All vulnerabilities

The response contains headers which might leak sensitive information.

The endpoint appears to accept requests with TRACK HTTP Method. The original request was replayed by replacing the method value with TRACK. The application responded with 2XX success code.

The endpoint appears to accept requests with TRACE HTTP Method. The original request was replayed by replacing the method value with TRACE. The application responded with 2XX success code.

Learn how HTTP response headers can reveal server version information, understand the security risks, and discover best practices to prevent server information disclosure and reduce attack surface.

Learn how invalid HTTP requests can expose server version details in response headers, understand the security risks, and discover best practices to prevent server information disclosure.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing XML upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing PDF upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin in an encoded format. The application responded with 2XX success code and also gave out admin-related details.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin. The make-127-0-0-1-rr.1u.ms/admin which redirects to localhost/admin.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin. The application responded with 2XX success code and also gave out admin-related details.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing image upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing file parameter with sensitive file path. The application responded with 2XX success code and also gave out sensitive AWS information in response.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing CSV upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with metadata endpoint provided by AWS. The application responded with 2XX success code and also gave out sensitive AWS information in response.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with metadata endpoint provided by AWS in enclosed alphanumerics. The application responded with 2XX success code and also gave out sensitive AWS information in response.

Vulnerability assessment by replacing the CSRF token with an invalid one

Assessing the system's vulnerability by removing the CSRF token to determine if unauthorized actions can be performed.

Learn how attackers bypass access controls using arbitrary HTTP request methods, understand the security risks, and discover best practices to prevent unauthorized access to web applications and APIs.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with some of the popular ports. The application responded with 2XX success code indicating that the port is open.

Attacker can access resources of any user by introducing multiple parameters with same name.

Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the user.

An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain.

Attacker can access resources of any user by changing the auth token in request and using older version of an API

API doesn't validate the authenticity of token. Attacker can remove the auth token and access the endpoint.

The response does not contain some HTTP security headers.

The endpoint appears to be vulnerable to Mass Assignment attack. The original request was replayed by adding role with admin permissions in request body. The application responded with 2XX success code in response.

The endpoint appears to be vulnerable to Mass Assignment attack. The original request was replayed by modifyinh role param in request body. The application responded with 2XX success code in response.

The endpoint appears to be vulnerable to Mass Assignment attack. The original request was replayed by modifying admin param in request body. The application responded with 2XX success code in response.

The endpoint appears to be vulnerable to Mass Assignment attack. The original request was replayed by changing account value in request body. The application responded with 2XX success code in response.

Since NONE Algorithm JWT is accepted by the server the attacker can tamper with the payload of JWT and access protected resources.

Since server is not validating the JWT signature the attacker can tamper with the payload of JWT and access protected resources

The error response contains information which may help in more sophisticated attacks

Learn how attackers bypass access controls by changing HTTP request methods to HEAD, understand the security risks, and discover best practices to prevent unauthorized access.

The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with popular sensitive file paths. The application responded with 2XX success code and also gave out details of these files.

The error response contains information related to urls which may help in more sophisticated attacks

This vulnerability can enable attackers to inject malicious code into the application or cause it to malfunction.

Hackers trick users to log into their account by forging requests, exploiting server authentication.

Validates the Cross-Origin Resource Sharing (CORS) whitelist, ensuring only authorized origins are included, enhancing application security.

"Detects misconfigured Cross-Origin Resource Sharing (CORS) settings by checking for invalid origin values, preventing unauthorized access."

Attacker can access resources of any user by changing the auth token in request.

Attacker can access resources of any user by adding user_id in URL.

Learn how changing file names can trigger Cross-Site Scripting (XSS) vulnerabilities, explore common attack scenarios, and discover best practices to detect and prevent XSS attacks.

Learn how changing URL paths can trigger Cross-Site Scripting (XSS) vulnerabilities, understand common attack techniques, and discover best practices to detect and prevent XSS attacks.

Injecting malicious content into a web url to mislead users.

Detection of Struts OGNL console enabled misconfiguration, which can lead to remote code execution vulnerabilities.

Struts debug mode enabled misconfiguration can expose sensitive information, potentially leading to security vulnerabilities.

Spring Boot Thread Dump Actuator Exposed Misconfiguration

Spring Boot Http Trace Actuator Exposed Misconfiguration.

Spring Boot Environment Actuator Exposed Misconfiguration.

Spring Boot Configuration Properties Actuator Exposed Misconfiguration.

Spring Boot Beans Actuator Exposed Misconfiguration.

This test detects vulnerabilities in web applications, ensuring proper session management and protection against attacks.

Learn how Server-Side Template Injection (SSTI) in Twig works, explore potential security risks, and discover best practices to detect and prevent SSTI vulnerabilities in PHP applications.

Learn how Server-Side Template Injection (SSTI) in FreeMarker works, understand its security risks, and discover best practices to detect and prevent SSTI vulnerabilities in Java applications.

Learn how Server-Side Template Injection (SSTI) in Flask and Jinja works, explore common security risks, and discover best practices to detect and prevent SSTI vulnerabilities.

The server fails to enforce captcha expiration, allowing users to submit multiple requests using the same captcha value without time restrictions.

Ignoring CAPTCHA validation without the field present in the backend server can result in severe damage and vulnerabilities.

Rails Default Homepage Enabled Misconfiguration.

Rails debug mode enabled misconfiguration can expose sensitive information, potentially leading to security vulnerabilities.

An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain by leveraging subdomain whitelisting.

Tests for open redirect vulnerability by injecting evil.com into URL path, ensuring secure redirection and protection against malicious redirects.

