REPORT

Risk Level	Number of Alerts
High	0
Medium	2
Low	2
Informational	1

Name	Risk Level	Number of Instances
Content Security Policy (CSP) Header Not Set	Medium	5
Missing Anti-clickjacking Header	Medium	2
Server Leaks Version Information via "Server" HTTP Response Header Field	Low	7
X-Content-Type-Options Header Missing	Low	4
User Agent Fuzzer	Informational	15

Name	Rule Type	Threshold	Strength
Directory Browsing	Active	MEDIUM	MEDIUM
CRLF Injection	Active	MEDIUM	MEDIUM
Path Traversal	Active	MEDIUM	MEDIUM
Remote File Inclusion	Active	MEDIUM	MEDIUM
Parameter Tampering	Active	MEDIUM	MEDIUM
Server Side Include	Active	MEDIUM	MEDIUM
GET for POST	Active	MEDIUM	MEDIUM
Cross Site Scripting (Reflected)	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent)	Active	MEDIUM	MEDIUM
Script Active Scan Rules	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent) - Prime	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent) - Spider	Active	MEDIUM	MEDIUM
SQL Injection	Active	MEDIUM	MEDIUM
SQL Injection - MySQL	Active	MEDIUM	MEDIUM
SQL Injection - Hypersonic SQL	Active	MEDIUM	MEDIUM
SQL Injection - Oracle	Active	MEDIUM	MEDIUM
SQL Injection - PostgreSQL	Active	MEDIUM	MEDIUM
SQL Injection - SQLite	Active	MEDIUM	MEDIUM
Cross Site Scripting (DOM Based)	Active	MEDIUM	MEDIUM
SQL Injection - MsSQL	Active	MEDIUM	MEDIUM
ELMAH Information Leak	Active	MEDIUM	MEDIUM
Trace.axd Information Leak	Active	MEDIUM	MEDIUM
XSLT Injection	Active	MEDIUM	MEDIUM
.htaccess Information Leak	Active	MEDIUM	MEDIUM
.env Information Leak	Active	MEDIUM	MEDIUM
Server Side Code Injection	Active	MEDIUM	MEDIUM
Hidden File Finder	Active	MEDIUM	MEDIUM
Remote OS Command Injection	Active	MEDIUM	MEDIUM
XML External Entity Attack	Active	MEDIUM	MEDIUM
Generic Padding Oracle	Active	MEDIUM	MEDIUM
SOAP Action Spoofing	Active	MEDIUM	MEDIUM
SOAP XML Injection	Active	MEDIUM	MEDIUM
Heartbleed OpenSSL Vulnerability	Active	MEDIUM	MEDIUM
Buffer Overflow	Active	MEDIUM	MEDIUM
Source Code Disclosure - CVE-2012-1823	Active	MEDIUM	MEDIUM
Format String Error	Active	MEDIUM	MEDIUM
Remote Code Execution - CVE-2012-1823	Active	MEDIUM	MEDIUM
Cloud Metadata Potentially Exposed	Active	MEDIUM	MEDIUM
External Redirect	Active	MEDIUM	MEDIUM
Source Code Disclosure - /WEB-INF folder	Active	MEDIUM	MEDIUM
Private IP Disclosure	Passive	MEDIUM	-
Session ID in URL Rewrite	Passive	MEDIUM	-
Insecure JSF ViewState	Passive	MEDIUM	-
Vulnerable JS Library (Powered by Retire.js)	Passive	MEDIUM	-
Charset Mismatch	Passive	MEDIUM	-
Cookie No HttpOnly Flag	Passive	MEDIUM	-
Cookie Without Secure Flag	Passive	MEDIUM	-
Re-examine Cache-control Directives	Passive	MEDIUM	-
Cross-Domain JavaScript Source File Inclusion	Passive	MEDIUM	-
Content-Type Header Missing	Passive	MEDIUM	-
Application Error Disclosure	Passive	MEDIUM	-
Information Disclosure - Debug Error Messages	Passive	MEDIUM	-
Information Disclosure - Sensitive Information in URL	Passive	MEDIUM	-
Information Disclosure - Sensitive Information in HTTP Referrer Header	Passive	MEDIUM	-
Information Disclosure - Suspicious Comments	Passive	MEDIUM	-
Open Redirect	Passive	MEDIUM	-
Cookie Poisoning	Passive	MEDIUM	-
User Controllable Charset	Passive	MEDIUM	-
User Controllable HTML Element Attribute (Potential XSS)	Passive	MEDIUM	-
WSDL File Detection	Passive	MEDIUM	-
Loosely Scoped Cookie	Passive	MEDIUM	-
Viewstate	Passive	MEDIUM	-
Directory Browsing	Passive	MEDIUM	-
Heartbleed OpenSSL Vulnerability (Indicative)	Passive	MEDIUM	-
Strict-Transport-Security Header	Passive	MEDIUM	-
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)	Passive	MEDIUM	-
X-Backend-Server Header Information Leak	Passive	MEDIUM	-
Secure Pages Include Mixed Content	Passive	MEDIUM	-
HTTP to HTTPS Insecure Transition in Form Post	Passive	MEDIUM	-
HTTPS to HTTP Insecure Transition in Form Post	Passive	MEDIUM	-
User Controllable JavaScript Event (XSS)	Passive	MEDIUM	-
Big Redirect Detected (Potential Sensitive Information Leak)	Passive	MEDIUM	-
Retrieved from Cache	Passive	MEDIUM	-
X-ChromeLogger-Data (XCOLD) Header Information Leak	Passive	MEDIUM	-
Cookie without SameSite Attribute	Passive	MEDIUM	-
CSP	Passive	MEDIUM	-
X-Debug-Token Information Leak	Passive	MEDIUM	-
Username Hash Found	Passive	MEDIUM	-
X-AspNet-Version Response Header	Passive	MEDIUM	-
PII Disclosure	Passive	MEDIUM	-
Script Passive Scan Rules	Passive	MEDIUM	-
Stats Passive Scan Rule	Passive	MEDIUM	-
Absence of Anti-CSRF Tokens	Passive	MEDIUM	-
Timestamp Disclosure	Passive	MEDIUM	-
Hash Disclosure	Passive	MEDIUM	-
Cross-Domain Misconfiguration	Passive	MEDIUM	-
Weak Authentication Method	Passive	MEDIUM	-
Reverse Tabnabbing	Passive	MEDIUM	-
Modern Web Application	Passive	MEDIUM	-

Sites

http://www.vulnweb.com

HTTP Response Code	Number of Responses
404 Not Found	134
405 Method Not Allowed	8
200 OK	79

No Authentication Statistics Found

Parameter Name	Type	Flags	Times Used	# Values

Alert Detail

Medium	Content Security Policy (CSP) Header Not Set
Description	Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

