Project: ThreatMapper (Provisioning / Security & Compliance)
File: Security Report for Security Test 1 2021-04-14 19_13_47.pdf

Issues report for Security Test 1
in Project 6/Security Test Suite 1/http://164.90.157.161 TestCase
Summary
Started at 2021-04-14 19:13:47
Time taken 00:00:08.369
Total scans performed: 62
Issues found: 12
Scan Issues Found In Test StepsTotal Issues 
Found
HTTP Method 
FuzzingGET 12 12
Detailed Info
Issues are grouped by Security scan.
HTTP Method Fuzzing
An HTTP Method Fuzzing Scan attempts to use other HTTP verbs (methods) than those defined in 
an API. For instance, if you have defined GET and POST, it will send requests using the DELETE 
and PUT verbs, expecting an appropriate HTTP error response and reporting alerts if it doesn't 
receive it.
Sometimes, unexpected HTTP verbs can overwrite data on a server or get data that shouldn't be 
revealed to clients.
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request PURGE http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PURGE
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codesAction Points You should check if the HTTP method  should really be allowed for this resource.PURGE
Issue Number #1
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request COPY http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method COPY
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.COPY
Issue Number #2
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request UNLOCK http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method UNLOCK
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. UNLOCK
Issue Number #3
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request LOCK http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method LOCK
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.LOCK
Issue Number #4Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request PROPFIND http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PROPFIND
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. PROPFIND
Issue Number #5
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request PATCH http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PATCH
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PATCH
Issue Number #6
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request TRACE http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method TRACE
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.TRACE
Issue Number #7
Scan HTTP Method Fuzzing
Severity WARNINGEndpoint http://164.90.157.161/
Request OPTIONS http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method OPTIONS
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. OPTIONS
Issue Number #8
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request HEAD http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method HEAD
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.HEAD
Issue Number #9
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request DELETE http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method DELETE
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. DELETE
Issue Number #10
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request PUT http://164.90.157.161/ HTTP/1.1
Test Step GETModified 
ParametersName Value
method PUT
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PUT
Issue Number #11
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint http://164.90.157.161/
Request POST http://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method POST
Response No content
Alerts Valid HTTP Status Codes: Response status code: 302 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.POST
Issue Number #12