Generated on Mon, 6 Jun 2022 14:43:56

Summary of Alerts

Risk Level Number of Alerts
High
1
Medium
6
Low
5
Informational
7

Alerts

Name Risk Level Number of Instances
Anti-CSRF Tokens Check High 1
CSP: Wildcard Directive Medium 7
CSP: script-src unsafe-inline Medium 7
CSP: style-src unsafe-inline Medium 7
Hidden File Found Medium 1
Relative Path Confusion Medium 1
Vulnerable JS Library Medium 3
Absence of Anti-CSRF Tokens Low 3
Dangerous JS Functions Low 2
Permissions Policy Header Not Set Low 30
Private IP Disclosure Low 1
Timestamp Disclosure - Unix Low 37
Base64 Disclosure Informational 8
Content-Type Header Missing Informational 1
Cookie Slack Detector Informational 1
Information Disclosure - Suspicious Comments Informational 40
Non-Storable Content Informational 5
Storable and Cacheable Content Informational 40
User Agent Fuzzer Informational 7

Passing Rules

Name Rule Type Threshold Strength
Directory Browsing Active MEDIUM MEDIUM
Path Traversal Active MEDIUM MEDIUM
Remote File Inclusion Active MEDIUM MEDIUM
XSLT Injection Active MEDIUM MEDIUM
Server Side Code Injection Active MEDIUM MEDIUM
Advanced SQL Injection Active MEDIUM MEDIUM
XPath Injection Active MEDIUM MEDIUM
Remote OS Command Injection Active MEDIUM MEDIUM
XML External Entity Attack Active MEDIUM MEDIUM
Expression Language Injection Active MEDIUM MEDIUM
Generic Padding Oracle Active MEDIUM MEDIUM
Source Code Disclosure - Git Active MEDIUM MEDIUM
Source Code Disclosure - SVN Active MEDIUM MEDIUM
SOAP Action Spoofing Active MEDIUM MEDIUM
Source Code Disclosure - File Inclusion Active MEDIUM MEDIUM
SOAP XML Injection Active MEDIUM MEDIUM
Insecure HTTP Method Active MEDIUM MEDIUM
HTTP Parameter Pollution Active MEDIUM MEDIUM
Heartbleed OpenSSL Vulnerability Active MEDIUM MEDIUM
Cross-Domain Misconfiguration Active MEDIUM MEDIUM
Source Code Disclosure - CVE-2012-1823 Active MEDIUM MEDIUM
Buffer Overflow Active MEDIUM MEDIUM
Remote Code Execution - CVE-2012-1823 Active MEDIUM MEDIUM
Format String Error Active MEDIUM MEDIUM
Integer Overflow Error Active MEDIUM MEDIUM
Cloud Metadata Potentially Exposed Active MEDIUM MEDIUM
External Redirect Active MEDIUM MEDIUM
Source Code Disclosure - /WEB-INF folder Active MEDIUM MEDIUM
HTTPS Content Available via HTTP Active MEDIUM MEDIUM
Remote Code Execution - Shell Shock Active MEDIUM MEDIUM
CRLF Injection Active MEDIUM MEDIUM
Example Active Scan Rule: Denial of Service Active MEDIUM MEDIUM
An example active scan rule which loads data from a file Active MEDIUM MEDIUM
Parameter Tampering Active MEDIUM MEDIUM
Server Side Include Active MEDIUM MEDIUM
GET for POST Active MEDIUM MEDIUM
Cross Site Scripting (Reflected) Active MEDIUM MEDIUM
Session Fixation Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) Active MEDIUM MEDIUM
LDAP Injection Active MEDIUM MEDIUM
Script Active Scan Rules Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) - Prime Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) - Spider Active MEDIUM MEDIUM
SQL Injection Active MEDIUM MEDIUM
SQL Injection - MySQL Active MEDIUM MEDIUM
SQL Injection - Hypersonic SQL Active MEDIUM MEDIUM
SQL Injection - Oracle Active MEDIUM MEDIUM
SQL Injection - PostgreSQL Active MEDIUM MEDIUM
Possible Username Enumeration Active MEDIUM MEDIUM
SQL Injection - SQLite Active MEDIUM MEDIUM
Proxy Disclosure Active MEDIUM MEDIUM
Cross Site Scripting (DOM Based) Active MEDIUM MEDIUM
SQL Injection - MsSQL Active MEDIUM MEDIUM
ELMAH Information Leak Active MEDIUM MEDIUM
Trace.axd Information Leak Active MEDIUM MEDIUM
.htaccess Information Leak Active MEDIUM MEDIUM
NoSQL Injection - MongoDB Active MEDIUM MEDIUM
.env Information Leak Active MEDIUM MEDIUM
JWT Scan Rule Active MEDIUM MEDIUM
Bypassing 403 Active MEDIUM MEDIUM
Web Cache Deception Active MEDIUM MEDIUM
CORS Header Active MEDIUM MEDIUM
Active MEDIUM MEDIUM
Spring Actuator Information Leak Active MEDIUM MEDIUM
Log4Shell Active MEDIUM MEDIUM
Backup File Disclosure Active MEDIUM MEDIUM
HTTP Only Site Active MEDIUM MEDIUM
Httpoxy - Proxy Header Misuse Active MEDIUM MEDIUM
Session ID in URL Rewrite Passive MEDIUM -
Cookie without SameSite Attribute Passive MEDIUM -
X-Debug-Token Information Leak Passive MEDIUM -
Username Hash Found Passive MEDIUM -
X-AspNet-Version Response Header Passive MEDIUM -
Insecure JSF ViewState Passive MEDIUM -
Script Passive Scan Rules Passive MEDIUM -
Sub Resource Integrity Attribute Missing Passive MEDIUM -
Stats Passive Scan Rule Passive MEDIUM -
Java Serialization Object Passive MEDIUM -
Insufficient Site Isolation Against Spectre Vulnerability Passive MEDIUM -
Use of SAML Passive MEDIUM -
In Page Banner Information Leak Passive MEDIUM -
Charset Mismatch Passive MEDIUM -
Cookie No HttpOnly Flag Passive MEDIUM -
Cookie Without Secure Flag Passive MEDIUM -
Incomplete or No Cache-control Header Set Passive MEDIUM -
Example Passive Scan Rule: Denial of Service Passive MEDIUM -
Cross-Domain JavaScript Source File Inclusion Passive MEDIUM -
An example passive scan rule which loads data from a file. Passive MEDIUM -
Anti-clickjacking Header Passive MEDIUM -
X-Content-Type-Options Header Missing Passive MEDIUM -
Application Error Disclosure Passive MEDIUM -
Information Disclosure - Debug Error Messages Passive MEDIUM -
Information Disclosure - Sensitive Information in URL Passive MEDIUM -
Information Disclosure - Sensitive Information in HTTP Referrer Header Passive MEDIUM -
WSDL File Detection Passive MEDIUM -
Loosely Scoped Cookie Passive MEDIUM -
Viewstate Passive MEDIUM -
Cross-Domain Misconfiguration Passive MEDIUM -
Source Code Disclosure Passive MEDIUM -
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) Passive MEDIUM -
Secure Pages Include Mixed Content Passive MEDIUM -
Weak Authentication Method Passive MEDIUM -