URL	http://www.vulnweb.com
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 205 bytes.	GET http://www.vulnweb.com HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 4018 Last-Modified: Tue, 28 Jul 2020 09:20:49 GMT Connection: keep-alive ETag: "5f1fedf1-fb2" Accept-Ranges: bytes
Response Body - size: 4,018 bytes.	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Acunetix Web Vulnerability Scanner - Test websites</title> <style type="text/css"> <!-- @import url("style.css"); --> </style> </head> <body> <center> <br> <a href='https://www.acunetix.com/'><img src='acunetix-logo.png' border='0' alt="Acunetix website security"></a><br><br> <div>Vulnerable test websites for <a href='https://www.acunetix.com/vulnerability-scanner/'>Acunetix Web Vulnerability Scanner</a>.</div> <table id="one-column-emphasis" summary="Acunetix test websites" style="width:60%"> <colgroup> <col> </colgroup> <thead> <tr style="font-size:14px"> <th scope="col"><b>Name</b></th> <th scope="col"><b>URL</b></th> <th scope="col"><b>Technologies</b></th> <th scope="col"><b>Resources</b></th> </tr> </thead> <tbody> <tr style="font-size:14px"> <td>SecurityTweets</td> <td><a href='http://testhtml5.vulnweb.com/'>http://testhtml5.vulnweb.com</a></td> <td>nginx, Python, Flask, CouchDB</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/html5-website-security/'>Review</a> Acunetix HTML5 scanner or <a href='https://www.acunetix.com/vulnerability-scanner/crawling-html5-javascript-websites/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuart</td> <td><a href='http://testphp.vulnweb.com/'>http://testphp.vulnweb.com</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/php-security-scanner/'>Review</a> Acunetix PHP scanner or <a href='https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuforum</td> <td><a href='http://testasp.vulnweb.com/'>http://testasp.vulnweb.com</a></td> <td>IIS, ASP, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/sql-injection/'>Review</a> Acunetix SQL scanner or <a href='https://www.acunetix.com/websitesecurity/sql-injection/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acublog</td> <td><a href='http://testaspnet.vulnweb.com/'>http://testaspnet.vulnweb.com</a></td> <td>IIS, ASP.NET, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/network-vulnerability-scanner/'>Review</a> Acunetix network scanner or <a href='https://www.acunetix.com/blog/articles/network-vulnerability-assessment-gotchas-avoid/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>REST API</td> <td><a href='http://rest.vulnweb.com/'>http://rest.vulnweb.com/</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>Review</a> Acunetix scanner or <a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>learn more</a> on the topic.</td> </tr> </tbody> </table> <div style="background-color:lightgray;width:60%;text-align:center;font-size:14px"> <p style="padding-left:140px;padding-right:140px"><b>Warning</b>: This site hosts intentionally vulnerable web applications. You can use these applications to understand how programming and configuration errors lead to security breaches. We created the site to help you test Acunetix but you may also use it for manual penetration testing or for educational purposes. It will help you learn about vulnerabilities such as SQL Injection, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and many more.</p> </div> </center> </body> </html>
URL	http://www.vulnweb.com/
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 206 bytes.	GET http://www.vulnweb.com/ HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 4018 Last-Modified: Tue, 28 Jul 2020 09:20:49 GMT Connection: keep-alive ETag: "5f1fedf1-fb2" Accept-Ranges: bytes
Response Body - size: 4,018 bytes.	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Acunetix Web Vulnerability Scanner - Test websites</title> <style type="text/css"> <!-- @import url("style.css"); --> </style> </head> <body> <center> <br> <a href='https://www.acunetix.com/'><img src='acunetix-logo.png' border='0' alt="Acunetix website security"></a><br><br> <div>Vulnerable test websites for <a href='https://www.acunetix.com/vulnerability-scanner/'>Acunetix Web Vulnerability Scanner</a>.</div> <table id="one-column-emphasis" summary="Acunetix test websites" style="width:60%"> <colgroup> <col> </colgroup> <thead> <tr style="font-size:14px"> <th scope="col"><b>Name</b></th> <th scope="col"><b>URL</b></th> <th scope="col"><b>Technologies</b></th> <th scope="col"><b>Resources</b></th> </tr> </thead> <tbody> <tr style="font-size:14px"> <td>SecurityTweets</td> <td><a href='http://testhtml5.vulnweb.com/'>http://testhtml5.vulnweb.com</a></td> <td>nginx, Python, Flask, CouchDB</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/html5-website-security/'>Review</a> Acunetix HTML5 scanner or <a href='https://www.acunetix.com/vulnerability-scanner/crawling-html5-javascript-websites/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuart</td> <td><a href='http://testphp.vulnweb.com/'>http://testphp.vulnweb.com</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/php-security-scanner/'>Review</a> Acunetix PHP scanner or <a href='https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuforum</td> <td><a href='http://testasp.vulnweb.com/'>http://testasp.vulnweb.com</a></td> <td>IIS, ASP, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/sql-injection/'>Review</a> Acunetix SQL scanner or <a href='https://www.acunetix.com/websitesecurity/sql-injection/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acublog</td> <td><a href='http://testaspnet.vulnweb.com/'>http://testaspnet.vulnweb.com</a></td> <td>IIS, ASP.NET, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/network-vulnerability-scanner/'>Review</a> Acunetix network scanner or <a href='https://www.acunetix.com/blog/articles/network-vulnerability-assessment-gotchas-avoid/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>REST API</td> <td><a href='http://rest.vulnweb.com/'>http://rest.vulnweb.com/</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>Review</a> Acunetix scanner or <a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>learn more</a> on the topic.</td> </tr> </tbody> </table> <div style="background-color:lightgray;width:60%;text-align:center;font-size:14px"> <p style="padding-left:140px;padding-right:140px"><b>Warning</b>: This site hosts intentionally vulnerable web applications. You can use these applications to understand how programming and configuration errors lead to security breaches. We created the site to help you test Acunetix but you may also use it for manual penetration testing or for educational purposes. It will help you learn about vulnerabilities such as SQL Injection, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and many more.</p> </div> </center> </body> </html>
URL	http://www.vulnweb.com/favicon.ico
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 294 bytes.	GET http://www.vulnweb.com/favicon.ico HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:32:03 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive
Response Body - size: 153 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html>
URL	http://www.vulnweb.com/robots.txt
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 216 bytes.	GET http://www.vulnweb.com/robots.txt HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive
Response Body - size: 153 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html>
URL	http://www.vulnweb.com/sitemap.xml
Method	GET
Parameter
Attack
Evidence
Show / hide Request and Response
Request Header - size: 217 bytes.	GET http://www.vulnweb.com/sitemap.xml HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive
Response Body - size: 153 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html>
Instances	5
Solution	Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: "Content-Security-Policy" for Chrome 25+, Firefox 23+ and Safari 7+, "X-Content-Security-Policy" for Firefox 4.0+ and Internet Explorer 10+, and "X-WebKit-CSP" for Chrome 14+ and Safari 6+.
Reference	https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html http://www.w3.org/TR/CSP/ http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html http://www.html5rocks.com/en/tutorials/security/content-security-policy/ http://caniuse.com/#feat=contentsecuritypolicy http://content-security-policy.com/
Tags	OWASP_2021_A05 OWASP_2017_A06
CWE Id	693
WASC Id	15
Plugin Id	10038

Medium	Missing Anti-clickjacking Header
Description	The response does not include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options to protect against 'ClickJacking' attacks.

URL	http://www.vulnweb.com
Method	GET
Parameter	X-Frame-Options
Attack
Evidence
Show / hide Request and Response
Request Header - size: 205 bytes.	GET http://www.vulnweb.com HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 4018 Last-Modified: Tue, 28 Jul 2020 09:20:49 GMT Connection: keep-alive ETag: "5f1fedf1-fb2" Accept-Ranges: bytes
Response Body - size: 4,018 bytes.	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Acunetix Web Vulnerability Scanner - Test websites</title> <style type="text/css"> <!-- @import url("style.css"); --> </style> </head> <body> <center> <br> <a href='https://www.acunetix.com/'><img src='acunetix-logo.png' border='0' alt="Acunetix website security"></a><br><br> <div>Vulnerable test websites for <a href='https://www.acunetix.com/vulnerability-scanner/'>Acunetix Web Vulnerability Scanner</a>.</div> <table id="one-column-emphasis" summary="Acunetix test websites" style="width:60%"> <colgroup> <col> </colgroup> <thead> <tr style="font-size:14px"> <th scope="col"><b>Name</b></th> <th scope="col"><b>URL</b></th> <th scope="col"><b>Technologies</b></th> <th scope="col"><b>Resources</b></th> </tr> </thead> <tbody> <tr style="font-size:14px"> <td>SecurityTweets</td> <td><a href='http://testhtml5.vulnweb.com/'>http://testhtml5.vulnweb.com</a></td> <td>nginx, Python, Flask, CouchDB</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/html5-website-security/'>Review</a> Acunetix HTML5 scanner or <a href='https://www.acunetix.com/vulnerability-scanner/crawling-html5-javascript-websites/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuart</td> <td><a href='http://testphp.vulnweb.com/'>http://testphp.vulnweb.com</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/php-security-scanner/'>Review</a> Acunetix PHP scanner or <a href='https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuforum</td> <td><a href='http://testasp.vulnweb.com/'>http://testasp.vulnweb.com</a></td> <td>IIS, ASP, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/sql-injection/'>Review</a> Acunetix SQL scanner or <a href='https://www.acunetix.com/websitesecurity/sql-injection/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acublog</td> <td><a href='http://testaspnet.vulnweb.com/'>http://testaspnet.vulnweb.com</a></td> <td>IIS, ASP.NET, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/network-vulnerability-scanner/'>Review</a> Acunetix network scanner or <a href='https://www.acunetix.com/blog/articles/network-vulnerability-assessment-gotchas-avoid/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>REST API</td> <td><a href='http://rest.vulnweb.com/'>http://rest.vulnweb.com/</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>Review</a> Acunetix scanner or <a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>learn more</a> on the topic.</td> </tr> </tbody> </table> <div style="background-color:lightgray;width:60%;text-align:center;font-size:14px"> <p style="padding-left:140px;padding-right:140px"><b>Warning</b>: This site hosts intentionally vulnerable web applications. You can use these applications to understand how programming and configuration errors lead to security breaches. We created the site to help you test Acunetix but you may also use it for manual penetration testing or for educational purposes. It will help you learn about vulnerabilities such as SQL Injection, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and many more.</p> </div> </center> </body> </html>
URL	http://www.vulnweb.com/
Method	GET
Parameter	X-Frame-Options
Attack
Evidence
Show / hide Request and Response
Request Header - size: 206 bytes.	GET http://www.vulnweb.com/ HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 4018 Last-Modified: Tue, 28 Jul 2020 09:20:49 GMT Connection: keep-alive ETag: "5f1fedf1-fb2" Accept-Ranges: bytes
Response Body - size: 4,018 bytes.	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Acunetix Web Vulnerability Scanner - Test websites</title> <style type="text/css"> <!-- @import url("style.css"); --> </style> </head> <body> <center> <br> <a href='https://www.acunetix.com/'><img src='acunetix-logo.png' border='0' alt="Acunetix website security"></a><br><br> <div>Vulnerable test websites for <a href='https://www.acunetix.com/vulnerability-scanner/'>Acunetix Web Vulnerability Scanner</a>.</div> <table id="one-column-emphasis" summary="Acunetix test websites" style="width:60%"> <colgroup> <col> </colgroup> <thead> <tr style="font-size:14px"> <th scope="col"><b>Name</b></th> <th scope="col"><b>URL</b></th> <th scope="col"><b>Technologies</b></th> <th scope="col"><b>Resources</b></th> </tr> </thead> <tbody> <tr style="font-size:14px"> <td>SecurityTweets</td> <td><a href='http://testhtml5.vulnweb.com/'>http://testhtml5.vulnweb.com</a></td> <td>nginx, Python, Flask, CouchDB</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/html5-website-security/'>Review</a> Acunetix HTML5 scanner or <a href='https://www.acunetix.com/vulnerability-scanner/crawling-html5-javascript-websites/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuart</td> <td><a href='http://testphp.vulnweb.com/'>http://testphp.vulnweb.com</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/php-security-scanner/'>Review</a> Acunetix PHP scanner or <a href='https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuforum</td> <td><a href='http://testasp.vulnweb.com/'>http://testasp.vulnweb.com</a></td> <td>IIS, ASP, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/sql-injection/'>Review</a> Acunetix SQL scanner or <a href='https://www.acunetix.com/websitesecurity/sql-injection/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acublog</td> <td><a href='http://testaspnet.vulnweb.com/'>http://testaspnet.vulnweb.com</a></td> <td>IIS, ASP.NET, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/network-vulnerability-scanner/'>Review</a> Acunetix network scanner or <a href='https://www.acunetix.com/blog/articles/network-vulnerability-assessment-gotchas-avoid/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>REST API</td> <td><a href='http://rest.vulnweb.com/'>http://rest.vulnweb.com/</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>Review</a> Acunetix scanner or <a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>learn more</a> on the topic.</td> </tr> </tbody> </table> <div style="background-color:lightgray;width:60%;text-align:center;font-size:14px"> <p style="padding-left:140px;padding-right:140px"><b>Warning</b>: This site hosts intentionally vulnerable web applications. You can use these applications to understand how programming and configuration errors lead to security breaches. We created the site to help you test Acunetix but you may also use it for manual penetration testing or for educational purposes. It will help you learn about vulnerabilities such as SQL Injection, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and many more.</p> </div> </center> </body> </html>
Instances	2
Solution	Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app. If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's "frame-ancestors" directive.
Reference	https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
Tags	OWASP_2021_A05 WSTG-v42-CLNT-09 OWASP_2017_A06
CWE Id	1021
WASC Id	15
Plugin Id	10020

Low	Server Leaks Version Information via "Server" HTTP Response Header Field
Description	The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.

