Scribd Logo
Upload

Welcome to Scribd!

  • 100 views

    Wapiti Vulnerability Report: Target: Http://123.231.148.147:8081/webservice

    Uploaded by

    Plokodot Plokodot

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Wapiti Vulnerability Report: Target: Http://123.231.148.147:8081/webservice

    Uploaded by

    Plokodot Plokodot
    100 views7 pages

    Original Title

    123.231.148.147_8081_10162021_0549

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    100 views7 pages

    Wapiti Vulnerability Report: Target: Http://123.231.148.147:8081/webservice

    Uploaded by

    Plokodot Plokodot

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 7

    Wapiti vulnerability report

    Target: http://123.231.148.147:8081/webservice/
    Date of the scan: Sat, 16 Oct 2021 05:49:33 +0000. Scope of the scan: folder

    Summary

    Category Number of vulnerabilities found

    Backup file 0

    Weak credentials 0

    CRLF Injection 0

    Content Security Policy Configuration 0

    Cross Site Request Forgery 1

    Potentially dangerous file 3

    Command execution 0

    Path Traversal 0

    Fingerprint web application framework 2

    Fingerprint web server 1

    Htaccess Bypass 0

    HTTP Secure Headers 0

    HttpOnly Flag cookie 0


    Category Number of vulnerabilities found

    Open Redirect 0

    Secure Flag cookie 0

    SQL Injection 0

    Server Side Request Forgery 0

    Blind SQL Injection 0

    Cross Site Scripting 0

    XML External Entity 0

    Internal Server Error 0

    Resource consumption 0

    Fingerprint web technology 7

    Cross Site Request Forgery


    Description
    Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute
    unwanted actions on a web application in which they're currently authenticated.

    Vulnerability found in /webservice/login


    Description HTTP Request cURL command line
    Lack of anti CSRF token

    Solutions
    Check if your framework has built-in CSRF protection and use it. If framework does not
    have built-in CSRF protection add CSRF tokens to all state changing requests (requests
    that cause actions on the site) and validate them on backend.

    References
    • OWASP: Testing for Cross Site Request Forgery
    • OWASP: Cross-Site Request Forgery Prevention Cheat Sheet
    • CWE-352: Cross-Site Request Forgery (CSRF)

    Potentially dangerous file


    Description
    A file with potential vulnerabilities has been found on the website.

    Vulnerability found in /icons/README


    Description HTTP Request cURL command line

    Apache default file found.


    References:
    https://vulners.com/osvdb/OSVDB:3233

    Vulnerability found in /server-status


    Description HTTP Request cURL command line

    Apache server-status interface found (protected/forbidden)


    Vulnerability found in /server-info
    Description HTTP Request cURL command line

    Apache server-info interface found (protected/forbidden)

    Solutions
    Make sure the script is up-to-date and restrict access to it if possible.

    References
    • Mitre: Search details of a CVE

    Fingerprint web application framework


    Description
    The version of a web application framework can be identified due to the presence of its
    specific fingerprints.

    Vulnerability found in /webservice/


    Description HTTP Request cURL command line

    {"versions": ["1.0.2q"], "name": "OpenSSL", "categories": ["Web server extensions"]}

    Vulnerability found in /webservice/


    Description HTTP Request cURL command line
    {"versions": ["5.6.40"], "name": "PHP", "categories": ["Programming languages"]}

    Solutions
    This is only for informational purposes.

    References
    • OWASP: Fingerprint Web Application Framework

    Fingerprint web server


    Description
    The version of a web server can be identified due to the presence of its specific
    fingerprints.

    Vulnerability found in /webservice/


    Description HTTP Request cURL command line

    {"versions": ["2.4.38"], "name": "Apache", "categories": ["Web servers"]}

    Solutions
    This is only for informational purposes.

    References
    • OWASP: Fingerprint Web Server

    Fingerprint web technology


    Description
    The use of a web technology can be deducted due to the presence of its specific
    fingerprints.
    Additional found in /webservice/
    Description HTTP Request cURL command line

    {"versions": ["2.4.38"], "name": "Apache", "categories": ["Web servers"]}

    Additional found in /webservice/


    Description HTTP Request cURL command line

    {"versions": [], "name": "Bootstrap", "categories": ["UI frameworks"]}

    Additional found in /webservice/


    Description HTTP Request cURL command line

    {"versions": [], "name": "jQuery", "categories": ["JavaScript libraries"]}

    Additional found in /webservice/


    Description HTTP Request cURL command line

    {"versions": ["1.0.2q"], "name": "OpenSSL", "categories": ["Web server extensions"]}


    Additional found in /webservice/
    Description HTTP Request cURL command line

    {"versions": ["5.6.40"], "name": "PHP", "categories": ["Programming languages"]}

    Additional found in /webservice/


    Description HTTP Request cURL command line

    {"versions": [], "name": "reCAPTCHA", "categories": ["Security"]}

    Additional found in /webservice/


    Description HTTP Request cURL command line

    {"versions": [], "name": "Windows Server", "categories": ["Operating systems"]}

    Solutions
    This is only for informational purposes.

    References
    • OWASP: Fingerprint Web Server
    • OWASP: Fingerprint Web Application Framework

    Wapiti 3.0.5 © Nicolas SURRIBAS 2006-2021

    You might also like