Generated on Wed, 14 Dec 2022 00:30:54

Summary of Alerts

Risk Level Number of Alerts
High
0
Medium
3
Low
3
Informational
3

Passing Rules

Name Rule Type Threshold Strength
Directory Browsing Active MEDIUM MEDIUM
CRLF Injection Active MEDIUM MEDIUM
Path Traversal Active MEDIUM MEDIUM
Remote File Inclusion Active MEDIUM MEDIUM
Parameter Tampering Active MEDIUM MEDIUM
Server Side Include Active MEDIUM MEDIUM
GET for POST Active MEDIUM MEDIUM
Cross Site Scripting (Reflected) Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) Active MEDIUM MEDIUM
Script Active Scan Rules Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) - Prime Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) - Spider Active MEDIUM MEDIUM
SQL Injection Active MEDIUM MEDIUM
SQL Injection - MySQL Active MEDIUM MEDIUM
SQL Injection - Hypersonic SQL Active MEDIUM MEDIUM
SQL Injection - Oracle Active MEDIUM MEDIUM
SQL Injection - PostgreSQL Active MEDIUM MEDIUM
SQL Injection - SQLite Active MEDIUM MEDIUM
Cross Site Scripting (DOM Based) Active MEDIUM MEDIUM
SQL Injection - MsSQL Active MEDIUM MEDIUM
ELMAH Information Leak Active MEDIUM MEDIUM
Trace.axd Information Leak Active MEDIUM MEDIUM
XSLT Injection Active MEDIUM MEDIUM
.htaccess Information Leak Active MEDIUM MEDIUM
.env Information Leak Active MEDIUM MEDIUM
Server Side Code Injection Active MEDIUM MEDIUM
Hidden File Finder Active MEDIUM MEDIUM
Remote OS Command Injection Active MEDIUM MEDIUM
XML External Entity Attack Active MEDIUM MEDIUM
Generic Padding Oracle Active MEDIUM MEDIUM
SOAP Action Spoofing Active MEDIUM MEDIUM
SOAP XML Injection Active MEDIUM MEDIUM
Heartbleed OpenSSL Vulnerability Active MEDIUM MEDIUM
Buffer Overflow Active MEDIUM MEDIUM
Source Code Disclosure - CVE-2012-1823 Active MEDIUM MEDIUM
Format String Error Active MEDIUM MEDIUM
Remote Code Execution - CVE-2012-1823 Active MEDIUM MEDIUM
Cloud Metadata Potentially Exposed Active MEDIUM MEDIUM
External Redirect Active MEDIUM MEDIUM
Source Code Disclosure - /WEB-INF folder Active MEDIUM MEDIUM
Private IP Disclosure Passive MEDIUM -
Session ID in URL Rewrite Passive MEDIUM -
Insecure JSF ViewState Passive MEDIUM -
Charset Mismatch Passive MEDIUM -
Cookie No HttpOnly Flag Passive MEDIUM -
Cookie Without Secure Flag Passive MEDIUM -
Re-examine Cache-control Directives Passive MEDIUM -
Cross-Domain JavaScript Source File Inclusion Passive MEDIUM -
Content-Type Header Missing Passive MEDIUM -
Application Error Disclosure Passive MEDIUM -
Information Disclosure - Debug Error Messages Passive MEDIUM -
Information Disclosure - Sensitive Information in URL Passive MEDIUM -
Information Disclosure - Sensitive Information in HTTP Referrer Header Passive MEDIUM -
Open Redirect Passive MEDIUM -
Cookie Poisoning Passive MEDIUM -
User Controllable Charset Passive MEDIUM -
User Controllable HTML Element Attribute (Potential XSS) Passive MEDIUM -
WSDL File Detection Passive MEDIUM -
Loosely Scoped Cookie Passive MEDIUM -
Viewstate Passive MEDIUM -
Directory Browsing Passive MEDIUM -
Heartbleed OpenSSL Vulnerability (Indicative) Passive MEDIUM -
Strict-Transport-Security Header Passive MEDIUM -
X-Backend-Server Header Information Leak Passive MEDIUM -
Secure Pages Include Mixed Content Passive MEDIUM -
HTTP to HTTPS Insecure Transition in Form Post Passive MEDIUM -
HTTPS to HTTP Insecure Transition in Form Post Passive MEDIUM -
User Controllable JavaScript Event (XSS) Passive MEDIUM -
Big Redirect Detected (Potential Sensitive Information Leak) Passive MEDIUM -
Retrieved from Cache Passive MEDIUM -
X-ChromeLogger-Data (XCOLD) Header Information Leak Passive MEDIUM -
Cookie without SameSite Attribute Passive MEDIUM -