URL	http://www.vulnweb.com
Method	GET
Parameter
Attack
Evidence	nginx/1.19.0
Show / hide Request and Response
Request Header - size: 205 bytes.	GET http://www.vulnweb.com HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 4018 Last-Modified: Tue, 28 Jul 2020 09:20:49 GMT Connection: keep-alive ETag: "5f1fedf1-fb2" Accept-Ranges: bytes
Response Body - size: 4,018 bytes.	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Acunetix Web Vulnerability Scanner - Test websites</title> <style type="text/css"> <!-- @import url("style.css"); --> </style> </head> <body> <center> <br> <a href='https://www.acunetix.com/'><img src='acunetix-logo.png' border='0' alt="Acunetix website security"></a><br><br> <div>Vulnerable test websites for <a href='https://www.acunetix.com/vulnerability-scanner/'>Acunetix Web Vulnerability Scanner</a>.</div> <table id="one-column-emphasis" summary="Acunetix test websites" style="width:60%"> <colgroup> <col> </colgroup> <thead> <tr style="font-size:14px"> <th scope="col"><b>Name</b></th> <th scope="col"><b>URL</b></th> <th scope="col"><b>Technologies</b></th> <th scope="col"><b>Resources</b></th> </tr> </thead> <tbody> <tr style="font-size:14px"> <td>SecurityTweets</td> <td><a href='http://testhtml5.vulnweb.com/'>http://testhtml5.vulnweb.com</a></td> <td>nginx, Python, Flask, CouchDB</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/html5-website-security/'>Review</a> Acunetix HTML5 scanner or <a href='https://www.acunetix.com/vulnerability-scanner/crawling-html5-javascript-websites/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuart</td> <td><a href='http://testphp.vulnweb.com/'>http://testphp.vulnweb.com</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/php-security-scanner/'>Review</a> Acunetix PHP scanner or <a href='https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuforum</td> <td><a href='http://testasp.vulnweb.com/'>http://testasp.vulnweb.com</a></td> <td>IIS, ASP, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/sql-injection/'>Review</a> Acunetix SQL scanner or <a href='https://www.acunetix.com/websitesecurity/sql-injection/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acublog</td> <td><a href='http://testaspnet.vulnweb.com/'>http://testaspnet.vulnweb.com</a></td> <td>IIS, ASP.NET, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/network-vulnerability-scanner/'>Review</a> Acunetix network scanner or <a href='https://www.acunetix.com/blog/articles/network-vulnerability-assessment-gotchas-avoid/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>REST API</td> <td><a href='http://rest.vulnweb.com/'>http://rest.vulnweb.com/</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>Review</a> Acunetix scanner or <a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>learn more</a> on the topic.</td> </tr> </tbody> </table> <div style="background-color:lightgray;width:60%;text-align:center;font-size:14px"> <p style="padding-left:140px;padding-right:140px"><b>Warning</b>: This site hosts intentionally vulnerable web applications. You can use these applications to understand how programming and configuration errors lead to security breaches. We created the site to help you test Acunetix but you may also use it for manual penetration testing or for educational purposes. It will help you learn about vulnerabilities such as SQL Injection, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and many more.</p> </div> </center> </body> </html>
URL	http://www.vulnweb.com/
Method	GET
Parameter
Attack
Evidence	nginx/1.19.0
Show / hide Request and Response
Request Header - size: 206 bytes.	GET http://www.vulnweb.com/ HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 4018 Last-Modified: Tue, 28 Jul 2020 09:20:49 GMT Connection: keep-alive ETag: "5f1fedf1-fb2" Accept-Ranges: bytes
Response Body - size: 4,018 bytes.	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Acunetix Web Vulnerability Scanner - Test websites</title> <style type="text/css"> <!-- @import url("style.css"); --> </style> </head> <body> <center> <br> <a href='https://www.acunetix.com/'><img src='acunetix-logo.png' border='0' alt="Acunetix website security"></a><br><br> <div>Vulnerable test websites for <a href='https://www.acunetix.com/vulnerability-scanner/'>Acunetix Web Vulnerability Scanner</a>.</div> <table id="one-column-emphasis" summary="Acunetix test websites" style="width:60%"> <colgroup> <col> </colgroup> <thead> <tr style="font-size:14px"> <th scope="col"><b>Name</b></th> <th scope="col"><b>URL</b></th> <th scope="col"><b>Technologies</b></th> <th scope="col"><b>Resources</b></th> </tr> </thead> <tbody> <tr style="font-size:14px"> <td>SecurityTweets</td> <td><a href='http://testhtml5.vulnweb.com/'>http://testhtml5.vulnweb.com</a></td> <td>nginx, Python, Flask, CouchDB</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/html5-website-security/'>Review</a> Acunetix HTML5 scanner or <a href='https://www.acunetix.com/vulnerability-scanner/crawling-html5-javascript-websites/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuart</td> <td><a href='http://testphp.vulnweb.com/'>http://testphp.vulnweb.com</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/php-security-scanner/'>Review</a> Acunetix PHP scanner or <a href='https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuforum</td> <td><a href='http://testasp.vulnweb.com/'>http://testasp.vulnweb.com</a></td> <td>IIS, ASP, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/sql-injection/'>Review</a> Acunetix SQL scanner or <a href='https://www.acunetix.com/websitesecurity/sql-injection/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acublog</td> <td><a href='http://testaspnet.vulnweb.com/'>http://testaspnet.vulnweb.com</a></td> <td>IIS, ASP.NET, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/network-vulnerability-scanner/'>Review</a> Acunetix network scanner or <a href='https://www.acunetix.com/blog/articles/network-vulnerability-assessment-gotchas-avoid/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>REST API</td> <td><a href='http://rest.vulnweb.com/'>http://rest.vulnweb.com/</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>Review</a> Acunetix scanner or <a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>learn more</a> on the topic.</td> </tr> </tbody> </table> <div style="background-color:lightgray;width:60%;text-align:center;font-size:14px"> <p style="padding-left:140px;padding-right:140px"><b>Warning</b>: This site hosts intentionally vulnerable web applications. You can use these applications to understand how programming and configuration errors lead to security breaches. We created the site to help you test Acunetix but you may also use it for manual penetration testing or for educational purposes. It will help you learn about vulnerabilities such as SQL Injection, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and many more.</p> </div> </center> </body> </html>
URL	http://www.vulnweb.com/acunetix-logo.png
