Security Misconfiguration (SM)

eSMTP configuration was discovered.

Nginx is vulnerable to git configuration exposure.

A Laravel .env file was discovered, which stores sensitive information like database credentials and tokens. It should not be publicly accessible.

A Docker container misconfiguration was discovered.

Msmtp configuration was discovered.

Parameters.yml was discovered.

Mongo Express was able to be access with no authentication requirements in place.

Attacker can get unauthorized access to Apache Airflow configuration files.

Attackers can get access to sensitive AWS Dockerrun configuration files.

Attackers can get access to the Apache configuration files.

Attackers can get access to the appspec.yml file used in application deployments.

A test CGI script on the server leaks a list of server environment variables in the response page.

Attacker can get unauthorized access to the CircleCI config.yml file.

Attacker can get unauthorized access to JSON configuration files.

Directory listing of sensitive files.

Attacker can get unauthorized access of Golang expvar information.

Attacker can get unauthorized access of Docker Compose configuration files.

Attacker can get unauthorized access of hidden Dockerfile(s).

Attacker can get unauthorized access of Firebase configuration details.

Attacker can get unauthorized access of FTP credentials.

Searches for the pattern /.git/config and log file on passed URLs.

Searches for the pattern and log file on passed URLs.

Searches for the presence of GitHub workflow files on provided URLs.

Search for the presence of Kubernetes Kustomization files (kustomization.yml) on the provided URLs.

Attacker can get unauthorized access of Nginx config file.

Oracle EBS credentials may be exposed through the jtfwrepo.xml file.

Exposed Prometheus metrics endpoint found.

Redis configuration file (redis.conf) was exposed.

MongoDB credentials file used by RoboMongo

Detects the presence of private SSH, TLS, and JWT keys on the server.

Detects the exposure of SFTP configuration files.

Detects publicly accessible SonarQube projects.

Exposed SSH Authorized Keys

Exposed SSH Known Hosts

Exposes the Wgetrc configuration file used by Wget utility, containing potentially sensitive information.

WordPress configuration file (wp-config.php) leaked, exposing AWS S3 keys and sensitive database credentials.

This test verifies if the 'secure' attribute is properly set in HTTP response header 'set-cookie' field to ensure secure cookie transmission.

Detection of default login credentials misconfiguration for potential unauthorized access vulnerability.

Detection of Django default homepage enabled misconfiguration, exposing sensitive information and indicating a potential security risk.

Express Default Homepage Enabled Misconfiguration

Express Stack Trace Enabled Misconfiguration exposes sensitive error details, potentially aiding attackers in identifying vulnerabilities and exploiting the application.

Assessing security vulnerability by appending .json to API path, accessing complete Firebase collection data without authentication.

Flask Debug Mode Enabled Misconfiguration.

GraphQL debug mode enabled vulnerability exposes sensitive debug information, increasing the risk of data leakage and potential security breaches

Exposed GraphQL development console allows type introspection, increasing the risk of security vulnerabilities and unauthorized access

GraphQL field suggestions provide auto-complete suggestions for available fields, enabling attackers to gain insights into data structures, potentially leading to data exposure and targeted attacks on the API.

GraphQL introspection mode vulnerability allows unauthorized access to schema details, potentially exposing sensitive data and increasing attack surface.

GraphQL type introspection vulnerability enables unauthorized access to type details, potentially leading to data exposure and security breaches.

Adds a random header to a request for a non-existent page and checks if it is reflected in the response.

This test checks for JWT client side signing

Laravel debug mode enabled misconfiguration can expose sensitive information, potentially leading to security vulnerabilities.

Laravel Default Homepage Enabled Misconfiguration.

Laravel Telescope Enabled Misconfiguration.

Detection of Nginx default page enabled misconfiguration, potentially exposing sensitive server information.

Detection of Nginx server version disclosure misconfiguration, potentially aiding attackers in identifying vulnerable versions.

Appending 'nginx-status' to the URL, this test checks if the NGINX status module is accessible, potentially revealing sensitive server information.

Tests for open redirect vulnerability by injecting evil.com into host headers, ensuring secure redirection and protection against malicious redirects.

Tests for open redirect vulnerability by injecting evil.com into URL path, ensuring secure redirection and protection against malicious redirects.

An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain by leveraging subdomain whitelisting.

Rails debug mode enabled misconfiguration can expose sensitive information, potentially leading to security vulnerabilities.

Rails Default Homepage Enabled Misconfiguration.

This test detects vulnerabilities in web applications, ensuring proper session management and protection against attacks.

Spring Boot Beans Actuator Exposed Misconfiguration.

Spring Boot Configuration Properties Actuator Exposed Misconfiguration.

Spring Boot Environment Actuator Exposed Misconfiguration.

Spring Boot Http Trace Actuator Exposed Misconfiguration.

Spring Boot Thread Dump Actuator Exposed Misconfiguration

Struts debug mode enabled misconfiguration can expose sensitive information, potentially leading to security vulnerabilities.

Detection of Struts OGNL console enabled misconfiguration, which can lead to remote code execution vulnerabilities.

Injecting malicious content into a web url to mislead users.

An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain.