Project: ThreatMapper (Provisioning / Security & Compliance)
File: Security Report for Security Test 1 2021-04-14 18_43_22.pdf

Issues report for Security Test 1
in Project 4/Security Test Suite 1/https://164.90.157.161 TestCase
Summary
Started at 2021-04-14 18:43:22
Time taken 00:00:08.364
Total scans performed: 62
Issues found: 12
Scan Issues Found In Test StepsTotal Issues 
Found
HTTP Method 
FuzzingGET 12 12
Detailed Info
Issues are grouped by Security scan.
HTTP Method Fuzzing
An HTTP Method Fuzzing Scan attempts to use other HTTP verbs (methods) than those defined in 
an API. For instance, if you have defined GET and POST, it will send requests using the DELETE 
and PUT verbs, expecting an appropriate HTTP error response and reporting alerts if it doesn't 
receive it.
Sometimes, unexpected HTTP verbs can overwrite data on a server or get data that shouldn't be 
revealed to clients.
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request PURGE https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PURGE
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PURGE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PURGE
Issue Number #1
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request COPY https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method COPY
ResponseContent-type: text/html; charset=utf-8
140 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot COPY /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.COPY
Issue Number #2
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request UNLOCK https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method UNLOCK
ResponseContent-type: text/html; charset=utf-8
142 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot UNLOCK /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. UNLOCK
Issue Number #3
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request LOCK https://164.90.157.161/ HTTP/1.1Test Step GET
Modified 
ParametersName Value
method LOCK
ResponseContent-type: text/html; charset=utf-8
140 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot LOCK /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.LOCK
Issue Number #4
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request PROPFIND https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PROPFIND
ResponseContent-type: text/html; charset=utf-8
144 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PROPFIND /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. PROPFIND
Issue Number #5
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request PATCH https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PATCH
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PATCH /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PATCH
Issue Number #6Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request TRACE https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method TRACE
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot TRACE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.TRACE
Issue Number #7
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request OPTIONS https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method OPTIONS
ResponseContent-type: text/plain
2 Content length: 
Full response:
ok
Alerts Valid HTTP Status Codes: Response status code: 200 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. OPTIONS
Issue Number #8
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request HEAD https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method HEAD
Response No contentAlerts Valid HTTP Status Codes: Response status code: 200 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.HEAD
Issue Number #9
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request DELETE https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method DELETE
ResponseContent-type: text/html; charset=utf-8
142 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot DELETE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. DELETE
Issue Number #10
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request PUT https://164.90.157.161/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PUT
ResponseContent-type: text/html; charset=utf-8
139 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PUT /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PUT
Issue Number #11
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request POST https://164.90.157.161/ HTTP/1.1
Test Step GETModified 
ParametersName Value
method POST
ResponseContent-type: text/html; charset=utf-8
140 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot POST /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.POST
Issue Number #12