CSP Passive MEDIUM -
X-Debug-Token Information Leak Passive MEDIUM -
Username Hash Found Passive MEDIUM -
X-AspNet-Version Response Header Passive MEDIUM -
PII Disclosure Passive MEDIUM -
Script Passive Scan Rules Passive MEDIUM -
Stats Passive Scan Rule Passive MEDIUM -
Absence of Anti-CSRF Tokens Passive MEDIUM -
Timestamp Disclosure Passive MEDIUM -
Hash Disclosure Passive MEDIUM -
Cross-Domain Misconfiguration Passive MEDIUM -
Weak Authentication Method Passive MEDIUM -
Reverse Tabnabbing Passive MEDIUM -

Sites

http://rest.vulnweb.com

HTTP Response Code Number of Responses
403 Forbidden
10
404 Not Found
559
405 Method Not Allowed
2
200 OK
6134
301 Moved Permanently
312
400 Bad Request
61

No Authentication Statistics Found

Parameter Name Type Flags Times Used # Values

Alert Detail

Medium
Content Security Policy (CSP) Header Not Set
Description
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
URL http://rest.vulnweb.com
Method GET
Parameter
Attack
Evidence
Request Header - size: 207 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/
Method GET
Parameter
Attack
Evidence
Request Header - size: 208 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/docs/
Method GET
Parameter
Attack
Evidence
Request Header - size: 247 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs/%23%7B%7B../section%7D%7D-examples-%7B%7B../id%7D%7D-%7B%7B@index%7D%7D
Method GET
Parameter
Attack
Evidence
Request Header - size: 324 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23api-%7B%7Bgroup%7D%7D
Method GET
Parameter
Attack
Evidence
Request Header - size: 277 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23api-%7B%7Bgroup%7D%7D-%7B%7Bname%7D%7D
Method GET
Parameter
Attack
Evidence
Request Header - size: 294 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23examples-%7B%7B../id%7D%7D-%7B%7B@index%7D%7D
Method GET
Parameter
Attack
Evidence
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%7B%7B%7Bgenerator.url%7D%7D%7D
Method GET
Parameter
Attack
Evidence
Request Header - size: 284 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/article.id%7D%7D-%7B%7Bindex%7D%7D
Method GET
Parameter
Attack
Evidence
Request Header - size: 287 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/each
Method GET
Parameter
Attack
Evidence
Request Header - size: 252 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/each_compare_list_field
Method GET
Parameter
Attack
Evidence
Request Header - size: 271 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/favicon.ico
Method GET
Parameter
Attack
Evidence
Request Header - size: 297 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/id
Method GET
Parameter
Attack
Evidence
Request Header - size: 250 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/if
Method GET
Parameter
Attack
Evidence
Request Header - size: 250 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/if_eq
Method GET
Parameter
Attack
Evidence
Request Header - size: 253 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/robots.txt
Method GET
Parameter
Attack
Evidence
Request Header - size: 218 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/sitemap.xml
Method GET
Parameter
Attack
Evidence
Request Header - size: 219 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/unless
Method GET
Parameter
Attack
Evidence
Request Header - size: 254 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
Instances 18
Solution
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: "Content-Security-Policy" for Chrome 25+, Firefox 23+ and Safari 7+, "X-Content-Security-Policy" for Firefox 4.0+ and Internet Explorer 10+, and "X-WebKit-CSP" for Chrome 14+ and Safari 6+.