Sites

http://update.googleapis.com

HTTP Response Code Number of Responses

No Authentication Statistics Found

Parameter Name Type Flags Times Used # Values

https://clientservices.googleapis.com

HTTP Response Code Number of Responses

No Authentication Statistics Found

Parameter Name Type Flags Times Used # Values

https://update.googleapis.com

HTTP Response Code Number of Responses

No Authentication Statistics Found

Parameter Name Type Flags Times Used # Values

https://optimizationguide-pa.googleapis.com

HTTP Response Code Number of Responses

No Authentication Statistics Found

Parameter Name Type Flags Times Used # Values

https://accounts.google.com

HTTP Response Code Number of Responses

No Authentication Statistics Found

Parameter Name Type Flags Times Used # Values

http://192.168.2.47

HTTP Response Code Number of Responses
501 Not Implemented
1
403 Forbidden
2
404 Not Found
108
405 Method Not Allowed
4
200 OK
145
Authentication Statistics Number of Responses
!reports.report.stats.auth.proxy.state.nothtml!
43
!reports.report.stats.auth.manual.state.unknown!
1
!reports.report.stats.auth.proxy.state.unknown!
12
!reports.report.stats.auth.ascan.state.notsuccess!
114
!reports.report.stats.auth.10.state.nothtml!
33
!reports.report.stats.auth.10.state.unknown!
1
!reports.report.stats.auth.ascan.state.unknown!
46
Parameter Name Type Flags Times Used # Values

Alert Detail

High
 Anti-CSRF Tokens Check
Description
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.

CSRF attacks are effective in a number of situations, including:

* The victim has an active session on the target site.

* The victim is authenticated via HTTP auth on the target site.

* The victim is on the same local network as the target site.

CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence <form name = 'myform' id='myform' autocomplete="off" style='width:100%' method='POST' enctype='multipart/form-data' >
Request Header - size: 543 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
Instances 1
Solution
Phase: Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

For example, use anti-CSRF packages such as the OWASP CSRFGuard.

Phase: Implementation

Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.

Phase: Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).

Note that this can be bypassed using XSS.

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

Note that this can be bypassed using XSS.