Method	GET
Parameter
Attack
Evidence	nginx/1.19.0
Show / hide Request and Response
Request Header - size: 256 bytes.	GET http://www.vulnweb.com/acunetix-logo.png HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache Referer: http://www.vulnweb.com
Request Body - size: 0 bytes.
Response Header - size: 240 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: image/png Content-Length: 4474 Last-Modified: Thu, 19 Jun 2014 11:18:40 GMT Connection: keep-alive ETag: "53a2c710-117a" Accept-Ranges: bytes
Response Body - size: 4,474 bytes.	PNG IHDR * '®HsRGB®ÎégAMA±üa pHYs."."ªâÝtEXtSoftwarePaint.NET v3.5.11GóB7éIDATx^í ´EÉ¼$(Ì¸¨ ¢"( ,Ñ#ÁsT@EEePTWQ6Ã"(èQ ëÑo²/Íÿ×=©TnUwõÌ¼`ÿç\|'/3Ý5=Ý}oWÝ{«fZZµ®ÄâóâOâå¢Hë³ÄBñO±§XALµ¦gÿÖªUkz«8IÜ"wØXÄ´ð÷©Ví$jÕ þ,\|C"'ñ aíw³ W2ê¿X0}Î´v£5{b¬µØVìvËØ%{÷V;7Û«V'¤ª:Ãµßcb1êhËàeô;cÄÕbx¼Å5âX1¯Ýh®5W«ÖEUÄ.ÂÚï 1ÕqêNâºkNqo,åR¸_ÌÖ=ZOUu+ßwEâ bªUÍIÈ7gGeð½@çWeW«ÖòªªNÍ?G ²#ÃPá¶Ä![ÞOø5Y3ûøZµ7õâ$FEåÄ &bqKfÀSÉmb¢Ôx£ØW#Î?ßûW+ª¼bb¬ùLñnñ1_p§ÅÅj¢¬hÓ:>¨"«ÉÚ\|ñÔ\|ø¢8U!N\®O¿Åq¼H¼ON?\|ö·Ä®b÷{Ä&ÂÝ\¹n±m E±¶f¸d +ýÄ#Â2â©à1qà¸%;¬~.Üñu1]ÆÅãEÔüU¤£ÿ¤¸VXëó°ø¥ØJpqcâf´ñ×¢®V{O¾Èõs^ým¯¹Vûõ]sîO½êgô/a}ÙÅ;DÔãóû]Ùßjw±p·£&ÂÕ¶Â}?F.mam»²âhµQÑZYÆyc¬Ãf~»ÑìG è)âûâQa]Ä8ç.õþÕ¢¸ép:w «2ðä{º¸µßoEQùgµÇùôÅ0Ñ:¿7 ´© ïï¿ã®:ülË<,þ&61á$¬}àpµ°¶ûpµ£9"+ºHÛP_ááF{Vk%%ñËXÉ í±9½<Q^nÖI)Ë¿EÈË8 nôóµ·-¥Qu¯÷:¯¥p 7"÷ïÂj/GÄ!ciªÌß k[8VÄÄPâlaí{¹à{ÚN¤ñÏ8G£Ú³æuµ-qsöòäv¡«g½^ä$Ö×kßª<(xªøE'q(ÓÕq(u_OX%Î½ÀÄªëj'êz8µÍEHûk¿Ä²Ï³êHâé¡½@½9éÞYïÇ9 ÜÚÏ\|G[Û¸pa_#\¢è<Ñô,A,ÉÚ?n9©~°äo^³¶uùðTÃp$±kÇÖ y(ôakY'Ñkm(,S19lÒ±Mè6t³NHÆÍÉáB³=1¢î¤«¾,èÖ[ûùÄ9oknNJréñð`XE ±%=nÐøþ#Ü1ûòà$nßdu^+Ú}T#bÎÜý®¾8o k_ úNaEï1wk_à:Ì®è%\Ì 9ó»Ý«T'Xû:_dÍ¬m~¸ ¥Äx£µïbÏG+ÚcÍâÍd4Û:!ÞOu_Ä´Úp 9µ}Îiâi¢H¤A!½Ry8¶\£î$xrÏ!z&aí¤¬CbÆ¤µÐ[°22¾xX/¬6ËÍW¨â$°Ê¶ýÿ¸î×ëaCïymáji»ÑíãáòãªøÒÙýÿþÓ H_V[9 [ëÉL±l$îùþ<u_(\|² î£¨ÑÇ6 XÂbOnÑÁ×å'Âj¸v!M¥@îikß ÄÐÃºqV\kÉ¹k6ep·{¸<°PÇNÍBH\Dÿä¸c¯qÂöÀr±^iÌAØ·V1'7ªNãIòüaµCìÈêIR#`mO¯ñù"UMrT{B½©vèSÂÚ¨aèa½w°ä:ÖAñõÅuâ¢ÙkÖ¶½ÀpÂÆ VþAT1N°bÕ®å$XxÄÚ,VçP¤¼°+¤Quo)zªæ!ùbõ'k[ÆáUE Üjvá$cqo[û/d¬×gKN¢=Ö!CëWÉ5ÅÎb;££ú,z,óÄù¢_»Û¦5¶åbø'$ÑBsþ}'AµíÑbE'Ák}ªB©~F^e(àI<L¨ [COáa8 ã,ªbÍ¡úóÕ"¤I'!#ÛÉ3ºªLæY>¡'«¯ m·×gûöÊ{²¦]WrzÜ$³bµí; Òp¡Ä §þ¢ âÑ¥ê\á·[ W[k;à³6T%ä\|®å$ÐÂjÃç S×Ié\.P/aH¯ÁJÖbUÙË]iÕ´ïy^[U xçëHaªFâÈ7µ ~Û¾ ìoÜpu©Qt7"#á·¾(kýÌU<L'AöçÂj'çbQô°>MÝôì>ÏàR¹DÆÞíîË1àx¶g;Ó¾ F`ôt±¹;Ñ¾3õÚÕvY©?ÊÊìUô(ÏöÛöùvà©VSèU£è$ò¹©ë$Hg[Û zVliNÙ uyÀ±"w¦cÌ[zÆÊ=.uGãNçd7à4Qw#Óú{m½v§³M¬âT¼Ä´à^à©è·];I ËI0[ÔÚnÐXÔa; z7 «-z²Û"uÄþ¡¥Â4çÆÇ:ÅXçzïÇ8KN¥k(úÿ^Þû©PLä .Ö bi°^ÅV Ëw¡12Oi¢Âúl&UÑòà$Þ/¬íÍ(:ÐªÛ9ÄY²k'qªgh)Ü¥@7u¢ÿâ½_²ÝYe,ËÞû)0sÀR¦R3&J§¶}'Á´òPàúAõ2¬Ï¥2¯B¥FÉIb@@à °4L'+(samX ¹ã$.ó-léH¾¦þÿ÷~î£¡ä¹#ýÿhïýü(3s¬©¹z_[íúN(´nB?b#1±²õ¹ôRW{âYFÏkV[Ãr¤C5ÖAPë8ÆÔ«àZÍUr!RÇIÜìZ ïÍ¢=¼÷R` ±ôw/éØ;®Ñr½:é7e¾\|T" t¿°Úõb¡µ-ÆJO£ª²#\|ÿÐq¦:I®ÕFo6,'.Ö¶ô ª^sº2FmÇN"¦^ÇÈJSÖþLj³^§V"Ô»é8<CK¡;S³´¾µMX ¸#ýÍ÷XÛáþFÔ¤+Ö´N°RQªÑE³ÚËIÄz4Ì¬R³¦êó»ÂÔå4õ¹Ì,û¹´OUÕ?ÄË5L'ñamü¦Eq®8fl®Å%Ä:Ö1\|SÄÔ`µ/%ü<TXaËzbweleéÖÁëï³¼÷R`ñÑdäÏ6Þ/Ë"íïÁ;ëf^'¯^V8ªë¬¶r,'Aï&¶¿¦8 ÆÝnÃ¬ÐÒjîg¹PGRôtä¸B©dØMX¦ ÞâQHÇ="Î)cJþEQv ¾ûÙ9ôncÃªN¶µ ×!/ÜcÝÓÐpá¯_é8^ÇYÖíâ½·#ý½÷^ @±Y\|1+øæE:BU.@¡é¹9dXE)&Fiqq#ðó'»qÜ¡¢Nj;Ökb&jhõîa: ËrpÜe[ôø?Ã£Õ¸ýà/"´w'A!}¢7íê;ÂÚû³;ôÏÔqÔ9XWîÔRýÍÚÖ6e Ôþ~÷^ ú.«[ÞCq§V[PtÂâ'ÔZpcÐ5#^À,KzaZ Uæ06d.S¿YlcÃSbêæÐ¥´«(YÛçPçOolÐÞ7dh®BNlþ°±Ã hõdéñÒbù¶#Dh"Ð#°¦è» ÅGóÎ×°¥: þ§k ÑMdbXÁëÖöô´ÜïÔqWyk+t¤¿×UÝ_,ºÅXúû@ç½Tb%¿{ØJG.Ü@¡.Y1'AÙzlµ#·ì1sÃ²È¯%G(hUËD,<l'0tj¬ý\x0s§ÂÅc¬×ïØÄ¨\ë"gËz©n03ÕIzM\|&µYb©Ðwt×í8_yBw¾D¶x.%×Öv1ø®¬¨ÒFÕe1Ð²nÜÐÕ´^9 WMe® 79«8Å);3°Ö,Â'è öÛA²ü@ÑÐÐõ0EKùEäJq/¡VQÞ£µäétÄ¡¥°Tå¢Z¶·MÚg©1´^ëÅiucñC+UsÏ¡Hu÷"Ã,zZ)ÔùÊÆEb(ÕëÊÑd9+4*NÑ =Rø¨2Õß!àiµÉ²qnl§¬`¾÷µ-½ê¢9?M`/\»É¡±-+C7+KFOvâJo;Ëµí2½Î¼kû2ýÕ"²2¤S®?q¼×çaIL§êoðô8X¤Eçàº¥ö¨øîÀB«0ù%'Èâ(» ±ùH¦ÖJ¸"@LïÛ¿ïö®Ê:Pzö¥è,1·Ú(s©+ãªºøéµeÔn4Õù9q³mÎâá×3t¤×÷Î¶KEß¡I4¹¬0R<%ËÇu Zêfs$ÆùÔø.Lc?V6b,ËB6Á®^V´BÏðB]Õ2Üe{+¹V1¶õÏÆ^E_ý¶ hå,¿Æ¯(îD ªI©æýZQüFÐ¤2ÒO³õ] ¤æ¢jÓÚÈ^3V;p8?åa²Jex1Ë(I-]M4LøÚ@l/¶CZ¿=sÉ.KÖZÚ¶ÊþÏXÍÏñ7uÜ<L#AÙ5ëÒE/ûôìUÖëÇA/ÍqàXþó]õ;Äwçw(Yþºà»³<;ëÒEÄõx²s}Éèç\|«p³´l%ì^Åuä¼û+k&2°ÍDjfw RÛzUµÔ!ÔªU«¿tü¬¿l_QvØqa{¬9°'L{¬5]q÷1Nr±©U«Vß´¤d\|v5'wE«T6ÞhY¿ØWésfù"æ¸uz´Ö «UëÿUKD.Ý:â0q`2Su'¶hÏä0miM4ÏæÙgsKòsl_Ý"¬Zµj BÓ¦ÿûóáRÑáIEND®B`
URL	http://www.vulnweb.com/favicon.ico
Method	GET
Parameter
Attack
Evidence	nginx/1.19.0
Show / hide Request and Response
Request Header - size: 294 bytes.	GET http://www.vulnweb.com/favicon.ico HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:32:03 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive
Response Body - size: 153 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html>
URL	http://www.vulnweb.com/robots.txt
Method	GET
Parameter
Attack
Evidence	nginx/1.19.0
Show / hide Request and Response
Request Header - size: 216 bytes.	GET http://www.vulnweb.com/robots.txt HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive
Response Body - size: 153 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html>
URL	http://www.vulnweb.com/sitemap.xml
Method	GET
Parameter
Attack
Evidence	nginx/1.19.0
Show / hide Request and Response
Request Header - size: 217 bytes.	GET http://www.vulnweb.com/sitemap.xml HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive
Response Body - size: 153 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html>
URL	http://www.vulnweb.com/style.css
Method	GET
Parameter
Attack
Evidence	nginx/1.19.0
Show / hide Request and Response
Request Header - size: 285 bytes.	GET http://www.vulnweb.com/style.css HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:32:03 GMT Content-Type: text/css Content-Length: 9894 Last-Modified: Thu, 19 Jun 2014 11:13:14 GMT Connection: keep-alive ETag: "53a2c5ca-26a6" Accept-Ranges: bytes
Response Body - size: 9,894 bytes.	/* ------------------ styling for the tables ------------------ / body { line-height: 1.6em; } .acunetix-title { font-size: 20px; padding: 12px 15px; color: #039; } #hor-minimalist-a { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; background: #fff; margin: 45px; width: 480px; border-collapse: collapse; text-align: left; } #hor-minimalist-a th { font-size: 14px; font-weight: normal; color: #039; padding: 10px 8px; border-bottom: 2px solid #6678b1; } #hor-minimalist-a td { color: #669; padding: 9px 8px 0px 8px; } #hor-minimalist-a tbody tr:hover td { color: #009; } #hor-minimalist-b { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; background: #fff; margin: 45px; width: 480px; border-collapse: collapse; text-align: left; } #hor-minimalist-b th { font-size: 14px; font-weight: normal; color: #039; padding: 10px 8px; border-bottom: 2px solid #6678b1; } #hor-minimalist-b td { border-bottom: 1px solid #ccc; color: #669; padding: 6px 8px; } #hor-minimalist-b tbody tr:hover td { color: #009; } #ver-minimalist { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #ver-minimalist th { padding: 8px 2px; font-weight: normal; font-size: 14px; border-bottom: 2px solid #6678b1; border-right: 30px solid #fff; border-left: 30px solid #fff; color: #039; } #ver-minimalist td { padding: 12px 2px 0px 2px; border-right: 30px solid #fff; border-left: 30px solid #fff; color: #669; } #box-table-a { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #box-table-a th { font-size: 13px; font-weight: normal; padding: 