OWASP Top Ten 2017 Scan Report Summary |
||||||||||||
|
Total Requests
9962
Average Speed
8.94 req/sec.
|
71
Identified
22
Confirmed
0
Critical
20
Informational
|
||||||||||
Explanation |
||||||||||||
|
||||||||||||
71 vulnerabilities listed in OWASP Top Ten 2017 were found on this web site.
Vulnerabilities |
||||||||||||||||||||||||||||||||
|
Vulnerabilities By OWASP Top Ten 2017 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
pentestonline.es detected that password data is being transmitted over HTTP.
pentestonline.es detected that weak ciphers are enabled during secure communication (SSL).
You should allow only strong ciphers on your web server to protect secure communication with your visitors.
httpd.conf.
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
regedt32 or type regedit, and then click OK.HKLM\SYSTEM\CurrentControlSet\Control\SecurityProvidersSCHANNEL\Ciphers\DES 56/56
SCHANNEL\Ciphers\RC4 64/128
SCHANNEL\Ciphers\RC4 40/128
SCHANNEL\Ciphers\RC2 56/128
SCHANNEL\Ciphers\RC2 40/128
SCHANNEL\Ciphers\NULL
SCHANNEL\Hashes\MD5
pentestonline.es detected that insecure transportation security protocol (SSLv3) is supported by your web server.
SSLv3 has several flaws. An attacker can cause connection failures and they can trigger the use of SSL 3.0 to exploit vulnerabilities like POODLE.
Configure your web server to disallow using weak ciphers. You need to restart the web server to enable changes.
SSLProtocol +TLSv1.1 +TLSv1.2
nginx.conf file and remove SSLv3.
ssl_protocols TLSv1.1 TLSv1.2;
regedt32 or regedit, and then click OK.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\
Server or create if it doesn't exist.Server key, locate a DWORD value named Enabled or create if it doesn't exist and set its value to "0".ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable"
pentestonline.es identified that the target web site is using Bootstrap and detected that it is out of date.
Please upgrade your installation of Bootstrap to the latest stable version.
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
http://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,400,600,700,300&subset=latin
pentestonline.es detected that an active content loaded over HTTP within an HTTPS page.
Active Content is a resource which can run in the context of your page and moreover can alter the entire page. If the HTTPS page includes active content like scripts or stylesheets retrieved through regular, cleartext HTTP, then the connection is only partially encrypted. The unencrypted content is accessible to sniffers.
A man-in-the-middle attacker can intercept the request for the HTTP content and also rewrite the response to include malicious codes. Malicious active content can steal the user's credentials, acquire sensitive data about the user, or attempt to install malware on the user's system (by leveraging vulnerabilities in the browser or its plugins, for example), and therefore the connection is not safeguarded anymore.
A protocol relative URL to load an style would look like <link rel="stylesheet" href="//example.com/style.css"/>.
Same for scripts <script type="text/javascript" src="//example.com/code.js"></script>
The browser will automatically add either "http:" or "https:" to the start of the URL, whichever is appropriate.
pentestonline.es detected that autocomplete is enabled in one or more of the form fields which might contain sensitive information like "username", "credit card" or "CVV".
If user chooses to save, data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers, such as cyber cafes or airport terminals.
autocomplete="off" to the form tag or to individual "input" fields.pentestonline.es identified a cookie not marked as HTTPOnly.
HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.
pentestonline.es identified a version disclosure (ASP.NET) in target web server's HTTP response.
This information can help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of ASP.NET.
web.config file to prevent information leakage by using custom error pages and removing X-AspNet-Version from HTTP responses. <System.Web>
<httpRuntime enableVersionHeader="false" />
<customErrors mode="On" defaultRedirect="~/error/GeneralError.aspx">
<error statusCode="403" redirect="~/error/Forbidden.aspx" />
<error statusCode="404" redirect="~/error/PageNotFound.aspx" />
<error statusCode="500" redirect="~/error/InternalError.aspx" />
</customErrors>
</System.Web>
pentestonline.es identified a programming error message.
| Parameter | Type | Value |
| username_id | POST | |
| __VIEWSTATE | POST | |
| __VIEWSTATE_KEY | POST | <?xml version="1.0"?><!DOCTYPE ns [<!ELEMENT ns ANY><!ENTITY lfi SYSTEM "file:///C:/Windows/System32... |
| ctl01 | POST | Inicia sesión |
| password_id | POST |
| Parameter | Type | Value |
| URI-BASED | Full URL | /"ns="pentestonline.es(0x000A1B) |
pentestonline.es identified a stack trace disclosure (ASP.NET) in the target web server's HTTP response.
web.config file to prevent information leakage by applying custom error pages. <System.Web>
<customErrors mode="On" defaultRedirect="~/error/GeneralError.aspx">
<error statusCode="403" redirect="~/error/Forbidden.aspx" />
<error statusCode="404" redirect="~/error/PageNotFound.aspx" />
<error statusCode="500" redirect="~/error/InternalError.aspx" />
</customErrors>
</System.Web>
| Parameter | Type | Value |
| Query Based | Query String | '"--></style></scRipt><scRipt src="//en5k_y54-pfmmjdpxw0jylmw7ejnljou7quqmkj2ius.r87.me"></s... |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x000037)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | /'"--></style></scRipt><scRipt>pentestonline.es(0x000038)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x000163)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | /'"--></style></scRipt><scRipt>pentestonline.es(0x000164)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x00028F)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | /'"--></style></scRipt><scRipt>pentestonline.es(0x000290)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x00033D)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | /'"--></style></scRipt><scRipt>pentestonline.es(0x000358)</scRipt> |
| Parameter | Type | Value |
| URI-BASED | Full URL | '"--></style></scRipt><scRipt>pentestonline.es(0x00041F)</scRipt> |
pentestonline.es identified that HTTP Strict Transport Security (HSTS) policy is not enabled.