Reference https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
http://www.w3.org/TR/CSP/
http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html
http://www.html5rocks.com/en/tutorials/security/content-security-policy/
http://caniuse.com/#feat=contentsecuritypolicy
http://content-security-policy.com/
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 693
WASC Id 15
Plugin Id 10038
Medium
Missing Anti-clickjacking Header
Description
The response does not include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options to protect against 'ClickJacking' attacks.
URL http://rest.vulnweb.com
Method GET
Parameter X-Frame-Options
Attack
Evidence
Request Header - size: 207 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/
Method GET
Parameter X-Frame-Options
Attack
Evidence
Request Header - size: 208 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/docs/
Method GET
Parameter X-Frame-Options
Attack
Evidence
Request Header - size: 247 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
Instances 3
Solution
Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.

If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's "frame-ancestors" directive.
Reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
Tags OWASP_2021_A05
WSTG-v42-CLNT-09
OWASP_2017_A06
CWE Id 1021
WASC Id 15
Plugin Id 10020
Medium
Vulnerable JS Library
Description
The identified library jquery, version 2.2.1 is vulnerable.
URL http://rest.vulnweb.com/docs/vendor/bootstrap.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence * Bootstrap v3.3.7
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 37,051 bytes.
URL http://rest.vulnweb.com/docs/vendor/handlebars.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence /*! handlebars v4.0.5
Request Header - size: 314 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 72,642 bytes.
URL http://rest.vulnweb.com/docs/vendor/jquery.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence /*! jQuery v2.2.1
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 85,634 bytes.
Instances 3
Solution
Please upgrade to the latest version of jquery.
Reference https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
http://research.insecurelabs.org/jquery/test/
https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
https://nvd.nist.gov/vuln/detail/CVE-2019-11358
https://nvd.nist.gov/vuln/detail/CVE-2015-9251
https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
Tags CVE-2020-11023 =
OWASP_2017_A09
CVE-2020-11022 =
OWASP_2021_A06
CVE-2015-9251 =
CVE-2019-11358 =
CWE Id 829
WASC Id
Plugin Id 10003
Low
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
Description
The web/application server is leaking information via one or more "X-Powered-By" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to.
URL http://rest.vulnweb.com
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 207 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 208 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/docs/
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 247 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs/%23%7B%7B../section%7D%7D-examples-%7B%7B../id%7D%7D-%7B%7B@index%7D%7D
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 324 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23api-%7B%7Bgroup%7D%7D
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 277 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23api-%7B%7Bgroup%7D%7D-%7B%7Bname%7D%7D
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 294 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23examples-%7B%7B../id%7D%7D-%7B%7B@index%7D%7D
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%7B%7B%7Bgenerator.url%7D%7D%7D
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 284 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/article.id%7D%7D-%7B%7Bindex%7D%7D
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 287 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/each
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 252 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/each_compare_list_field
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 271 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/favicon.ico
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 297 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/id
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 250 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/if
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 250 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/if_eq
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 253 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/robots.txt
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 218 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/sitemap.xml
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 219 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/unless
Method GET
Parameter
Attack
Evidence X-Powered-By: PHP/7.1.26
Request Header - size: 254 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
Instances 18
Solution
Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-Powered-By" headers.
Reference http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx
http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
Tags OWASP_2021_A01
WSTG-v42-INFO-08
OWASP_2017_A03
CWE Id 200
WASC Id 13
Plugin Id 10037
Low
Server Leaks Version Information via "Server" HTTP Response Header Field
Description
The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
URL http://rest.vulnweb.com
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 207 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 208 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/docs/
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 247 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs/%23%7B%7B../section%7D%7D-examples-%7B%7B../id%7D%7D-%7B%7B@index%7D%7D
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 324 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23api-%7B%7Bgroup%7D%7D
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 277 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23api-%7B%7Bgroup%7D%7D-%7B%7Bname%7D%7D
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 294 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%23examples-%7B%7B../id%7D%7D-%7B%7B@index%7D%7D
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/%7B%7B%7Bgenerator.url%7D%7D%7D
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 284 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/api_data.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 25,875 bytes.