8px; background: #b9c9fe; border-top: 4px solid #aabcfe; border-bottom: 1px solid #fff; color: #039; } #box-table-a td { padding: 8px; background: #e8edff; border-bottom: 1px solid #fff; color: #669; border-top: 1px solid transparent; } #box-table-a tr:hover td { background: #d0dafd; color: #339; } #box-table-b { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: center; border-collapse: collapse; border-top: 7px solid #9baff1; border-bottom: 7px solid #9baff1; } #box-table-b th { font-size: 13px; font-weight: normal; padding: 8px; background: #e8edff; border-right: 1px solid #9baff1; border-left: 1px solid #9baff1; color: #039; } #box-table-b td { padding: 8px; background: #e8edff; border-right: 1px solid #aabcfe; border-left: 1px solid #aabcfe; color: #669; } #hor-zebra { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #hor-zebra th { font-size: 14px; font-weight: normal; padding: 10px 8px; color: #039; } #hor-zebra td { padding: 8px; color: #669; } #hor-zebra .odd { background: #e8edff; } #ver-zebra { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #ver-zebra th { font-size: 14px; font-weight: normal; padding: 12px 15px; border-right: 1px solid #fff; border-left: 1px solid #fff; color: #039; } #ver-zebra td { padding: 8px 15px; border-right: 1px solid #fff; border-left: 1px solid #fff; color: #669; } .vzebra-odd { background: #eff2ff; } .vzebra-even { background: #e8edff; } #ver-zebra #vzebra-adventure, #ver-zebra #vzebra-children { background: #d0dafd; border-bottom: 1px solid #c8d4fd; } #ver-zebra #vzebra-comedy, #ver-zebra #vzebra-action { background: #dce4ff; border-bottom: 1px solid #d6dfff; } #one-column-emphasis { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 650px; text-align: left; border-collapse: collapse; } #one-column-emphasis th { font-size: 14px; font-weight: normal; padding: 12px 15px; color: #039; } #one-column-emphasis td { padding: 10px 15px; color: #669; border-top: 1px solid #e8edff; } .oce-first { background: #d0dafd; border-right: 10px solid transparent; border-left: 10px solid transparent; } #one-column-emphasis tr:hover td { color: #339; background: #eff2ff; } #newspaper-a { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; border: 1px solid #69c; } #newspaper-a th { padding: 12px 17px 12px 17px; font-weight: normal; font-size: 14px; color: #039; border-bottom: 1px dashed #69c; } #newspaper-a td { padding: 7px 17px 7px 17px; color: #669; } #newspaper-a tbody tr:hover td { color: #339; background: #d0dafd; } #newspaper-b { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; border: 1px solid #69c; } #newspaper-b th { padding: 15px 10px 10px 10px; font-weight: normal; font-size: 14px; color: #039; } #newspaper-b tbody { background: #e8edff; } #newspaper-b td { padding: 10px; color: #669; border-top: 1px dashed #fff; } #newspaper-b tbody tr:hover td { color: #339; background: #d0dafd; } #newspaper-c { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; border: 1px solid #6cf; } #newspaper-c th { padding: 20px; font-weight: normal; font-size: 13px; color: #039; text-transform: uppercase; border-right: 1px solid #0865c2; border-top: 1px solid #0865c2; border-left: 1px solid #0865c2; border-bottom: 1px solid #fff; } #newspaper-c td { padding: 10px 20px; color: #669; border-right: 1px dashed #6cf; } #rounded-corner { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #rounded-corner thead th.rounded-company { background: #b9c9fe url('table-images/left.png') left -1px no-repeat; } #rounded-corner thead th.rounded-q4 { background: #b9c9fe url('table-images/right.png') right -1px no-repeat; } #rounded-corner th { padding: 8px; font-weight: normal; font-size: 13px; color: #039; background: #b9c9fe; } #rounded-corner td { padding: 8px; background: #e8edff; border-top: 1px solid #fff; color: #669; } #rounded-corner tfoot td.rounded-foot-left { background: #e8edff url('table-images/botleft.png') left bottom no-repeat; } #rounded-corner tfoot td.rounded-foot-right { background: #e8edff url('table-images/botright.png') right bottom no-repeat; } #rounded-corner tbody tr:hover td { background: #d0dafd; } #background-image { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; background: url('table-images/blurry.jpg') 330px 59px no-repeat; } #background-image th { padding: 12px; font-weight: normal; font-size: 14px; color: #339; } #background-image td { padding: 9px 12px; color: #669; border-top: 1px solid #fff; } #background-image tfoot td { font-size: 11px; } #background-image tbody td { background: url('table-images/back.png'); } html #background-image tbody td { /* ---------------------------- PUT THIS ON IE6 ONLY STYLE AS THE RULE INVALIDATES YOUR STYLESHEET ---------------------------- */ filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='table-images/back.png',sizingMethod='crop'); background: none; } #background-image tbody tr:hover td { color: #339; background: none; } #gradient-style { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #gradient-style th { font-size: 13px; font-weight: normal; padding: 8px; background: #b9c9fe url('table-images/gradhead.png') repeat-x; border-top: 2px solid #d3ddff; border-bottom: 1px solid #fff; color: #039; } #gradient-style td { padding: 8px; border-bottom: 1px solid #fff; color: #669; border-top: 1px solid #fff; background: #e8edff url('table-images/gradback.png') repeat-x; } #gradient-style tfoot tr td { background: #e8edff; font-size: 12px; color: #99c; } #gradient-style tbody tr:hover td { background: #d0dafd url('table-images/gradhover.png') repeat-x; color: #339; } #pattern-style-a { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; background: url('table-images/pattern.png'); } #pattern-style-a thead tr { background: url('table-images/pattern-head.png'); } #pattern-style-a th { font-size: 13px; font-weight: normal; padding: 8px; border-bottom: 1px solid #fff; color: #039; } #pattern-style-a td { padding: 8px; border-bottom: 1px solid #fff; color: #669; border-top: 1px solid transparent; } #pattern-style-a tbody tr:hover td { color: #339; background: #fff; } #pattern-style-b { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; background: url('table-images/patternb.png'); } #pattern-style-b thead tr { background: url('table-images/patternb-head.png'); } #pattern-style-b th { font-size: 13px; font-weight: normal; padding: 8px; border-bottom: 1px solid #fff; color: #039; } #pattern-style-b td { padding: 8px; border-bottom: 1px solid #fff; color: #669; border-top: 1px solid transparent; } #pattern-style-b tbody tr:hover td { color: #339; background: #cdcdee; }
Instances	7
Solution	Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.
Reference	http://httpd.apache.org/docs/current/mod/core.html#servertokens http://msdn.microsoft.com/en-us/library/ff648552.aspx#ht_urlscan_007 http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
Tags	OWASP_2021_A05 OWASP_2017_A06 WSTG-v42-INFO-02
CWE Id	200
WASC Id	13
Plugin Id	10036

