomblob(10000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [449] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [449] milliseconds, when the original unmodified query with value [query] took [13] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/money-map-get-spendings-by-type.html?_dc=1544043856896\nMethod: POST\nParam: _dc\nAttack: 1544043856896 * case randomblob(10000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [1544043856896 * case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [509] milliseconds, parameter value [1544043856896 * case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [509] milliseconds, when the original unmodified query with value [1544043856896] took [10] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills.html\nMethod: GET\nParam: query\nAttack: case randomblob(10000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [469] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [469] milliseconds, when the original unmodified query with value [query] took [21] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/money-map.html\nMethod: GET\nParam: query\nAttack: \" | case randomblob(100000000) when not null then \"\" else \"\" end | \"\nEvidence: The query time is controllable using parameter value [\" | case randomblob(100000000) when not null then \"\" else \"\" end | \"], which caused the request to take [517] milliseconds, parameter value [\" | case randomblob(100000000) when not null then \"\" else \"\" end | \"], which caused the request to take [517] milliseconds, when the original unmodified query with value [query] took [21] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: POST\nParam: user_password\nAttack: case randomblob(100000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(100000) when not null then 1 else 1 end ], which caused the request to take [453] milliseconds, parameter value [case randomblob(100000) when not null then 1 else 1 end ], which caused the request to take [453] milliseconds, when the original unmodified query with value [password] took [19] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank\nMethod: GET\nParam: query\nAttack: \" | case randomblob(1000000) when not null then \"\" else \"\" end | \"\nEvidence: The query time is controllable using parameter value [\" | case randomblob(1000000) when not null then \"\" else \"\" end | \"], which caused the request to take [586] milliseconds, parameter value [\" | case randomblob(1000000) when not null then \"\" else \"\" end | \"], which caused the request to take [586] milliseconds, when the original unmodified query with value [query] took [490] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-purchase-currency.html\nMethod: GET\nParam: query\nAttack: case randomblob(100000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(100000000) when not null then 1 else 1 end ], which caused the request to take [474] milliseconds, parameter value [case randomblob(100000000) when not null then 1 else 1 end ], which caused the request to take [474] milliseconds, when the original unmodified query with value [query] took [11] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: POST\nParam: user_remember_me\nAttack: case randomblob(1000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [446] milliseconds, parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [446] milliseconds, when the original unmodified query with value [on] took [21] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: GET\nParam: query\nAttack: ' | case randomblob(1000000000) when not null then \"\" else \"\" end | '\nEvidence: The query time is controllable using parameter value [' | case randomblob(1000000000) when not null then \"\" else \"\" end | '], which caused the request to take [497] milliseconds, parameter value [' | case randomblob(1000000000) when not null then \"\" else \"\" end | '], which caused the request to take [497] milliseconds, when the original unmodified query with value [query] took [32] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/transfer-funds-verify.html\nMethod: POST\nParam: fromAccountId\nAttack: case randomblob(10000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [549] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [549] milliseconds, when the original unmodified query with value [4] took [21] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/sendFeedback.html\nMethod: POST\nParam: query\nAttack: case randomblob(1000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [445] milliseconds, parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [445] milliseconds, when the original unmodified query with value [query] took [18] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/login.html?login_error=true\nMethod: GET\nParam: login_error\nAttack: case randomblob(100000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(100000000) when not null then 1 else 1 end ], which caused the request to take [451] milliseconds, parameter value [case randomblob(100000000) when not null then 1 else 1 end ], which caused the request to take [451] milliseconds, when the original unmodified query with value [true] took [8] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: POST\nParam: query\nAttack: case randomblob(100000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(100000000) when not null then 1 else 1 end ], which caused the request to take [497] milliseconds, parameter value [case randomblob(100000000) when not null then 1 else 1 end ], which caused the request to take [497] milliseconds, when the original unmodified query with value [query] took [17] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements.html\nMethod: GET\nParam: query\nAttack: \" | case randomblob(1000000000) when not null then \"\" else \"\" end | \"\nEvidence: The query time is controllable using parameter value [\" | case randomblob(1000000000) when not null then \"\" else \"\" end | \"], which caused the request to take [480] milliseconds, parameter value [\" | case randomblob(1000000000) when not null then \"\" else \"\" end | \"], which caused the request to take [480] milliseconds, when the original unmodified query with value [query] took [25] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-conversion-rate-for-currency.html\nMethod: POST\nParam: query\nAttack: ' | case randomblob(100000) when not null then \"\" else \"\" end --\nEvidence: The query time is controllable using parameter value [' | case randomblob(100000) when not null then \"\" else \"\" end --], which caused the request to take [449] milliseconds, parameter value [' | case randomblob(100000) when not null then \"\" else \"\" end --], which