URL http://rest.vulnweb.com/docs/api_project.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 304 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 9,123 bytes.
URL http://rest.vulnweb.com/docs/article.id%7D%7D-%7B%7Bindex%7D%7D
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 287 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css/style.css
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 266 bytes.
Request Body - size: 0 bytes.
Response Header - size: 254 bytes.
Response Body - size: 11,514 bytes.
URL http://rest.vulnweb.com/docs/img/favicon.ico
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 268 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 894 bytes.
URL http://rest.vulnweb.com/docs/locales/ca.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,250 bytes.
URL http://rest.vulnweb.com/docs/locales/cs.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,271 bytes.
URL http://rest.vulnweb.com/docs/locales/de.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,259 bytes.
URL http://rest.vulnweb.com/docs/locales/es.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,269 bytes.
URL http://rest.vulnweb.com/docs/locales/fr.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,289 bytes.
URL http://rest.vulnweb.com/docs/locales/it.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,274 bytes.
URL http://rest.vulnweb.com/docs/locales/locale.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 307 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,300 bytes.
URL http://rest.vulnweb.com/docs/locales/nl.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,266 bytes.
URL http://rest.vulnweb.com/docs/locales/pl.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,251 bytes.
URL http://rest.vulnweb.com/docs/locales/pt_br.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 306 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,261 bytes.
URL http://rest.vulnweb.com/docs/locales/ro.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,263 bytes.
URL http://rest.vulnweb.com/docs/locales/ru.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,506 bytes.
URL http://rest.vulnweb.com/docs/locales/tr.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,271 bytes.
URL http://rest.vulnweb.com/docs/locales/vi.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,353 bytes.
URL http://rest.vulnweb.com/docs/locales/zh.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,188 bytes.
URL http://rest.vulnweb.com/docs/locales/zh_cn.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 306 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,211 bytes.
URL http://rest.vulnweb.com/docs/main.js
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 281 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 29,549 bytes.
URL http://rest.vulnweb.com/docs/utils/handlebars_helper.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 316 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 10,634 bytes.
URL http://rest.vulnweb.com/docs/utils/send_sample_request.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 318 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 6,328 bytes.
URL http://rest.vulnweb.com/docs/vendor/bootstrap.min.css
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 277 bytes.
Request Body - size: 0 bytes.
Response Header - size: 256 bytes.
Response Body - size: 121,205 bytes.
URL http://rest.vulnweb.com/docs/vendor/bootstrap.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 37,051 bytes.
URL http://rest.vulnweb.com/docs/vendor/handlebars.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 314 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 72,642 bytes.
URL http://rest.vulnweb.com/docs/vendor/jquery.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 85,634 bytes.
URL http://rest.vulnweb.com/docs/vendor/list.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 308 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 15,953 bytes.
URL http://rest.vulnweb.com/docs/vendor/lodash.custom.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 317 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 19,619 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp/index.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 320 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 5,351 bytes.
URL http://rest.vulnweb.com/docs/vendor/polyfill.js
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 271 bytes.
Request Body - size: 0 bytes.
Response Header - size: 266 bytes.
Response Body - size: 2,996 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify.css
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 272 bytes.
Request Body - size: 0 bytes.
Response Header - size: 252 bytes.
Response Body - size: 2,007 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify/prettify.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 317 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 15,307 bytes.
URL http://rest.vulnweb.com/docs/vendor/require.min.js
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 274 bytes.
Request Body - size: 0 bytes.
Response Header - size: 268 bytes.
Response Body - size: 15,862 bytes.
URL http://rest.vulnweb.com/docs/vendor/semver.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 12,950 bytes.