Use the ESAPI Session Management control.

This control includes a component for CSRF.

Do not use the GET method for any request that triggers a state change.

Phase: Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
Reference http://projects.webappsec.org/Cross-Site-Request-Forgery
http://cwe.mitre.org/data/definitions/352.html
Tags OWASP_2021_A05
WSTG-v42-SESS-05
OWASP_2017_A06
CWE Id 352
WASC Id 9
Plugin Id 20012
Medium
 CSP: Wildcard Directive
Description
The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:

connects-src, frame-ancestors, manifest-src, prefetch-src, form-action

The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
URL http://192.168.2.47/webprog_generic_login/onedb/webapp/login.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 222 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,055 bytes.
Response Body - size: 34,194 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/ajax_menu.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 289 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,205 bytes.
Response Body - size: 656 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/cm_bread_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 664 bytes.
Request Body - size: 34 bytes.
Response Header - size: 1,076 bytes.
Response Body - size: 167 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/db_field_length_checker_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 680 bytes.
Request Body - size: 113 bytes.
Response Header - size: 1,161 bytes.
Response Body - size: 2 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/menu_view_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 665 bytes.
Request Body - size: 22 bytes.
Response Header - size: 1,187 bytes.
Response Body - size: 2,558 bytes.
Instances 7
Solution
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
Reference http://www.w3.org/TR/CSP2/
http://www.w3.org/TR/CSP/
http://caniuse.com/#search=content+security+policy
http://content-security-policy.com/
https://github.com/shapesecurity/salvation
https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 693
WASC Id 15
Plugin Id 10055
Medium
 CSP: script-src unsafe-inline
Description
script-src includes unsafe-inline.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
URL http://192.168.2.47/webprog_generic_login/onedb/webapp/login.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 222 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,055 bytes.
Response Body - size: 34,194 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/ajax_menu.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 289 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,205 bytes.
Response Body - size: 656 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/cm_bread_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 664 bytes.
Request Body - size: 34 bytes.
Response Header - size: 1,076 bytes.
Response Body - size: 167 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/db_field_length_checker_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 680 bytes.
Request Body - size: 113 bytes.
Response Header - size: 1,161 bytes.
Response Body - size: 2 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/menu_view_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 665 bytes.
Request Body - size: 22 bytes.
Response Header - size: 1,187 bytes.
Response Body - size: 2,558 bytes.
Instances 7
Solution
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
Reference http://www.w3.org/TR/CSP2/
http://www.w3.org/TR/CSP/
http://caniuse.com/#search=content+security+policy
http://content-security-policy.com/
https://github.com/shapesecurity/salvation
https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 693
WASC Id 15
Plugin Id 10055
Medium
 CSP: style-src unsafe-inline
Description
style-src includes unsafe-inline.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
URL http://192.168.2.47/webprog_generic_login/onedb/webapp/login.php
Method GET
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 222 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,055 bytes.
Response Body - size: 34,194 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/ajax_menu.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 289 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,205 bytes.
Response Body - size: 656 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/cm_bread_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 664 bytes.
Request Body - size: 34 bytes.
Response Header - size: 1,076 bytes.
Response Body - size: 167 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/db_field_length_checker_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 680 bytes.
Request Body - size: 113 bytes.
Response Header - size: 1,161 bytes.
Response Body - size: 2 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/menu_view_ajax.php
Method POST
Parameter
Attack
Evidence script-src 'self' data: 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://yui.yahooapis.com http://ajax.googleapis.com https://ajax.googleapis.com; object-src 'self'; style-src 'self' data: 'unsafe-inline' https://maps.googleapis.com https://maps.gstatic.com https://fonts.googleapis.com https://www.gstatic.com https://maxcdn.bootstrapcdn.com/; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://www.gstatic.com http://icant.co.uk http://yui.yahooapis.com http://o.aolcdn.com http://maps.google.com; media-src 'self'; frame-src 'self'; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com
Request Header - size: 665 bytes.
Request Body - size: 22 bytes.
Response Header - size: 1,187 bytes.
Response Body - size: 2,558 bytes.
Instances 7
Solution
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
Reference http://www.w3.org/TR/CSP2/
http://www.w3.org/TR/CSP/
http://caniuse.com/#search=content+security+policy
http://content-security-policy.com/
https://github.com/shapesecurity/salvation
https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 693
WASC Id 15
Plugin Id 10055
Medium
 Hidden File Found
Description
A sensitive file was identified as accessible or available. This may leak administrative, configuration, or credential information which can be leveraged by a malicious individual to further attack the system or conduct social engineering efforts.
URL http://192.168.2.47/adminer.php
Method GET
Parameter
Attack
Evidence HTTP/1.1 200 OK
Request Header - size: 515 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,341 bytes.
Response Body - size: 4,297 bytes.
Instances 1
Solution
Consider whether or not the component is actually required in production, if it isn't then disable it. If it is then ensure access to it requires appropriate authentication and authorization, or limit exposure to internal systems or specific source IPs, etc.
Reference https://blog.hboeck.de/archives/892-Introducing-Snallygaster-a-Tool-to-Scan-for-Secrets-on-Web-Servers.html
Tags OWASP_2021_A05
WSTG-v42-CONF-05
OWASP_2017_A06
CWE Id 538
WASC Id 13
Plugin Id 40035
Medium
 Relative Path Confusion
Description
The web server is configured to serve responses to ambiguous URLs in a manner that is likely to lead to confusion about the correct "relative path" for the URL. Resources (CSS, images, etc.) are also specified in the page response using relative, rather than absolute URLs. In an attack, if the web browser parses the "cross-content" response in a permissive manner, or can be tricked into permissively parsing the "cross-content" response, using techniques such as framing, then the web browser may be fooled into interpreting HTML as CSS (or other content types), leading to an XSS vulnerability.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php/br1w9/o89rr
Evidence <link rel="SHORTCUT ICON" href="img/tab_title.ico">
Request Header - size: 378 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,447 bytes.
Instances 1
Solution
Web servers and frameworks should be updated to be configured to not serve responses to ambiguous URLs in such a way that the relative path of such URLs could be mis-interpreted by components on either the client side, or server side.