caused the request to take [449] milliseconds, when the original unmodified query with value [query] took [12] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/transfer-funds-verify.html\nMethod: POST\nParam: query\nAttack: case randomblob(1000000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(1000000000) when not null then 1 else 1 end ], which caused the request to take [20] milliseconds, parameter value [case randomblob(1000000000) when not null then 1 else 1 end ], which caused the request to take [20] milliseconds, when the original unmodified query with value [query] took [464] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/forgot-password.html\nMethod: GET\nParam: query\nAttack: case randomblob(10000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [11] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [11] milliseconds, when the original unmodified query with value [query] took [9] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: POST\nParam: submit\nAttack: ' | case randomblob(100000000) when not null then \"\" else \"\" end | '\nEvidence: The query time is controllable using parameter value [' | case randomblob(100000000) when not null then \"\" else \"\" end | '], which caused the request to take [518] milliseconds, parameter value [' | case randomblob(100000000) when not null then \"\" else \"\" end | '], which caused the request to take [518] milliseconds, when the original unmodified query with value [Sign in] took [482] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/sendFeedback.html\nMethod: POST\nParam: email\nAttack: case randomblob(1000000) when not null then 1 else 1 end \nEvidence: The query time is controllable using parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [19] milliseconds, parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [19] milliseconds, when the original unmodified query with value [ZAP] took [10] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: POST\nParam: query\nAttack: ' | case randomblob(100000000) when not null then \"\" else \"\" end | '\nEvidence: The query time is controllable using parameter value [' | case randomblob(100000000) when not null then \"\" else \"\" end | '], which caused the request to take [443] milliseconds, parameter value [' | case randomblob(100000000) when not null then \"\" else \"\" end | '], which caused the request to take [443] milliseconds, when the original unmodified query with value [query] took [18] milliseconds.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"10020","title":"X-Frame-Options Header Not Set","desc":"X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks.","impact":0.5,"tags":{"nist":["unmapped"],"cweid":"16","wascid":"15","sourceid":"3","confidence":"2","riskdesc":"Medium (Medium)","check":"Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. ALLOW-FROM allows specific websites to frame the web page in supported web browsers).
\n\n"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/money-map.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=1\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements-for-account.html\nMethod: POST\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-summary.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-new-payee.html\nMethod: POST\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/login.html?login_error=true\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html?topic=/help/topic2.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=6\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity-find-transactions.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=2\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=3\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=4\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/forgotten-password-send.html\nMethod: POST\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity.html?accountId=5\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html?topic=/help/topic3.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/search.html?searchTerm=ZAP\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity-show-transactions.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-new-payee.html\nMethod: GET\nParam: X-Frame-Options\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"40025.2","title":"Proxy Disclosure","desc":"1 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine - A list of targets for an attack against the application. - Potential vulnerabilities on the proxy servers that service the application. - The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated. ","impact":0.5,"tags":{"nist":["SC-8","Rev_4"],"cweid":"200","wascid":"45","sourceid":"1","confidence":"2","riskdesc":"Medium (Medium)","check":"Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server.
Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing).
Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages.
Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers.
\nUsing the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between OWASP ZAP and the application/web server:
- Apache/2.2.6 (Win32) mod_ssl/2.2.6 OpenSSL/0.9.8e mod_jk/1.2.40
The following web/application server has been identified:
- Unknown
\nUsing the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between OWASP ZAP and the application/web server:
- Apache/2.2.6 (Win32) mod_ssl/2.2.6 OpenSSL/0.9.8e mod_jk/1.2.40
The following web/application server has been identified:
- Unknown
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/transfer-funds-verify.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity-show-transactions.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-conversion-rate-for-currency.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/sendFeedback.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/account-activity-find-transactions.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/money-map-get-spendings-by-type.html?_dc=1544043856896\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-get-payee-details.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/online-statements-for-account.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/forgotten-password-send.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills-new-payee.html\nMethod: POST\nAttack: TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"40027","title":"SQL Injection - MsSQL","desc":"SQL injection may be possible","impact":0.7,"tags":{"nist":["SI-10","Rev_4"],"cweid":"89","wascid":"19","sourceid":"1","confidence":"2","riskdesc":"High (Medium)","check":"Do not trust client side input, even if there is client side validation in place.
