Project: ThreatMapper (Provisioning / Security & Compliance)
File: Security Report for Security Test 1 2021-04-14 18_27_51.pdf

Issues report for Security Test 1
in Project 3/Security Test Suite 1/https://164.90.157.161 TestCase
Summary
Started at 2021-04-14 18:27:51
Time taken 00:00:08.396
Total scans performed: 62
Issues found: 12
Scan Issues Found In Test StepsTotal Issues 
Found
HTTP Method 
FuzzingPOST 12 12
Detailed Info
Issues are grouped by Security scan.
HTTP Method Fuzzing
An HTTP Method Fuzzing Scan attempts to use other HTTP verbs (methods) than those defined in 
an API. For instance, if you have defined GET and POST, it will send requests using the DELETE 
and PUT verbs, expecting an appropriate HTTP error response and reporting alerts if it doesn't 
receive it.
Sometimes, unexpected HTTP verbs can overwrite data on a server or get data that shouldn't be 
revealed to clients.
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request PURGE https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method PURGE
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PURGE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PURGE
Issue Number #1
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request COPY https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method COPY
ResponseContent-type: text/html; charset=utf-8
140 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot COPY /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.COPY
Issue Number #2
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request UNLOCK https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method UNLOCK
ResponseContent-type: text/html; charset=utf-8
142 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot UNLOCK /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. UNLOCK
Issue Number #3
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request LOCK https://164.90.157.161/ HTTP/1.1Test Step POST
Modified 
ParametersName Value
method LOCK
ResponseContent-type: text/html; charset=utf-8
140 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot LOCK /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.LOCK
Issue Number #4
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request PROPFIND https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method PROPFIND
ResponseContent-type: text/html; charset=utf-8
144 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PROPFIND /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. PROPFIND
Issue Number #5
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request PATCH https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method PATCH
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PATCH /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PATCH
Issue Number #6Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request TRACE https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method TRACE
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot TRACE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.TRACE
Issue Number #7
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request OPTIONS https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method OPTIONS
ResponseContent-type: text/plain
2 Content length: 
Full response:
ok
Alerts Valid HTTP Status Codes: Response status code: 200 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. OPTIONS
Issue Number #8
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request HEAD https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method HEAD
Response No contentAlerts Valid HTTP Status Codes: Response status code: 200 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.HEAD
Issue Number #9
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request DELETE https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method DELETE
ResponseContent-type: text/html; charset=utf-8
142 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot DELETE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. DELETE
Issue Number #10
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://164.90.157.161/
Request PUT https://164.90.157.161/ HTTP/1.1
Test Step POST
Modified 
ParametersName Value
method PUT
ResponseContent-type: text/html; charset=utf-8
139 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PUT /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PUT
Issue Number #11
Scan HTTP Method Fuzzing
Severity ERROR
Endpoint https://164.90.157.161/
Request GET https://164.90.157.161/ HTTP/1.1
Test Step POSTModified 
ParametersName Value
method GET
ResponseContent-type: text/html; charset=UTF-8
7322 Content length: 
Response is too big. Beginning of the response:
<!DOCTYPE html> <html lang="en"> <head> <!-- Required meta tags --> <title
>DeepFence</title> <meta charset="utf-8"> <meta name="viewport" content="
width=device-width, initial-scale=1, shrink-to-fit=no"> <script language="
javascript"> window.__DF_CSRF_TOKEN = "$__CSRF_TOKEN_PLACEHOLDER__"; </
script> <!-- Start of Zendesk Widget script --> <!-- <script id="
ze-snippet" src="https://static.zdassets.com/ekr/snippet.js?key=c377ac9e-
9a0a-4c32-aed4-bfb86b515320"> </script> --> <!-- End of Zendesk Widget 
script --> <!-- Bootstrap CSS --> <link rel="shortcut icon" type="image/
png" href="data:image/png;base64,
iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZS
BJbWFnZVJlYWR5ccllPAAACaxJREFUeNqsV1tsXNUV3fvcc1/
z8ozHHjt2HNsJdmLyMGpjglEpoRWvNhCpRa1UAVLhg48Wif5U6oMvkPrDV6la8VFohfrRFrWCg
AQIoqIkiLwKcYJDHMexE789k3nP3Nc5p/vOmCStnTagjn11x54zZ6+
z9tp77YtKKQhfvzmyBCUBcG6pDp1JAz6ercP+oSRkXQE1R8DlgguFqg93DyYhHdVef+
9c4eHxBYe+qWBLxr58e19sX7bkj10q+eDTloGQsDUTh6iOsKNDh8NTNTg5XYHN7Sb...
Alerts
Sensitive Information Exposure: [Version x.y.z] Exposing version numbers gives 
unnecessary hints on your systems vulnerabilities - Token [(?s).*\w+/\d{1,2}(\.\d{1,3})+
.*] found [3/3.5.16]
Valid HTTP Status Codes: Response status code: 200 is not in acceptable list of 
status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.GET
Issue Number #12