Within the application, the correct use of the "<base>" HTML tag in the HTTP response will unambiguously specify the base URL for all relative URLs in the document.

Use the "Content-Type" HTTP response header to make it harder for the attacker to force the web browser to mis-interpret the content type of the response.

Use the "X-Content-Type-Options: nosniff" HTTP response header to prevent the web browser from "sniffing" the content type of the response.

Use a modern DOCTYPE such as "<!doctype html>" to prevent the page from being rendered in the web browser using "Quirks Mode", since this results in the content type being ignored by the web browser.

Specify the "X-Frame-Options" HTTP response header to prevent Quirks Mode from being enabled in the web browser using framing attacks.
Reference http://www.thespanner.co.uk/2014/03/21/rpo/
https://hsivonen.fi/doctype/
http://www.w3schools.com/tags/tag_base.asp
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 20
WASC Id 20
Plugin Id 10051
Medium
 Vulnerable JS Library
Description
The identified library jquery-ui, version 1.10.4 is vulnerable.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence // 4.4.3 (2016-09-01) !function(e,t){"use strict";function n(e,t){for(var n,r=[],i=0;i<e.length;++i){if(n=s[e[i]]||o(e[i]),!n)throw"module definition dependecy not found: "+e[i];r.push(n)}t.apply(null,r)}function r(e,r,i){if("string"!=typeof e)throw"invalid module definition, module id must be defined and be a string";if(r===t)throw"invalid module definition, dependencies must be specified";if(i===t)throw"invalid module definition, definition function must be specified";n(r,function(){s[e]=i.apply(null,arguments)})}function i(e){return!!s[e]}function o(t){for(var n=e,r=t.split(/[.\/]/),i=0;i<r.length;++i){if(!n[r[i]])return;n=n[r[i]]}return n}function a(n){var r,i,o,a,l;for(r=0;r<n.length;r++){i=e,o=n[r],a=o.split(/[.\/]/);for(var c=0;c<a.length-1;++c)i[a[c]]===t&&(i[a[c]]={}),i=i[a[c]];i[a[a.length-1]]=s[o]}if(e.AMDLC_TESTS){l=e.privateModules||{};for(o in s)l[o]=s[o];for(r=0;r<n.length;r++)delete l[n[r]];e.privateModules=l}}var s={},l="tinymce/geom/Rect"
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence jquery-1.10.2.min.js
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-ui-1.10.4.custom.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence /*! jQuery UI - v1.10.4
Request Header - size: 519 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 228,560 bytes.
Instances 3
Solution
Please upgrade to the latest version of jquery-ui.
Reference https://bugs.jqueryui.com/ticket/15284
https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
https://nvd.nist.gov/vuln/detail/CVE-2021-41184
https://nvd.nist.gov/vuln/detail/CVE-2021-41183
https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc
https://nvd.nist.gov/vuln/detail/CVE-2021-41182
Tags OWASP_2017_A09
OWASP_2021_A06
CWE Id 829
WASC Id
Plugin Id 10003
Low
 Absence of Anti-CSRF Tokens
Description
No Anti-CSRF tokens were found in a HTML submission form.

A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.

CSRF attacks are effective in a number of situations, including:

* The victim has an active session on the target site.

* The victim is authenticated via HTTP auth on the target site.