In general, type check all data on the server side.
If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'
If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.
If database Stored Procedures can be used, use them.
Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!
Do not create dynamic SQL queries using simple string concatenation.
Escape all data received from the client.
Apply a 'whitelist' of allowed characters, or a 'blacklist' of disallowed characters in user input.
Apply the privilege of least privilege by using the least privileged database user possible.
In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.
Grant the minimum database access that is necessary for the application.
\nThe query time is controllable using parameter value [account-summary.html) WAITFOR DELAY '0:0:15' -- ], which caused the request to take [20,001] milliseconds, when the original unmodified query with value [account-summary.html] took [947] milliseconds.
\nThe query time is controllable using parameter value [account-summary.html) WAITFOR DELAY '0:0:15' -- ], which caused the request to take [20,001] milliseconds, when the original unmodified query with value [account-summary.html] took [947] milliseconds.
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/redirect.html?url=account-summary.html\nMethod: GET\nParam: url\nAttack: account-summary.html) WAITFOR DELAY '0:0:15' -- \n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"},{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/bank/pay-bills.html\nMethod: GET\nParam: query\nAttack: query\" WAITFOR DELAY '0:0:15' -- \n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"6","title":"Path Traversal","desc":"The Path Traversal attack technique allows an attacker access to files, directories, and commands that potentially reside outside the web document root directory. An attacker may manipulate a URL in such a way that the web site will execute or reveal the contents of arbitrary files anywhere on the web server. Any device that exposes an HTTP-based interface is potentially vulnerable to Path Traversal.Most web sites restrict user access to a specific portion of the file-system, typically called the \"web document root\" or \"CGI root\" directory. These directories contain the files intended for user access and the executable necessary to drive web application functionality. To access files or execute commands anywhere on the file-system, Path Traversal attacks will utilize the ability of special-characters sequences.The most basic Path Traversal attack uses the \"../\" special-character sequence to alter the resource location requested in the URL. Although most popular web servers will prevent this technique from escaping the web document root, alternate encodings of the \"../\" sequence may help bypass the security filters. These method variations include valid and invalid Unicode-encoding (\"..%u2216\" or \"..%c0%af\") of the forward slash character, backslash characters (\"..\\\") on Windows-based servers, URL encoded characters \"%2e%2e%2f\"), and double URL encoding (\"..%255c\") of the backslash character.Even if the web server properly restricts Path Traversal attempts in the URL path, a web application itself may still be vulnerable due to improper handling of user-supplied input. This is a common problem of web applications that use template mechanisms or load static text from files. In variations of the attack, the original URL parameter value is substituted with the file name of one of the web application's dynamic scripts. Consequently, the results can reveal source code because the file is interpreted as text instead of an executable script. These techniques often employ additional special characters such as the dot (\".\") to reveal the listing of the current working directory, or \"%00\" NULL characters in order to bypass rudimentary file extension checks.","impact":0.7,"tags":{"nist":["SI-10","Rev_4"],"cweid":"22","wascid":"33","sourceid":"1","confidence":"2","riskdesc":"High (Medium)","check":"Assume all input is malicious. Use an \"accept known good\" input validation strategy, i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a blacklist). However, blacklists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, \"boat\" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if you are expecting colors such as \"red\" or \"blue.\"
For filenames, use stringent whitelists that limit the character set to be used. If feasible, only allow a single \".\" character in the filename to avoid weaknesses, and exclude directory separators such as \"/\". Use a whitelist of allowable file extensions.
