Project: ThreatMapper (Provisioning / Security & Compliance)
File: Security Report for Security Test 1 2022-08-09 02_29_43.pdf

Issues report for Security Test 1
in Project 4/Security Test Suite 1/https://137.184.10.129:443 TestCase
Summary
Started at 2022-08-09 02:29:43
Time taken 00:00:09.032
Total scans performed: 62
Issues found: 12
Scan Issues Found In Test StepsTotal Issues 
Found
HTTP Method 
FuzzingGET 12 12
Detailed Info
Issues are grouped by Security scan.
HTTP Method Fuzzing
An HTTP Method Fuzzing Scan attempts to use other HTTP verbs (methods) than those defined in 
an API. For instance, if you have defined GET and POST, it will send requests using the DELETE 
and PUT verbs, expecting an appropriate HTTP error response and reporting alerts if it doesn't 
receive it.
Sometimes, unexpected HTTP verbs can overwrite data on a server or get data that shouldn't be 
revealed to clients.
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request PURGE https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PURGE
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PURGE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PURGE
Issue Number #1
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request COPY https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method COPY
ResponseContent-type: text/html; charset=utf-8
140 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot COPY /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.COPY
Issue Number #2
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request UNLOCK https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method UNLOCK
ResponseContent-type: text/html; charset=utf-8
142 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot UNLOCK /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. UNLOCK
Issue Number #3
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request LOCK https://137.184.10.129:443/ HTTP/1.1Test Step GET
Modified 
ParametersName Value
method LOCK
ResponseContent-type: text/html; charset=utf-8
140 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot LOCK /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.LOCK
Issue Number #4
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request PROPFIND https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PROPFIND
ResponseContent-type: text/html; charset=utf-8
144 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PROPFIND /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. PROPFIND
Issue Number #5
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request PATCH https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PATCH
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PATCH /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PATCH
Issue Number #6Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request TRACE https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method TRACE
ResponseContent-type: text/html; charset=utf-8
141 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot TRACE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.TRACE
Issue Number #7
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request OPTIONS https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method OPTIONS
ResponseContent-type: text/plain
2 Content length: 
Full response:
ok
Alerts Valid HTTP Status Codes: Response status code: 200 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. OPTIONS
Issue Number #8
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request HEAD https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method HEAD
Response No contentAlerts Valid HTTP Status Codes: Response status code: 200 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.HEAD
Issue Number #9
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request DELETE https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method DELETE
ResponseContent-type: text/html; charset=utf-8
142 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot DELETE /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource. DELETE
Issue Number #10
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request PUT https://137.184.10.129:443/ HTTP/1.1
Test Step GET
Modified 
ParametersName Value
method PUT
ResponseContent-type: text/html; charset=utf-8
139 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot PUT /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.PUT
Issue Number #11
Scan HTTP Method Fuzzing
Severity WARNING
Endpoint https://137.184.10.129:443
Request POST https://137.184.10.129:443/ HTTP/1.1
Test Step GETModified 
ParametersName Value
method POST
ResponseContent-type: text/html; charset=utf-8
140 Content length: 
Full response:
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>
Error</title> </head> <body> <pre>Cannot POST /</pre> </body> </html>
Alerts Valid HTTP Status Codes: Response status code: 404 is not in acceptable list of status codes
Action Points You should check if the HTTP method  should really be allowed for this resource.POST
Issue Number #12