* The victim is on the same local network as the target site.

CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence <form name = 'myform' id='myform' autocomplete="off" style='width:100%' method='POST' enctype='multipart/form-data' >
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence <form name='myform' id='myform' method='post'>
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
URL http://192.168.2.47/webprog_generic_login/onedb/webapp/login.php
Method GET
Parameter
Attack
Evidence <form name="myform" id="myform" action="" method="POST">
Request Header - size: 222 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,055 bytes.
Response Body - size: 34,194 bytes.
Instances 3
Solution
Phase: Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

For example, use anti-CSRF packages such as the OWASP CSRFGuard.

Phase: Implementation

Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.

Phase: Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).

Note that this can be bypassed using XSS.

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

Note that this can be bypassed using XSS.

Use the ESAPI Session Management control.

This control includes a component for CSRF.

Do not use the GET method for any request that triggers a state change.

Phase: Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
Reference http://projects.webappsec.org/Cross-Site-Request-Forgery
http://cwe.mitre.org/data/definitions/352.html
Tags OWASP_2021_A01
WSTG-v42-SESS-05
OWASP_2017_A05
CWE Id 352
WASC Id 9
Plugin Id 10202
Low
 Dangerous JS Functions
Description
A dangerous JS function seems to be in use that would leave the site vulnerable.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.tablesorter.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence eval
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 16,520 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence eval
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
Instances 2
Solution
See the references for security advice on the use of these functions.
Reference https://angular.io/guide/security
Tags WSTG-v42-CLNT-02
OWASP_2021_A04
CWE Id 749
WASC Id
Plugin Id 10110
Low
 Permissions Policy Header Not Set
Description
Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/class/lstv_pager.js?v=20220224185611
Method GET
Parameter
Attack
Evidence
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 50,267 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/custom_modal.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 494 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 1,986 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/db_field_length_checker/db_field_length_checker.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 529 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 2,897 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/greaterdate_function.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 502 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 2,104 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.blockUI.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 20,322 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.equalHeight.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,142 bytes.
Response Body - size: 655 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.inputmask.bundle.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 146,513 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.tablesorter.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 16,520 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/lst_freeze_table/lst_freeze_table.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 515 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 9,219 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/searchmodal/searchable.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 10,850 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/sha1.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 486 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 3,459 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/jquery.tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 508 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 3,591 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/validation.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,142 bytes.
Response Body - size: 160 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/webcamjs-master2/webcam.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 26,791 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/alertify/alertify.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 33,298 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/customupload/customupload.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 1,633 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/moment.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 498 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 61,317 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-ui-1.10.4.custom.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 519 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 228,560 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/jquery.autonumeric.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 63,255 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
URL http://192.168.2.47/webprog_generic_login/onedb/webapp/login.php
Method GET
Parameter
Attack
Evidence
Request Header - size: 222 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,055 bytes.
Response Body - size: 34,194 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/ajax_menu.php
Method POST
Parameter
Attack
Evidence
Request Header - size: 289 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,205 bytes.
Response Body - size: 656 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/cm_bread_ajax.php
Method POST
Parameter
Attack
Evidence
Request Header - size: 664 bytes.
Request Body - size: 34 bytes.
Response Header - size: 1,076 bytes.
Response Body - size: 167 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/db_field_length_checker_ajax.php
Method POST
Parameter
Attack
Evidence
Request Header - size: 680 bytes.
Request Body - size: 113 bytes.
Response Header - size: 1,161 bytes.
Response Body - size: 2 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/menu_view_ajax.php
Method POST
Parameter
Attack
Evidence
Request Header - size: 665 bytes.
Request Body - size: 22 bytes.
Response Header - size: 1,187 bytes.
Response Body - size: 2,558 bytes.
Instances 30
Solution
Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header.
Reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
https://developers.google.com/web/updates/2018/06/feature-policy
https://scotthelme.co.uk/a-new-security-header-feature-policy/
https://w3c.github.io/webappsec-feature-policy/
https://www.smashingmagazine.com/2018/12/feature-policy/
Tags OWASP_2021_A01
OWASP_2017_A05
CWE Id 693
WASC Id 15
Plugin Id 10063
Low
 Private IP Disclosure
Description
A private IP (such as 10.x.x.x, 172.x.x.x, 192.168.x.x) or an Amazon EC2 private hostname (for example, ip-10-0-56-78) has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence 10.0.0.18
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
Instances 1
Solution
Remove the private IP address from the HTTP response body. For comments, use JSP/ASP/PHP comment instead of HTML/JavaScript comment which can be seen by client browsers.
Reference https://tools.ietf.org/html/rfc1918
Tags OWASP_2021_A01
OWASP_2017_A03
CWE Id 200
WASC Id 13
Plugin Id 2
Low
 Timestamp Disclosure - Unix
Description
A timestamp was disclosed by the application/web server - Unix
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/css/layout_body_lst.css?v=20220209161346
Method GET
Parameter
Attack
Evidence 20180404
Request Header - size: 506 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,130 bytes.
Response Body - size: 68,509 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/class/lstv_pager.js?v=20220224185611
Method GET
Parameter
Attack
Evidence 20190314
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 50,267 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/class/lstv_pager.js?v=20220224185611
Method GET
Parameter
Attack
Evidence 20191106
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 50,267 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/class/lstv_pager.js?v=20220224185611
Method GET
Parameter
Attack
Evidence 20191107
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 50,267 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/class/lstv_pager.js?v=20220224185611
Method GET
Parameter
Attack
Evidence 20191113
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 50,267 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/class/lstv_pager.js?v=20220224185611
Method GET
Parameter
Attack
Evidence 20191118
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 50,267 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20160801
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20160805
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20180214
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20180412
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20180420
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20180430
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20180820
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20190226
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20190606
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence 20191112
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 06262015
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20160809
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20191030
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20191106
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20191107
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20191112
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20191115
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20191121
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20191123
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/searchmodal/searchable.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20190801
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 10,850 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 16777215
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 2147024809
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 2147483647
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/customupload/customupload.js?v=20220209161346
Method GET
Parameter
Attack
Evidence 20190404
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 1,633 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence 32954565
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence 20030331
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence 20110929
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-ui-1.10.4.custom.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence 0123456789
Request Header - size: 519 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 228,560 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/jquery.autonumeric.js?v=20220209161352
Method GET
Parameter
Attack
Evidence 0123456789
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 63,255 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence 20180420
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence 20190311
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
Instances 37
Solution
Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
Reference http://projects.webappsec.org/w/page/13246936/Information%20Leakage
Tags OWASP_2021_A01
OWASP_2017_A03
CWE Id 200
WASC Id 13
Plugin Id 10096
Informational
 Base64 Disclosure
Description
Base64 encoded data was disclosed by the application/web server. Note: in the interests of performance not all base64 strings in the response were analyzed individually, the entire response should be looked at by the analyst/security team/developer(s).
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/css/layout_body_lst.css?v=20220209161346
Method GET
Parameter
Attack
Evidence R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7
Request Header - size: 506 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,130 bytes.
Response Body - size: 68,509 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence PxybLzDl2lWf8y6DDul4S3sDu4074Njwt3ACW1N/xZGXwf4zJAbXvun43pLgY6lYzPdQUSork6JtA0iaGmhu8w==
Request Header - size: 543 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 47,958 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence aXJFWXbtxoumqjNQ0DXgqlL74ST7dXdmFkYBJnYHkEz2AbS0aK8mUuMVp1SF8s5+VGJgami6DRwyDk5jsgQwIw==
Request Header - size: 543 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence vX/w7h1m83fBGJtHgt8J5ehfAZF5tw+UcEoJzLmv/5pFzleTGCNfLTwQNvhhX8xmb+bPL6SfkbnLzaVouw0Q0A==
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/webcamjs-master2/webcam.js?v=20220209161346
Method GET
Parameter
Attack
Evidence org/en-US/docs/Web/JavaScript/Base64_encoding_and_decoding
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 26,791 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/alertify/css/alertify.min.css?v=20220209161346
Method GET
Parameter
Attack
Evidence iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAALEgAACxIB0t1+/AAAABZ0RVh0Q3JlYXRpb24gVGltZQAwNy8xMy8xNOrZqugAAAAcdEVYdFNvZnR3YXJlAEFkb2JlIEZpcmV3b3JrcyBDUzbovLKMAAAAh0lEQVQYlY2QsQ0EIQwEB9cBAR1CJUaI/gigDnwR6NBL/7/xWLNrZ2b8EwGotVpr7eOitWa1VjugiNB7R1UPrKrWe0dEAHBbXUqxMQbeewDmnHjvyTm7C3zDwAUd9c63YQdUVdu6EAJzzquz7HXvTiklt+H9DQFYaxFjvDqllFyMkbXWvfpXHjJrWFgdBq/hAAAAAElFTkSuQmCC
Request Header - size: 516 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,130 bytes.
Response Body - size: 19,192 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence org/TR/2011/REC-css3-selectors-20110929/
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
Instances 8
Solution
Manually confirm that the Base64 data does not leak sensitive information, and that the data cannot be aggregated/used to exploit other vulnerabilities.
Reference http://projects.webappsec.org/w/page/13246936/Information%20Leakage
Tags OWASP_2021_A04
OWASP_2017_A03
CWE Id 200
WASC Id 13
Plugin Id 10094
Informational
 Content-Type Header Missing
Description
The Content-Type header was either missing or empty.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/font-awesome-4.6.2/fonts/fontawesome-webfont.woff2?v=4.6.2
Method GET
Parameter
Attack