Warning: if you attempt to cleanse your data, then do so that the end result is not in the form that can be dangerous. A sanitizing mechanism can remove characters such as '.' and ';' which may be required for some exploits. An attacker can try to fool the sanitizing mechanism into \"cleaning\" data into a dangerous form. Suppose the attacker injects a '.' inside a filename (e.g. \"sensi.tiveFile\") and the sanitizing mechanism removes the character resulting in the valid filename, \"sensitiveFile\". If the input data are now assumed to be safe, then the file may be compromised.
Inputs should be decoded and canonicalized to the application's current internal representation before being validated. Make sure that your application does not decode the same input twice. Such errors could be used to bypass whitelist schemes by introducing dangerous inputs after they have been checked.
Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes \"..\" sequences and symbolic links.
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Run your code in a \"jail\" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by your software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows you to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
\n\n"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html?topic=WEB-INF%2Fweb.xml\nMethod: GET\nParam: topic\nAttack: WEB-INF/web.xml\nEvidence: \n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]},{"id":"7","title":"Remote File Inclusion","desc":"Remote File Include (RFI) is an attack technique used to exploit \"dynamic file include\" mechanisms in web applications. When web applications take user input (URL, parameter value, etc.) and pass them into file include commands, the web application might be tricked into including remote files with malicious code.Almost all web application frameworks support file inclusion. File inclusion is mainly used for packaging common code into separate files that are later referenced by main application modules. When a web application references an include file, the code in this file may be executed implicitly or explicitly by calling specific procedures. If the choice of module to load is based on elements from the HTTP request, the web application might be vulnerable to RFI.An attacker can use RFI for: * Running malicious code on the server: any code in the included malicious files will be run by the server. If the file include is not executed using some wrapper, code in include files is executed in the context of the server user. This could lead to a complete system compromise. * Running malicious code on clients: the attacker's malicious code can manipulate the content of the response sent to the client. The attacker can embed malicious code in the response that will be run by the client (for example, Javascript to steal the client session cookies).PHP is particularly vulnerable to RFI attacks due to the extensive use of \"file includes\" in PHP programming and due to default server configurations that increase susceptibility to an RFI attack.","impact":0.7,"tags":{"nist":["unmapped"],"cweid":"98","wascid":"5","sourceid":"1","confidence":"2","riskdesc":"High (Medium)","check":"Phase: Architecture and Design
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
For example, ID 1 could map to \"inbox.txt\" and ID 2 could map to \"profile.txt\". Features such as the ESAPI AccessReferenceMap provide this capability.
Phases: Architecture and Design; Operation
Run your code in a \"jail\" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by your software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows you to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
For PHP, the interpreter offers restrictions such as open basedir or safe mode which can make it more difficult for an attacker to escape out of the application. Also consider Suhosin, a hardened PHP extension, which includes various options that disable some of the more dangerous PHP features.
Phase: Implementation
Assume all input is malicious. Use an \"accept known good\" input validation strategy, i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a blacklist). However, blacklists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, \"boat\" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if you are expecting colors such as \"red\" or \"blue.\"
For filenames, use stringent whitelists that limit the character set to be used. If feasible, only allow a single \".\" character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as \"/\" to avoid CWE-36. Use a whitelist of allowable file extensions, which will help to avoid CWE-434.
Phases: Architecture and Design; Operation
Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately.
This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce your attack surface.
Phases: Architecture and Design; Implementation
Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
Many file inclusion problems occur because the programmer assumed that certain inputs could not be modified, especially for cookies and URL components.
\n\n"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/help.html?topic=http%3A%2F%2Fwww.google.com%2F\nMethod: GET\nParam: topic\nAttack: http://www.google.com/\nEvidence:Rewrite the background program using proper deletion of bad character strings. This will require a recompile of the background executable.
\nPotential Format String Error. The script closed the connection on a /%s
\nPotential Format String Error. The script closed the connection on a /%s
"},"descriptions":[],"refs":[],"source_location":{},"code":"","results":[{"status":"failed","code_desc":"Uri: http://zero.webappsecurity.com/signin.html\nMethod: POST\nParam: user_token\nAttack: ZAP%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s\n\n","run_time":0.0,"start_time":"Wed, 5 Dec 2018 19:00:19"}]}],"sha256":"87f7c8c5efe76ac398d2f1a88dc7126e9f303a1ba8692624d11a80b7de4a7f50"}]}