Zapotek/arachni — Issue #118: Arachni doesn't differentiate between /notfound.aspx and //notfound.aspx
Author: virilefool
Created: 2011-12-07 05:29:53+00:00
State: open

Try running a scan on demo.testfire.net

You'll get:

[2] Cross-Site Scripting (XSS) ( Severity: High )
In link input aspxerrorpath using GET at http://demo.testfire.net/notfound.aspx

[3] Cross-Site Scripting (XSS) ( Severity: High )
In link input aspxerrorpath using GET at http://demo.testfire.net//notfound.aspx