Evidence
Request Header - size: 587 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,083 bytes.
Response Body - size: 71,760 bytes.
Instances 1
Solution
Ensure each page is setting the specific and appropriate content-type value for the content being delivered.
Reference http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 345
WASC Id 12
Plugin Id 10019
Informational
 Cookie Slack Detector
Description
Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence
Request Header - size: 562 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
Instances 1
Solution
Reference http://projects.webappsec.org/Fingerprinting
Tags OWASP_2021_A05
WSTG-v42-SESS-02
OWASP_2017_A06
CWE Id 200
WASC Id 45
Plugin Id 90027
Informational
 Information Disclosure - Suspicious Comments
Description
The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/class/lstv_pager.js?v=20220224185611
Method GET
Parameter
Attack
Evidence select
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 50,267 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence from
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.blockUI.js?v=20220209161346
Method GET
Parameter
Attack
Evidence from
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 20,322 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.blockUI.js?v=20220209161346
Method GET
Parameter
Attack
Evidence later
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 20,322 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.blockUI.js?v=20220209161346
Method GET
Parameter
Attack
Evidence where
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 20,322 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.inputmask.bundle.js?v=20220209161346
Method GET
Parameter
Attack
Evidence select
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 146,513 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.inputmask.bundle.js?v=20220209161346
Method GET
Parameter
Attack
Evidence where
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 146,513 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/searchmodal/searchable.js?v=20220209161346
Method GET
Parameter
Attack
Evidence select
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 10,850 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence query
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence select
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence user
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/webcamjs-master2/webcam.js?v=20220209161346
Method GET
Parameter
Attack
Evidence from
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 26,791 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/webcamjs-master2/webcam.js?v=20220209161346
Method GET
Parameter
Attack
Evidence later
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 26,791 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/webcamjs-master2/webcam.js?v=20220209161346
Method GET
Parameter
Attack
Evidence user
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 26,791 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/alertify/alertify.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence Db
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 33,298 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/customupload/customupload.js?v=20220209161346
Method GET
Parameter
Attack
Evidence user
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 1,633 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence bug
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence from
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence later
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence query
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence select
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence TODO
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence user
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence where
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/moment.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence db
Request Header - size: 498 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 61,317 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/moment.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence from
Request Header - size: 498 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 61,317 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/moment.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence TODO
Request Header - size: 498 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 61,317 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence bug
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence bugs
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence from
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence later
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence query
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence select
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence user
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence username
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence where
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-ui-1.10.4.custom.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence select
Request Header - size: 519 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 228,560 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/jquery.autonumeric.js?v=20220209161352
Method GET
Parameter
Attack
Evidence Select
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 63,255 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence admin
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
URL http://192.168.2.47/webprog_generic_login/onedb/webapp/login.php
Method GET
Parameter
Attack
Evidence DB
Request Header - size: 222 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,055 bytes.
Response Body - size: 34,194 bytes.
Instances 40
Solution
Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.
Reference
Tags OWASP_2021_A01
OWASP_2017_A03
CWE Id 200
WASC Id 13
Plugin Id 10027
Informational
 Non-Storable Content
Description
The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter
Attack
Evidence no-store
Request Header - size: 347 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/login_applist.php
Method GET
Parameter
Attack
Evidence no-store
Request Header - size: 234 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 19,386 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/ajax_menu.php
Method POST
Parameter
Attack
Evidence no-store
Request Header - size: 289 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,205 bytes.
Response Body - size: 656 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/db_field_length_checker_ajax.php
Method POST
Parameter
Attack
Evidence no-store
Request Header - size: 680 bytes.
Request Body - size: 113 bytes.
Response Header - size: 1,161 bytes.
Response Body - size: 2 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/menu_view_ajax.php
Method POST
Parameter
Attack
Evidence no-store
Request Header - size: 665 bytes.
Request Body - size: 22 bytes.
Response Header - size: 1,187 bytes.
Response Body - size: 2,558 bytes.
Instances 5
Solution
The content may be marked as storable by ensuring that the following conditions are satisfied:

The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable)

The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)

The "no-store" cache directive must not appear in the request or response header fields

For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response

For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives)

In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:

It must contain an "Expires" header field

It must contain a "max-age" response directive

For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive

It must contain a "Cache Control Extension" that allows it to be cached

It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).
Reference https://tools.ietf.org/html/rfc7234
https://tools.ietf.org/html/rfc7231
http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html (obsoleted by rfc7234)
Tags WSTG-v42-ATHN-06
CWE Id 524
WASC Id 13
Plugin Id 10049
Informational
 Storable and Cacheable Content
Description
The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where "shared" caching servers such as "proxy" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/css/layout_body_lst.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 506 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,130 bytes.
Response Body - size: 68,509 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/css/layout_header_lst.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 508 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,129 bytes.
Response Body - size: 1,502 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/css/main.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 495 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,129 bytes.
Response Body - size: 2,629 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/css/modified_layout.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 506 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,130 bytes.
Response Body - size: 11,278 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/css/pager.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,129 bytes.
Response Body - size: 7,005 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/css/table.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,128 bytes.
Response Body - size: 431 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/class/lstv_pager.js?v=20220224185611
Method GET
Parameter
Attack
Evidence
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 50,267 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/css/global_style.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 508 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,128 bytes.
Response Body - size: 772 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/custom_modal.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 494 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 1,986 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/db_field_length_checker/db_field_length_checker.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 529 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 2,897 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/db_field_length_checker/dbflc.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 527 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,129 bytes.
Response Body - size: 2,802 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/greaterdate_function.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 502 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 2,104 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.blockUI.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 20,322 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.equalHeight.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,142 bytes.
Response Body - size: 655 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.inputmask.bundle.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 146,513 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/jquery.tablesorter.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 16,520 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/lst_freeze_table/lst_freeze_table.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 531 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,129 bytes.
Response Body - size: 3,066 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/lst_freeze_table/lst_freeze_table.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 515 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 9,219 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/regex.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 487 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 15,425 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/searchmodal/searchable.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 520 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,129 bytes.
Response Body - size: 3,323 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/searchmodal/searchable.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 504 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 10,850 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/sha1.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 486 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 3,459 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/jquery.tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 508 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 3,591 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/tinymce/tinymce.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 501 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 385,081 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/validation.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 492 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,142 bytes.
Response Body - size: 160 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/javascript/webcamjs-master2/webcam.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 505 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 26,791 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/alertify/alertify.min.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 496 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 33,298 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/alertify/css/alertify.min.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 516 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,130 bytes.
Response Body - size: 19,192 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/alertify/css/themes/bootstrap.min.css?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 524 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,129 bytes.
Response Body - size: 1,243 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/customupload/customupload.js?v=20220209161346
Method GET
Parameter
Attack
Evidence
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,143 bytes.
Response Body - size: 1,633 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/font-awesome-4.6.2/css/font-awesome.min.css?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 530 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,130 bytes.
Response Body - size: 28,931 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/font-awesome-4.6.2/fonts/fontawesome-webfont.woff2?v=4.6.2
Method GET
Parameter
Attack
Evidence
Request Header - size: 587 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,083 bytes.
Response Body - size: 71,760 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.css?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 516 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,130 bytes.
Response Body - size: 30,924 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/fullcalendar.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 394,023 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/fullcalendar/moment.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 498 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 61,317 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-1.10.2.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 509 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 273,199 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/1.10.4/js/jquery-ui-1.10.4.custom.min.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 519 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,145 bytes.
Response Body - size: 228,560 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/lib/jquery/jquery.autonumeric.js?v=20220209161352
Method GET
Parameter
Attack
Evidence
Request Header - size: 500 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,144 bytes.
Response Body - size: 63,255 bytes.
URL http://192.168.2.47/webprog_generic_login/onedb/webapp/login.php
Method GET
Parameter
Attack
Evidence
Request Header - size: 222 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,055 bytes.
Response Body - size: 34,194 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/cm_bread_ajax.php
Method POST
Parameter
Attack
Evidence
Request Header - size: 664 bytes.
Request Body - size: 34 bytes.
Response Header - size: 1,076 bytes.
Response Body - size: 167 bytes.
Instances 40
Solution
Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:

Cache-Control: no-cache, no-store, must-revalidate, private

Pragma: no-cache

Expires: 0

This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
Reference https://tools.ietf.org/html/rfc7234
https://tools.ietf.org/html/rfc7231
http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html (obsoleted by rfc7234)
Tags WSTG-v42-ATHN-06
CWE Id 524
WASC Id 13
Plugin Id 10049
Informational
 User Agent Fuzzer
Description
Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 497 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 497 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 497 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 519 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 530 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 588 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
URL http://192.168.2.47/online_test/web_standard_onedb//webapp/hris/mf_postype.php
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 493 bytes.
Request Body - size: 0 bytes.
Response Header - size: 1,165 bytes.
Response Body - size: 48,435 bytes.
Instances 7
Solution
Reference https://owasp.org/wstg
Tags
CWE Id
WASC Id
Plugin Id 10104