Tests for open redirect vulnerability by injecting evil.com into host headers, ensuring secure redirection and protection against malicious redirects.

Appending 'nginx-status' to the URL, this test checks if the NGINX status module is accessible, potentially revealing sensitive server information.

Detection of Nginx server version disclosure misconfiguration, potentially aiding attackers in identifying vulnerable versions.

Detection of Nginx default page enabled misconfiguration, potentially exposing sensitive server information.

Laravel Telescope Enabled Misconfiguration.

Laravel Default Homepage Enabled Misconfiguration.

Laravel debug mode enabled misconfiguration can expose sensitive information, potentially leading to security vulnerabilities.

This test appends vulnerable payloads to the end of the URL, checking for Local File Inclusion vulnerabilities by manipulating file path references.

File path fuzzing in query parameters and request body to identify potential Local File Inclusion vulnerabilities.

This test evaluates the vulnerability of a web application to Local File Inclusion by introducing new parameters for potential file path manipulation

Replacing request parameters with bash commands in a Ruby on Rails app test can lead to command injection due to the use of 'Kernel#open' and the presence of shell injection vulnerability.

This test checks for JWT client side signing

HTTP header injection allows attackers to add headers or inject content, leading to XSS attack

Adds a random header to a request for a non-existent page and checks if it is reflected in the response.

GraphQL type introspection vulnerability enables unauthorized access to type details, potentially leading to data exposure and security breaches.

GraphQL introspection mode vulnerability allows unauthorized access to schema details, potentially exposing sensitive data and increasing attack surface.

GraphQL field suggestions provide auto-complete suggestions for available fields, enabling attackers to gain insights into data structures, potentially leading to data exposure and targeted attacks on the API.

Exposed GraphQL development console allows type introspection, increasing the risk of security vulnerabilities and unauthorized access

GraphQL debug mode enabled vulnerability exposes sensitive debug information, increasing the risk of data leakage and potential security breaches

Flask Debug Mode Enabled Misconfiguration.

Assessing security vulnerability by appending .json to API path, accessing complete Firebase collection data without authentication.

Express Stack Trace Enabled Misconfiguration exposes sensitive error details, potentially aiding attackers in identifying vulnerabilities and exploiting the application.

Express Default Homepage Enabled Misconfiguration

Detection of Django default homepage enabled misconfiguration, exposing sensitive information and indicating a potential security risk.

Verifies error messages for sensitive information leakage, specifically preventing the exposure of stack traces, enhancing application security.

Detection of default login credentials misconfiguration for potential unauthorized access vulnerability.

This test verifies if the 'secure' attribute is properly set in HTTP response header 'set-cookie' field to ensure secure cookie transmission.

This test explores various query parameter names for potential command injection, such as cmd, exec, command, execute, ping, and query.

Attackers can circumvent captcha protection by adding headers like x-forwarded-for, compromising the system's security.

Attackers can circumvent captcha protection by removing cookies compromising the system's security.

Testing vulnerability by injecting malicious scripts in query parameters to bypass security measures and execute unauthorized code.

Testing vulnerability by appending malicious scripts into query parameters to bypass security measures and execute unauthorized code.

This test examines the vulnerability of CRLF injection in HTTP headers, specifically focusing on the manipulation of query parameters through the abuse of line breaks.

WordPress configuration file (wp-config.php) leaked, exposing AWS S3 keys and sensitive database credentials.

Exposes the Wgetrc configuration file used by Wget utility, containing potentially sensitive information.

Exposed SSH Known Hosts

Exposed SSH Authorized Keys

Detects publicly accessible SonarQube projects.

Detects the exposure of SFTP configuration files.

Detects the presence of private SSH, TLS, and JWT keys on the server.

MongoDB credentials file used by RoboMongo

Redis configuration file (redis.conf) was exposed.

Exposed Prometheus metrics endpoint found.

Oracle EBS credentials may be exposed through the jtfwrepo.xml file.

Attacker can get unauthorized access of Nginx config file.

Search for the presence of Kubernetes Kustomization files (kustomization.yml) on the provided URLs.

Searches for the presence of GitHub workflow files on provided URLs.

Searches for the pattern and log file on passed URLs.

Searches for the pattern /.git/config and log file on passed URLs.

Attacker can get unauthorized access of FTP credentials.

Attacker can get unauthorized access of Firebase configuration details.

Attacker can get unauthorized access of hidden Dockerfile(s).

Attacker can get unauthorized access of Docker Compose configuration files.

Attacker can get unauthorized access of Golang expvar information.

Directory listing of sensitive files.

Learn how Ruby configuration file disclosure can expose sensitive application data, credentials, and secrets, and explore security measures to identify and prevent this vulnerability.

Attacker can get unauthorized access to JSON configuration files.

Attacker can get unauthorized access to the CircleCI config.yml file.

A test CGI script on the server leaks a list of server environment variables in the response page.

Attackers can get access to the appspec.yml file used in application deployments.

Attackers can get access to the Apache configuration files.

Attackers can get access to sensitive AWS Dockerrun configuration files.

Attacker can get unauthorized access to Apache Airflow configuration files.

Mongo Express was able to be access with no authentication requirements in place.

Parameters.yml was discovered.

Msmtp configuration was discovered.

A Docker container misconfiguration was discovered.

A Laravel .env file was discovered, which stores sensitive information like database credentials and tokens. It should not be publicly accessible.

Nginx is vulnerable to git configuration exposure.

eSMTP configuration was discovered.

Since Host server is using the JKU field of the JWT without validating, attacker can tamper with the payload of JWT and access protected resources.