URL http://rest.vulnweb.com/docs/vendor/webfontloader.js?v=1670998406044
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 12,509 bytes.
URL http://rest.vulnweb.com/each
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 252 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/each_compare_list_field
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 271 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/favicon.ico
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 297 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/id
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 250 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/if
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 250 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/if_eq
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 253 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/robots.txt
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 218 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/sitemap.xml
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 219 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/unless
Method GET
Parameter
Attack
Evidence Apache/2.4.25 (Debian)
Request Header - size: 254 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
Instances 54
Solution
Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.
Reference http://httpd.apache.org/docs/current/mod/core.html#servertokens
http://msdn.microsoft.com/en-us/library/ff648552.aspx#ht_urlscan_007
http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx
http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
Tags OWASP_2021_A05
OWASP_2017_A06
WSTG-v42-INFO-02
CWE Id 200
WASC Id 13
Plugin Id 10036
Low
X-Content-Type-Options Header Missing
Description
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
URL http://rest.vulnweb.com
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 207 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 208 bytes.
Request Body - size: 0 bytes.
Response Header - size: 199 bytes.
Response Body - size: 3,555 bytes.
URL http://rest.vulnweb.com/docs/
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 247 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs/api_data.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 25,875 bytes.
URL http://rest.vulnweb.com/docs/api_project.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 304 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 9,123 bytes.
URL http://rest.vulnweb.com/docs/css/style.css
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 266 bytes.
Request Body - size: 0 bytes.
Response Header - size: 254 bytes.
Response Body - size: 11,514 bytes.
URL http://rest.vulnweb.com/docs/img/favicon.ico
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 268 bytes.
Request Body - size: 0 bytes.
Response Header - size: 244 bytes.
Response Body - size: 894 bytes.
URL http://rest.vulnweb.com/docs/locales/ca.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,250 bytes.
URL http://rest.vulnweb.com/docs/locales/cs.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,271 bytes.
URL http://rest.vulnweb.com/docs/locales/de.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,259 bytes.
URL http://rest.vulnweb.com/docs/locales/es.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,269 bytes.
URL http://rest.vulnweb.com/docs/locales/fr.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,289 bytes.
URL http://rest.vulnweb.com/docs/locales/it.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,274 bytes.
URL http://rest.vulnweb.com/docs/locales/locale.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 307 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,300 bytes.
URL http://rest.vulnweb.com/docs/locales/nl.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,266 bytes.
URL http://rest.vulnweb.com/docs/locales/pl.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,251 bytes.
URL http://rest.vulnweb.com/docs/locales/pt_br.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 306 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,261 bytes.
URL http://rest.vulnweb.com/docs/locales/ro.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,263 bytes.
URL http://rest.vulnweb.com/docs/locales/ru.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,506 bytes.
URL http://rest.vulnweb.com/docs/locales/tr.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,271 bytes.
URL http://rest.vulnweb.com/docs/locales/vi.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,353 bytes.
URL http://rest.vulnweb.com/docs/locales/zh.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,188 bytes.
URL http://rest.vulnweb.com/docs/locales/zh_cn.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 306 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,211 bytes.
URL http://rest.vulnweb.com/docs/main.js
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 281 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 29,549 bytes.
URL http://rest.vulnweb.com/docs/utils/handlebars_helper.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 316 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 10,634 bytes.
URL http://rest.vulnweb.com/docs/utils/send_sample_request.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 318 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 6,328 bytes.
URL http://rest.vulnweb.com/docs/vendor/bootstrap.min.css
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 277 bytes.
Request Body - size: 0 bytes.
Response Header - size: 256 bytes.
Response Body - size: 121,205 bytes.
URL http://rest.vulnweb.com/docs/vendor/bootstrap.min.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 37,051 bytes.
URL http://rest.vulnweb.com/docs/vendor/handlebars.min.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 314 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 72,642 bytes.
URL http://rest.vulnweb.com/docs/vendor/jquery.min.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 85,634 bytes.
URL http://rest.vulnweb.com/docs/vendor/list.min.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 308 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 15,953 bytes.
URL http://rest.vulnweb.com/docs/vendor/lodash.custom.min.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 317 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 19,619 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp/index.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 320 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 5,351 bytes.
URL http://rest.vulnweb.com/docs/vendor/polyfill.js
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 271 bytes.
Request Body - size: 0 bytes.
Response Header - size: 266 bytes.
Response Body - size: 2,996 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify.css
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 272 bytes.
Request Body - size: 0 bytes.
Response Header - size: 252 bytes.
Response Body - size: 2,007 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify/prettify.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 317 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 15,307 bytes.
URL http://rest.vulnweb.com/docs/vendor/require.min.js
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 274 bytes.
Request Body - size: 0 bytes.
Response Header - size: 268 bytes.
Response Body - size: 15,862 bytes.
URL http://rest.vulnweb.com/docs/vendor/semver.min.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 12,950 bytes.
URL http://rest.vulnweb.com/docs/vendor/webfontloader.js?v=1670998406044
Method GET
Parameter X-Content-Type-Options
Attack
Evidence
Request Header - size: 313 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 12,509 bytes.
Instances 39
Solution
Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx
https://owasp.org/www-community/Security_Headers
Tags OWASP_2021_A05
OWASP_2017_A06
CWE Id 693
WASC Id 15
Plugin Id 10021
Informational
Information Disclosure - Suspicious Comments
Description
The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.
URL http://rest.vulnweb.com/docs/api_data.js?v=1670998406044
Method GET
Parameter
Attack
Evidence user
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 25,875 bytes.
URL http://rest.vulnweb.com/docs/api_data.js?v=1670998406044
Method GET
Parameter
Attack
Evidence username
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 25,875 bytes.
URL http://rest.vulnweb.com/docs/api_project.js?v=1670998406044
Method GET
Parameter
Attack
Evidence admin
Request Header - size: 304 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 9,123 bytes.
URL http://rest.vulnweb.com/docs/locales/es.js?v=1670998406044
Method GET
Parameter
Attack
Evidence todo
Request Header - size: 303 bytes.
Request Body - size: 0 bytes.
Response Header - size: 321 bytes.
Response Body - size: 1,269 bytes.
URL http://rest.vulnweb.com/docs/main.js
Method GET
Parameter
Attack
Evidence from
Request Header - size: 281 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 29,549 bytes.
URL http://rest.vulnweb.com/docs/main.js
Method GET
Parameter
Attack
Evidence select
Request Header - size: 281 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 29,549 bytes.
URL http://rest.vulnweb.com/docs/main.js
Method GET
Parameter
Attack
Evidence TODO
Request Header - size: 281 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 29,549 bytes.
URL http://rest.vulnweb.com/docs/main.js
Method GET
Parameter
Attack
Evidence where
Request Header - size: 281 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 29,549 bytes.
URL http://rest.vulnweb.com/docs/utils/send_sample_request.js?v=1670998406044
Method GET
Parameter
Attack
Evidence from
Request Header - size: 318 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 6,328 bytes.
URL http://rest.vulnweb.com/docs/utils/send_sample_request.js?v=1670998406044
Method GET
Parameter
Attack
Evidence user
Request Header - size: 318 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 6,328 bytes.
URL http://rest.vulnweb.com/docs/vendor/handlebars.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence FROM
Request Header - size: 314 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 72,642 bytes.
URL http://rest.vulnweb.com/docs/vendor/jquery.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence db
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 85,634 bytes.
URL http://rest.vulnweb.com/docs/vendor/jquery.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence select
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 85,634 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp/index.js?v=1670998406044
Method GET
Parameter
Attack
Evidence from
Request Header - size: 320 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 5,351 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp/index.js?v=1670998406044
Method GET
Parameter
Attack
Evidence user
Request Header - size: 320 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 5,351 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp/index.js?v=1670998406044
Method GET
Parameter
Attack
Evidence where
Request Header - size: 320 bytes.