The target website is being served from not only HTTP but also HTTPS and it lacks of HSTS policy implementation.
HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTP (HTTPS) connections. The HSTS Policy is communicated by the server to the user agent via a HTTP response header field named "Strict-Transport-Security". HSTS Policy specifies a period of time during which the user agent shall access the server in only secure fashion.
Configure your webserver to redirect HTTP requests to HTTPS.
For Apache, you should have modification in the httpd.conf.
# load module
LoadModule headers_module modules/mod_headers.so
# redirect all HTTP to HTTPS (optional)
<VirtualHost *:80>
ServerAlias *
RewriteEngine On
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [redirect=301]
</VirtualHost>
# HTTPS-Host-Configuration
<VirtualHost *:443>
# Use HTTP Strict Transport Security to force client to use secure connections only
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
# Further Configuration goes here
[...]
</VirtualHost>
pentestonline.es detected a missing X-Frame-Options header which means that this website could be at risk of a clickjacking attack.
The X-Frame-Options HTTP header field indicates a policy that specifies whether the browser should render the transmitted resource within a frame or an iframe. Servers can declare this policy in the header of their HTTP responses to prevent clickjacking attacks, which ensures that their content is not embedded into other pages or frames.
Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on a framed page when they were intending to click on the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both.
Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.
X-Frame-Options: DENY It completely denies to be loaded in frame/iframe.X-Frame-Options: SAMEORIGIN It allows only if the site which wants to load has a same origin.X-Frame-Options: ALLOW-FROM URL It grants a specific URL to load itself in a iframe. However please pay attention to that, not all browsers support this. pentestonline.es detected that insecure transportation security protocol (TLS 1.0) is supported by your web server.
TLS 1.0 has several flaws. An attacker can cause connection failures and they can trigger the use of TLS 1.0 to exploit vulnerabilities like BEAST (Browser Exploit Against SSL/TLS).
Websites using TLS 1.0 are considered non-compliant by PCI since 30 June 2018.
Configure your web server to disallow using weak ciphers. You need to restart the web server to enable changes.
SSLProtocol +TLSv1.1 +TLSv1.2
nginx.conf file and remove TLSv1.
ssl_protocols TLSv1.1 TLSv1.2;
regedt32 or regedit, and then click OK.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\
Server or create if it doesn't exist.Server key, locate a DWORD value named Enabled or create if it doesn't exist and set its value to "0".pentestonline.es identified a version disclosure (IIS) in target web server's HTTP response.
This information can help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of IIS.
SERVER header of its HTTP response.pentestonline.es detected that OPTIONS method is allowed. This issue is reported as extra information.
OPTIONS method in all production systems.pentestonline.es detected that autocomplete is enabled in one or more of the password fields.
If user chooses to save, data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers, such as cyber cafes or airport terminals.
autocomplete="off" to the form tag or to individual "input" fields. However, since early 2014, major browsers don't respect this instruction, due to their integrated password management mechanism, and offer to users to store password internally.pentestonline.es identified the target web site is using jQuery and detected that it is out of date.
Please upgrade your installation of jQuery to the latest stable version.
pentestonline.es identified the target web site is using jQuery UI Autocomplete and detected that it is out of date.
Please upgrade your installation of jQuery UI Autocomplete to the latest stable version.
pentestonline.es identified that the target web site is using Moment.js and detected that it is out of date.
Please upgrade your installation of Moment.js to the latest stable version.
pentestonline.es detected that no Referrer-Policy header implemented.
Referrer-Policy is a security header designed to prevent cross-domain Referer leakage.
Referer header is a request header that indicates the site which the traffic originated from. If there is no adequate prevention in place, the URL itself, and even sensitive information contained in the URL will be leaked to the cross-site.
The lack of Referrer-Policy header might affect privacy of the users and site's itself
In a response header:
Referrer-Policy: no-referrer | same-origin | origin | strict-origin | no-origin-when-downgrading
In a META tag
<meta name="Referrer-Policy" value="no-referrer | same-origin"/>
In an element attribute
<a href="http://crosssite.example.com" rel="noreferrer"></a>
or
<a href="http://crosssite.example.com" referrerpolicy="no-referrer | same-origin | origin | strict-origin | no-origin-when-downgrading"></a>
Please implement a Referrer-Policy by using the Referrer-Policy response header or by declaring it in the meta tags. It’s also possible to control referrer information over an HTML-element by using the rel attribute.