Low	X-Content-Type-Options Header Missing
Description	The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URL	http://www.vulnweb.com
Method	GET
Parameter	X-Content-Type-Options
Attack
Evidence
Show / hide Request and Response
Request Header - size: 205 bytes.	GET http://www.vulnweb.com HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 4018 Last-Modified: Tue, 28 Jul 2020 09:20:49 GMT Connection: keep-alive ETag: "5f1fedf1-fb2" Accept-Ranges: bytes
Response Body - size: 4,018 bytes.	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Acunetix Web Vulnerability Scanner - Test websites</title> <style type="text/css"> <!-- @import url("style.css"); --> </style> </head> <body> <center> <br> <a href='https://www.acunetix.com/'><img src='acunetix-logo.png' border='0' alt="Acunetix website security"></a><br><br> <div>Vulnerable test websites for <a href='https://www.acunetix.com/vulnerability-scanner/'>Acunetix Web Vulnerability Scanner</a>.</div> <table id="one-column-emphasis" summary="Acunetix test websites" style="width:60%"> <colgroup> <col> </colgroup> <thead> <tr style="font-size:14px"> <th scope="col"><b>Name</b></th> <th scope="col"><b>URL</b></th> <th scope="col"><b>Technologies</b></th> <th scope="col"><b>Resources</b></th> </tr> </thead> <tbody> <tr style="font-size:14px"> <td>SecurityTweets</td> <td><a href='http://testhtml5.vulnweb.com/'>http://testhtml5.vulnweb.com</a></td> <td>nginx, Python, Flask, CouchDB</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/html5-website-security/'>Review</a> Acunetix HTML5 scanner or <a href='https://www.acunetix.com/vulnerability-scanner/crawling-html5-javascript-websites/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuart</td> <td><a href='http://testphp.vulnweb.com/'>http://testphp.vulnweb.com</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/php-security-scanner/'>Review</a> Acunetix PHP scanner or <a href='https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuforum</td> <td><a href='http://testasp.vulnweb.com/'>http://testasp.vulnweb.com</a></td> <td>IIS, ASP, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/sql-injection/'>Review</a> Acunetix SQL scanner or <a href='https://www.acunetix.com/websitesecurity/sql-injection/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acublog</td> <td><a href='http://testaspnet.vulnweb.com/'>http://testaspnet.vulnweb.com</a></td> <td>IIS, ASP.NET, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/network-vulnerability-scanner/'>Review</a> Acunetix network scanner or <a href='https://www.acunetix.com/blog/articles/network-vulnerability-assessment-gotchas-avoid/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>REST API</td> <td><a href='http://rest.vulnweb.com/'>http://rest.vulnweb.com/</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>Review</a> Acunetix scanner or <a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>learn more</a> on the topic.</td> </tr> </tbody> </table> <div style="background-color:lightgray;width:60%;text-align:center;font-size:14px"> <p style="padding-left:140px;padding-right:140px"><b>Warning</b>: This site hosts intentionally vulnerable web applications. You can use these applications to understand how programming and configuration errors lead to security breaches. We created the site to help you test Acunetix but you may also use it for manual penetration testing or for educational purposes. It will help you learn about vulnerabilities such as SQL Injection, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and many more.</p> </div> </center> </body> </html>
URL	http://www.vulnweb.com/
Method	GET
Parameter	X-Content-Type-Options
Attack
Evidence
Show / hide Request and Response
Request Header - size: 206 bytes.	GET http://www.vulnweb.com/ HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: text/html Content-Length: 4018 Last-Modified: Tue, 28 Jul 2020 09:20:49 GMT Connection: keep-alive ETag: "5f1fedf1-fb2" Accept-Ranges: bytes
Response Body - size: 4,018 bytes.	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Acunetix Web Vulnerability Scanner - Test websites</title> <style type="text/css"> <!-- @import url("style.css"); --> </style> </head> <body> <center> <br> <a href='https://www.acunetix.com/'><img src='acunetix-logo.png' border='0' alt="Acunetix website security"></a><br><br> <div>Vulnerable test websites for <a href='https://www.acunetix.com/vulnerability-scanner/'>Acunetix Web Vulnerability Scanner</a>.</div> <table id="one-column-emphasis" summary="Acunetix test websites" style="width:60%"> <colgroup> <col> </colgroup> <thead> <tr style="font-size:14px"> <th scope="col"><b>Name</b></th> <th scope="col"><b>URL</b></th> <th scope="col"><b>Technologies</b></th> <th scope="col"><b>Resources</b></th> </tr> </thead> <tbody> <tr style="font-size:14px"> <td>SecurityTweets</td> <td><a href='http://testhtml5.vulnweb.com/'>http://testhtml5.vulnweb.com</a></td> <td>nginx, Python, Flask, CouchDB</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/html5-website-security/'>Review</a> Acunetix HTML5 scanner or <a href='https://www.acunetix.com/vulnerability-scanner/crawling-html5-javascript-websites/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuart</td> <td><a href='http://testphp.vulnweb.com/'>http://testphp.vulnweb.com</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/php-security-scanner/'>Review</a> Acunetix PHP scanner or <a href='https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acuforum</td> <td><a href='http://testasp.vulnweb.com/'>http://testasp.vulnweb.com</a></td> <td>IIS, ASP, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/sql-injection/'>Review</a> Acunetix SQL scanner or <a href='https://www.acunetix.com/websitesecurity/sql-injection/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>Acublog</td> <td><a href='http://testaspnet.vulnweb.com/'>http://testaspnet.vulnweb.com</a></td> <td>IIS, ASP.NET, Microsoft SQL Server</td> <td><a href='https://www.acunetix.com/vulnerability-scanner/network-vulnerability-scanner/'>Review</a> Acunetix network scanner or <a href='https://www.acunetix.com/blog/articles/network-vulnerability-assessment-gotchas-avoid/'>learn more</a> on the topic.</td> </tr> <tr style="font-size:14px"> <td>REST API</td> <td><a href='http://rest.vulnweb.com/'>http://rest.vulnweb.com/</a></td> <td>Apache, PHP, MySQL</td> <td><a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>Review</a> Acunetix scanner or <a href='https://www.acunetix.com/blog/articles/rest-api-security-testing-acunetix/'>learn more</a> on the topic.</td> </tr> </tbody> </table> <div style="background-color:lightgray;width:60%;text-align:center;font-size:14px"> <p style="padding-left:140px;padding-right:140px"><b>Warning</b>: This site hosts intentionally vulnerable web applications. You can use these applications to understand how programming and configuration errors lead to security breaches. We created the site to help you test Acunetix but you may also use it for manual penetration testing or for educational purposes. It will help you learn about vulnerabilities such as SQL Injection, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), and many more.</p> </div> </center> </body> </html>
URL	http://www.vulnweb.com/acunetix-logo.png
Method	GET
Parameter	X-Content-Type-Options
Attack
Evidence
Show / hide Request and Response
Request Header - size: 256 bytes.	GET http://www.vulnweb.com/acunetix-logo.png HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; x64; rv:105.0esr) Gecko/20010101 Firefox/105.0esr Pragma: no-cache Cache-Control: no-cache Referer: http://www.vulnweb.com
Request Body - size: 0 bytes.
Response Header - size: 240 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:31:55 GMT Content-Type: image/png Content-Length: 4474 Last-Modified: Thu, 19 Jun 2014 11:18:40 GMT Connection: keep-alive ETag: "53a2c710-117a" Accept-Ranges: bytes
Response Body - size: 4,474 bytes.	PNG IHDR * '®HsRGB®ÎégAMA±üa pHYs."."ªâÝtEXtSoftwarePaint.NET v3.5.11GóB7éIDATx^í ´EÉ¼$(Ì¸¨ ¢"( ,Ñ#ÁsT@EEePTWQ6Ã"(èQ ëÑo²/Íÿ×=©TnUwõÌ¼`ÿç\|'/3Ý5=Ý}oWÝ{«fZZµ®ÄâóâOâå¢Hë³ÄBñO±§XALµ¦gÿÖªUkz«8IÜ"wØXÄ´ð÷©Ví$jÕ þ,\|C"'ñ aíw³ W2ê¿X0}Î´v£5{b¬µØVìvËØ%{÷V;7Û«V'¤ª:Ãµßcb1êhËàeô;cÄÕbx¼Å5âX1¯Ýh®5W«ÖEUÄ.ÂÚï 1ÕqêNâºkNqo,åR¸_ÌÖ=ZOUu+ßwEâ bªUÍIÈ7gGeð½@çWeW«ÖòªªNÍ?G ²#ÃPá¶Ä![ÞOø5Y3ûøZµ7õâ$FEåÄ &bqKfÀSÉmb¢Ôx£ØW#Î?ßûW+ª¼bb¬ùLñnñ1_p§ÅÅj¢¬hÓ:>¨"«ÉÚ\|ñÔ\|ø¢8U!N\®O¿Åq¼H¼ON?\|ö·Ä®b÷{Ä&ÂÝ\¹n±m E±¶f¸d +ýÄ#Â2â©à1qà¸%;¬~.Üñu1]ÆÅãEÔüU¤£ÿ¤¸VXëó°ø¥ØJpqcâf´ñ×¢®V{O¾Èõs^ým¯¹Vûõ]sîO½êgô/a}ÙÅ;DÔãóû]Ùßjw±p·£&ÂÕ¶Â}?F.mam»²âhµQÑZYÆyc¬Ãf~»ÑìG è)âûâQa]Ä8ç.õþÕ¢¸ép:w «2ðä{º¸µßoEQùgµÇùôÅ0Ñ:¿7 ´© ïï¿ã®:ülË<,þ&61á$¬}àpµ°¶ûpµ£9"+ºHÛP_ááF{Vk%%ñËXÉ í±9½<Q^nÖI)Ë¿EÈË8 nôóµ·-¥Qu¯÷:¯¥p 7"÷ïÂj/GÄ!ciªÌß k[8VÄÄPâlaí{¹à{ÚN¤ñÏ8G£Ú³æuµ-qsöòäv¡«g½^ä$Ö×kßª<(xªøE'q(ÓÕq(u_OX%Î½ÀÄªëj'êz8µÍEHûk¿Ä²Ï³êHâé¡½@½9éÞYïÇ9 ÜÚÏ\|G[Û¸pa_#\¢è<Ñô,A,ÉÚ?n9©~°äo^³¶uùðTÃp$±kÇÖ y(ôakY'Ñkm(,S19lÒ±Mè6t³NHÆÍÉáB³=1¢î¤«¾,èÖ[ûùÄ9oknNJréñð`XE ±%=nÐøþ#Ü1ûòà$nßdu^+Ú}T#bÎÜý®¾8o k_ úNaEï1wk_à:Ì®è%\Ì 9ó»Ý«T'Xû:_dÍ¬m~¸ ¥Äx£µïbÏG+ÚcÍâÍd4Û:!ÞOu_Ä´Úp 9µ}Îiâi¢H¤A!½Ry8¶\£î$xrÏ!z&aí¤¬CbÆ¤µÐ[°22¾xX/¬6ËÍW¨â$°Ê¶ýÿ¸î×ëaCïymáji»ÑíãáòãªøÒÙýÿþÓ H_V[9 [ëÉL±l$îùþ<u_(\|² î£¨ÑÇ6 XÂbOnÑÁ×å'Âj¸v!M¥@îikß ÄÐÃºqV\kÉ¹k6ep·{¸<°PÇNÍBH\Dÿä¸c¯qÂöÀr±^iÌAØ·V1'7ªNãIòüaµCìÈêIR#`mO¯ñù"UMrT{B½©vèSÂÚ¨aèa½w°ä:ÖAñõÅuâ¢ÙkÖ¶½ÀpÂÆ VþAT1N°bÕ®å$XxÄÚ,VçP¤¼°+¤Quo)zªæ!ùbõ'k[ÆáUE Üjvá$cqo[û/d¬×gKN¢=Ö!CëWÉ5ÅÎb;££ú,z,óÄù¢_»Û¦5¶åbø'$ÑBsþ}'AµíÑbE'Ák}ªB©~F^e(àI<L¨ [COáa8 ã,ªbÍ¡úóÕ"¤I'!#ÛÉ3ºªLæY>¡'«¯ m·×gûöÊ{²¦]WrzÜ$³bµí; Òp¡Ä §þ¢ âÑ¥ê\á·[ W[k;à³6T%ä\|®å$ÐÂjÃç S×Ié\.P/aH¯ÁJÖbUÙË]iÕ´ïy^[U xçëHaªFâÈ7µ ~Û¾ ìoÜpu©Qt7"#á·¾(kýÌU<L'AöçÂj'çbQô°>MÝôì>ÏàR¹DÆÞíîË1àx¶g;Ó¾ F`ôt±¹;Ñ¾3õÚÕvY©?ÊÊìUô(ÏöÛöùvà©VSèU£è$ò¹©ë$Hg[Û zVliNÙ uyÀ±"w¦cÌ[zÆÊ=.uGãNçd7à4Qw#Óú{m½v§³M¬âT¼Ä´à^à©è·];I ËI0[ÔÚnÐXÔa; z7 «-z²Û"uÄþ¡¥Â4çÆÇ:ÅXçzïÇ8KN¥k(úÿ^Þû©PLä .Ö bi°^ÅV Ëw¡12Oi¢Âúl&UÑòà$Þ/¬íÍ(:ÐªÛ9ÄY²k'qªgh)Ü¥@7u¢ÿâ½_²ÝYe,ËÞû)0sÀR¦R3&J§¶}'Á´òPàúAõ2¬Ï¥2¯B¥FÉIb@@à °4L'+(samX ¹ã$.ó-léH¾¦þÿ÷~î£¡ä¹#ýÿhïýü(3s¬©¹z_[íúN(´nB?b#1±²õ¹ôRW{âYFÏkV[Ãr¤C5ÖAPë8ÆÔ«àZÍUr!RÇIÜìZ ïÍ¢=¼÷R` ±ôw/éØ;®Ñr½:é7e¾\|T" t¿°Úõb¡µ-ÆJO£ª²#\|ÿÐq¦:I®ÕFo6,'.Ö¶ô ª^sº2FmÇN"¦^ÇÈJSÖþLj³^§V"Ô»é8<CK¡;S³´¾µMX ¸#ýÍ÷XÛáþFÔ¤+Ö´N°RQªÑE³ÚËIÄz4Ì¬R³¦êó»ÂÔå4õ¹Ì,û¹´OUÕ?ÄË5L'ñamü¦Eq®8fl®Å%Ä:Ö1\|SÄÔ`µ/%ü<TXaËzbweleéÖÁëï³¼÷R`ñÑdäÏ6Þ/Ë"íïÁ;ëf^'¯^V8ªë¬¶r,'Aï&¶¿¦8 ÆÝnÃ¬ÐÒjîg¹PGRôtä¸B©dØMX¦ ÞâQHÇ="Î)cJþEQv ¾ûÙ9ôncÃªN¶µ ×!/ÜcÝÓÐpá¯_é8^ÇYÖíâ½·#ý½÷^ @±Y\|1+øæE:BU.@¡é¹9dXE)&Fiqq#ðó'»qÜ¡¢Nj;Ökb&jhõîa: ËrpÜe[ôø?Ã£Õ¸ýà/"´w'A!}¢7íê;ÂÚû³;ôÏÔqÔ9XWîÔRýÍÚÖ6e Ôþ~÷^ ú.«[ÞCq§V[PtÂâ'ÔZpcÐ5#^À,KzaZ Uæ06d.S¿YlcÃSbêæÐ¥´«(YÛçPçOolÐÞ7dh®BNlþ°±Ã hõdéñÒbù¶#Dh"Ð#°¦è» ÅGóÎ×°¥: þ§k ÑMdbXÁëÖöô´ÜïÔqWyk+t¤¿×UÝ_,ºÅXúû@ç½Tb%¿{ØJG.Ü@¡.Y1'AÙzlµ#·ì1sÃ²È¯%G(hUËD,<l'0tj¬ý\x0s§ÂÅc¬×ïØÄ¨\ë"gËz©n03ÕIzM\|&µYb©Ðwt×í8_yBw¾D¶x.%×Öv1ø®¬¨ÒFÕe1Ð²nÜÐÕ´^9 WMe® 79«8Å);3°Ö,Â'è öÛA²ü@ÑÐÐõ0EKùEäJq/¡VQÞ£µäétÄ¡¥°Tå¢Z¶·MÚg©1´^ëÅiucñC+UsÏ¡Hu÷"Ã,zZ)ÔùÊÆEb(ÕëÊÑd9+4*NÑ =Rø¨2Õß!àiµÉ²qnl§¬`¾÷µ-½ê¢9?M`/\»É¡±-+C7+KFOvâJo;Ëµí2½Î¼kû2ýÕ"²2¤S®?q¼×çaIL§êoðô8X¤Eçàº¥ö¨øîÀB«0ù%'Èâ(» ±ùH¦ÖJ¸"@LïÛ¿ïö®Ê:Pzö¥è,1·Ú(s©+ãªºøéµeÔn4Õù9q³mÎâá×3t¤×÷Î¶KEß¡I4¹¬0R<%ËÇu Zêfs$ÆùÔø.Lc?V6b,ËB6Á®^V´BÏðB]Õ2Üe{+¹V1¶õÏÆ^E_ý¶ hå,¿Æ¯(îD ªI©æýZQüFÐ¤2ÒO³õ] ¤æ¢jÓÚÈ^3V;p8?åa²Jex1Ë(I-]M4LøÚ@l/¶CZ¿=sÉ.KÖZÚ¶ÊþÏXÍÏñ7uÜ<L#AÙ5ëÒE/ûôìUÖëÇA/ÍqàXþó]õ;Äwçw(Yþºà»³<;ëÒEÄõx²s}Éèç\|«p³´l%ì^Åuä¼û+k&2°ÍDjfw RÛzUµÔ!ÔªU«¿tü¬¿l_QvØqa{¬9°'L{¬5]q÷1Nr±©U«Vß´¤d\|v5'wE«T6ÞhY¿ØWésfù"æ¸uz´Ö «UëÿUKD.Ý:â0q`2Su'¶hÏä0miM4ÏæÙgsKòsl_Ý"¬Zµj BÓ¦ÿûóáRÑáIEND®B`
URL	http://www.vulnweb.com/style.css
Method	GET
Parameter	X-Content-Type-Options
Attack
Evidence
Show / hide Request and Response
Request Header - size: 285 bytes.	GET http://www.vulnweb.com/style.css HTTP/1.1 Host: www.vulnweb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 239 bytes.	HTTP/1.1 200 OK Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:32:03 GMT Content-Type: text/css Content-Length: 9894 Last-Modified: Thu, 19 Jun 2014 11:13:14 GMT Connection: keep-alive ETag: "53a2c5ca-26a6" Accept-Ranges: bytes
Response Body - size: 9,894 bytes.	/* ------------------ styling for the tables ------------------ / body { line-height: 1.6em; } .acunetix-title { font-size: 20px; padding: 12px 15px; color: #039; } #hor-minimalist-a { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; background: #fff; margin: 45px; width: 480px; border-collapse: collapse; text-align: left; } #hor-minimalist-a th { font-size: 14px; font-weight: normal; color: #039; padding: 10px 8px; border-bottom: 2px solid #6678b1; } #hor-minimalist-a td { color: #669; padding: 9px 8px 0px 8px; } #hor-minimalist-a tbody tr:hover td { color: #009; } #hor-minimalist-b { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; background: #fff; margin: 45px; width: 480px; border-collapse: collapse; text-align: left; } #hor-minimalist-b th { font-size: 14px; font-weight: normal; color: #039; padding: 10px 8px; border-bottom: 2px solid #6678b1; } #hor-minimalist-b td { border-bottom: 1px solid #ccc; color: #669; padding: 6px 8px; } #hor-minimalist-b tbody tr:hover td { color: #009; } #ver-minimalist { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #ver-minimalist th { padding: 8px 2px; font-weight: normal; font-size: 14px; border-bottom: 2px solid #6678b1; border-right: 30px solid #fff; border-left: 30px solid #fff; color: #039; } #ver-minimalist td { padding: 12px 2px 0px 2px; border-right: 30px solid #fff; border-left: 30px solid #fff; color: #669; } #box-table-a { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #box-table-a th { font-size: 13px; font-weight: normal; padding: 8px; background: #b9c9fe; border-top: 4px solid #aabcfe; border-bottom: 1px solid #fff; color: #039; } #box-table-a td { padding: 8px; background: #e8edff; border-bottom: 1px solid #fff; color: #669; border-top: 1px solid transparent; } #box-table-a tr:hover td { background: #d0dafd; color: #339; } #box-table-b { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: center; border-collapse: collapse; border-top: 7px solid #9baff1; border-bottom: 7px solid #9baff1; } #box-table-b th { font-size: 13px; font-weight: normal; padding: 8px; background: #e8edff; border-right: 1px solid #9baff1; border-left: 1px solid #9baff1; color: #039; } #box-table-b td { padding: 8px; background: #e8edff; border-right: 1px solid #aabcfe; border-left: 1px solid #aabcfe; color: #669; } #hor-zebra { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #hor-zebra th { font-size: 14px; font-weight: normal; padding: 10px 8px; color: #039; } #hor-zebra td { padding: 8px; color: #669; } #hor-zebra .odd { background: #e8edff; } #ver-zebra { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #ver-zebra th { font-size: 14px; font-weight: normal; padding: 12px 15px; border-right: 1px solid #fff; border-left: 1px solid #fff; color: #039; } #ver-zebra td { padding: 8px 15px; border-right: 1px solid #fff; border-left: 1px solid #fff; color: #669; } .vzebra-odd { background: #eff2ff; } .vzebra-even { background: #e8edff; } #ver-zebra #vzebra-adventure, #ver-zebra #vzebra-children { background: #d0dafd; border-bottom: 1px solid #c8d4fd; } #ver-zebra #vzebra-comedy, #ver-zebra #vzebra-action { background: #dce4ff; border-bottom: 1px solid #d6dfff; } #one-column-emphasis { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 650px; text-align: left; border-collapse: collapse; } #one-column-emphasis th { font-size: 14px; font-weight: normal; padding: 12px 15px; color: #039; } #one-column-emphasis td { padding: 10px 15px; color: #669; border-top: 1px solid #e8edff; } .oce-first { background: #d0dafd; border-right: 10px solid transparent; border-left: 10px solid transparent; } #one-column-emphasis tr:hover td { color: #339; background: #eff2ff; } #newspaper-a { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; border: 1px solid #69c; } #newspaper-a th { padding: 12px 17px 12px 17px; font-weight: normal; font-size: 14px; color: #039; border-bottom: 1px dashed #69c; } #newspaper-a td { padding: 7px 17px 7px 17px; color: #669; } #newspaper-a tbody tr:hover td { color: #339; background: #d0dafd; } #newspaper-b { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; border: 1px solid #69c; } #newspaper-b th { padding: 15px 10px 10px 10px; font-weight: normal; font-size: 14px; color: #039; } #newspaper-b tbody { background: #e8edff; } #newspaper-b td { padding: 10px; color: #669; border-top: 1px dashed #fff; } #newspaper-b tbody tr:hover td { color: #339; background: #d0dafd; } #newspaper-c { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; border: 1px solid #6cf; } #newspaper-c th { padding: 20px; font-weight: normal; font-size: 13px; color: #039; text-transform: uppercase; border-right: 1px solid #0865c2; border-top: 1px solid #0865c2; border-left: 1px solid #0865c2; border-bottom: 1px solid #fff; } #newspaper-c td { padding: 10px 20px; color: #669; border-right: 1px dashed #6cf; } #rounded-corner { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #rounded-corner thead th.rounded-company { background: #b9c9fe url('table-images/left.png') left -1px no-repeat; } #rounded-corner thead th.rounded-q4 { background: #b9c9fe url('table-images/right.png') right -1px no-repeat; } #rounded-corner th { padding: 8px; font-weight: normal; font-size: 13px; color: #039; background: #b9c9fe; } #rounded-corner td { padding: 8px; background: #e8edff; border-top: 1px solid #fff; color: #669; } #rounded-corner tfoot td.rounded-foot-left { background: #e8edff url('table-images/botleft.png') left bottom no-repeat; } #rounded-corner tfoot td.rounded-foot-right { background: #e8edff url('table-images/botright.png') right bottom no-repeat; } #rounded-corner tbody tr:hover td { background: #d0dafd; } #background-image { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; background: url('table-images/blurry.jpg') 330px 59px no-repeat; } #background-image th { padding: 12px; font-weight: normal; font-size: 14px; color: #339; } #background-image td { padding: 9px 12px; color: #669; border-top: 1px solid #fff; } #background-image tfoot td { font-size: 11px; } #background-image tbody td { background: url('table-images/back.png'); } html #background-image tbody td { /* ---------------------------- PUT THIS ON IE6 ONLY STYLE AS THE RULE INVALIDATES YOUR STYLESHEET ---------------------------- */ filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(src='table-images/back.png',sizingMethod='crop'); background: none; } #background-image tbody tr:hover td { color: #339; background: none; } #gradient-style { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; } #gradient-style th { font-size: 13px; font-weight: normal; padding: 8px; background: #b9c9fe url('table-images/gradhead.png') repeat-x; border-top: 2px solid #d3ddff; border-bottom: 1px solid #fff; color: #039; } #gradient-style td { padding: 8px; border-bottom: 1px solid #fff; color: #669; border-top: 1px solid #fff; background: #e8edff url('table-images/gradback.png') repeat-x; } #gradient-style tfoot tr td { background: #e8edff; font-size: 12px; color: #99c; } #gradient-style tbody tr:hover td { background: #d0dafd url('table-images/gradhover.png') repeat-x; color: #339; } #pattern-style-a { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; background: url('table-images/pattern.png'); } #pattern-style-a thead tr { background: url('table-images/pattern-head.png'); } #pattern-style-a th { font-size: 13px; font-weight: normal; padding: 8px; border-bottom: 1px solid #fff; color: #039; } #pattern-style-a td { padding: 8px; border-bottom: 1px solid #fff; color: #669; border-top: 1px solid transparent; } #pattern-style-a tbody tr:hover td { color: #339; background: #fff; } #pattern-style-b { font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif; font-size: 12px; margin: 45px; width: 480px; text-align: left; border-collapse: collapse; background: url('table-images/patternb.png'); } #pattern-style-b thead tr { background: url('table-images/patternb-head.png'); } #pattern-style-b th { font-size: 13px; font-weight: normal; padding: 8px; border-bottom: 1px solid #fff; color: #039; } #pattern-style-b td { padding: 8px; border-bottom: 1px solid #fff; color: #669; border-top: 1px solid transparent; } #pattern-style-b tbody tr:hover td { color: #339; background: #cdcdee; }
Instances	4
Solution	Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Reference	http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx https://owasp.org/www-community/Security_Headers
Tags	OWASP_2021_A05 OWASP_2017_A06
CWE Id	693
WASC Id	15
Plugin Id	10021

Informational	User Agent Fuzzer
Description	Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.

URL	http://www.vulnweb.com/favicon.ico
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Show / hide Request and Response
Request Header - size: 264 bytes.	GET http://www.vulnweb.com/favicon.ico HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:00 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/favicon.ico
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Show / hide Request and Response
Request Header - size: 264 bytes.	GET http://www.vulnweb.com/favicon.ico HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:00 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/favicon.ico
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Show / hide Request and Response
Request Header - size: 264 bytes.	GET http://www.vulnweb.com/favicon.ico HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1) Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:00 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/favicon.ico
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Show / hide Request and Response
Request Header - size: 342 bytes.	GET http://www.vulnweb.com/favicon.ico HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:00 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/favicon.ico
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Show / hide Request and Response
Request Header - size: 329 bytes.	GET http://www.vulnweb.com/favicon.ico HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://www.vulnweb.com/
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:01 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/robots.txt
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Show / hide Request and Response
Request Header - size: 180 bytes.	GET http://www.vulnweb.com/robots.txt HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:01 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/robots.txt
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Show / hide Request and Response
Request Header - size: 180 bytes.	GET http://www.vulnweb.com/robots.txt HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:01 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/robots.txt
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Show / hide Request and Response
Request Header - size: 180 bytes.	GET http://www.vulnweb.com/robots.txt HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1) Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:01 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/robots.txt
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Show / hide Request and Response
Request Header - size: 258 bytes.	GET http://www.vulnweb.com/robots.txt HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0 Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:01 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/robots.txt
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Show / hide Request and Response
Request Header - size: 245 bytes.	GET http://www.vulnweb.com/robots.txt HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:02 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/sitemap.xml
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Show / hide Request and Response
Request Header - size: 181 bytes.	GET http://www.vulnweb.com/sitemap.xml HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:02 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/sitemap.xml
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Show / hide Request and Response
Request Header - size: 181 bytes.	GET http://www.vulnweb.com/sitemap.xml HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:01 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/sitemap.xml
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Show / hide Request and Response
Request Header - size: 181 bytes.	GET http://www.vulnweb.com/sitemap.xml HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1) Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:01 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/sitemap.xml
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Show / hide Request and Response
Request Header - size: 259 bytes.	GET http://www.vulnweb.com/sitemap.xml HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0 Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:02 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
URL	http://www.vulnweb.com/sitemap.xml
Method	GET
Parameter	Header User-Agent
Attack	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Show / hide Request and Response
Request Header - size: 246 bytes.	GET http://www.vulnweb.com/sitemap.xml HTTP/1.1 Host: www.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Pragma: no-cache Cache-Control: no-cache
Request Body - size: 0 bytes.
Response Header - size: 155 bytes.	HTTP/1.1 404 Not Found Server: nginx/1.19.0 Date: Wed, 14 Dec 2022 06:34:02 GMT Content-Type: text/html Content-Length: 555 Connection: keep-alive
Response Body - size: 555 bytes.	<html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page -->
Instances	15
Solution
Reference	https://owasp.org/wstg
Tags
CWE Id
WASC Id
Plugin Id	10104

REPORT

Generated on Wed, 14 Dec 2022 00:35:58

Summary of Alerts

Alerts

Passing Rules

Sites

http://www.vulnweb.com

No Authentication Statistics Found

Alert Detail