Request Body - size: 0 bytes.
Response Header - size: 322 bytes.
Response Body - size: 5,351 bytes.
URL http://rest.vulnweb.com/docs/vendor/polyfill.js
Method GET
Parameter
Attack
Evidence From
Request Header - size: 271 bytes.
Request Body - size: 0 bytes.
Response Header - size: 266 bytes.
Response Body - size: 2,996 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify/prettify.js?v=1670998406044
Method GET
Parameter
Attack
Evidence from
Request Header - size: 317 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 15,307 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify/prettify.js?v=1670998406044
Method GET
Parameter
Attack
Evidence select
Request Header - size: 317 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 15,307 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify/prettify.js?v=1670998406044
Method GET
Parameter
Attack
Evidence where
Request Header - size: 317 bytes.
Request Body - size: 0 bytes.
Response Header - size: 323 bytes.
Response Body - size: 15,307 bytes.
Instances 20
Solution
Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.
Reference
Tags OWASP_2021_A01
OWASP_2017_A03
CWE Id 200
WASC Id 13
Plugin Id 10027
Informational
Modern Web Application
Description
The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
URL http://rest.vulnweb.com/docs/
Method GET
Parameter
Attack
Evidence <script src="vendor/polyfill.js"></script>
Request Header - size: 247 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs/vendor/jquery.min.js?v=1670998406044
Method GET
Parameter
Attack
Evidence <a id='"+u+"'></a>
Request Header - size: 310 bytes.
Request Body - size: 0 bytes.
Response Header - size: 324 bytes.
Response Body - size: 85,634 bytes.
Instances 2
Solution
This is an informational alert and so no changes are required.
Reference
Tags
CWE Id
WASC Id
Plugin Id 10109
Informational
User Agent Fuzzer
Description
Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 210 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 210 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 210 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 222 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 288 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 275 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 238 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 232 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 243 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 296 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 206 bytes.
Request Body - size: 0 bytes.
Response Header - size: 200 bytes.
Response Body - size: 28,674 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 220 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 220 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 220 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 232 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 298 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 285 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 248 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 242 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 253 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 306 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 311 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/css
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 216 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 220 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 220 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 220 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 232 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 298 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 285 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 248 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 242 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 253 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 306 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 311 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/img
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 216 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 251 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 251 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 251 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 263 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 329 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 316 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 279 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 273 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 284 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 337 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 342 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/locales
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 247 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 249 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 249 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 249 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 261 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 327 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 314 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 277 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 271 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 282 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 335 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 340 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/utils
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 245 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 223 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 223 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 223 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 235 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 301 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 288 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 251 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 245 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 256 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 309 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 314 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 219 bytes.
Request Body - size: 0 bytes.
Response Header - size: 181 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 265 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 265 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 265 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 277 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 343 bytes.
Request Body - size: 0 bytes.
Response Header - size: 235 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 330 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 293 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 287 bytes.
Request Body - size: 0 bytes.
Response Header - size: 235 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 298 bytes.
Request Body - size: 0 bytes.
Response Header - size: 235 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 351 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 356 bytes.
Request Body - size: 0 bytes.
Response Header - size: 235 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/path-to-regexp
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 261 bytes.
Request Body - size: 0 bytes.
Response Header - size: 235 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Request Header - size: 259 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Request Header - size: 259 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Request Header - size: 259 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Request Header - size: 271 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Request Header - size: 337 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Request Header - size: 324 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Request Header - size: 287 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Request Header - size: 281 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Request Header - size: 292 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Request Header - size: 345 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Request Header - size: 350 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
URL http://rest.vulnweb.com/docs/vendor/prettify
Method GET
Parameter Header User-Agent
Attack msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Request Header - size: 255 bytes.
Request Body - size: 0 bytes.
Response Header - size: 236 bytes.
Response Body - size: 881 bytes.
Instances 96
Solution
Reference https://owasp.org/wstg
Tags
CWE Id
WASC Id
Plugin Id 10104