Wapiti scan report

Wapiti vulnerability report

Date of the scan: Thu, 01 Jan 1970 00:00:00 +0000. Scope of the scan: folder. Crawled pages: 123456

Category	Number of vulnerabilities found
Backup file	0
Cleartext Submission of Password	0
Weak credentials	0
CRLF Injection	0
Content Security Policy Configuration	0
Cross Site Request Forgery	0
Potentially dangerous file	0
Command execution	0
Path Traversal	0
Fingerprint web application framework	0
Fingerprint web server	0
Htaccess Bypass	0
HTML Injection	0
Clickjacking Protection	0
HTTP Strict Transport Security (HSTS)	0
MIME Type Confusion	0
HttpOnly Flag cookie	0
Unencrypted Channels	0
Inconsistent Redirection	0
Information Disclosure - Full Path	0
LDAP Injection	0
Log4Shell	0
NS takeover	0
Open Redirect	0
Reflected Cross Site Scripting	1
Secure Flag cookie	0
Spring4Shell	0
SQL Injection	0
TLS/SSL misconfigurations	0
Server Side Request Forgery	0
Stored HTML Injection	0
Stored Cross Site Scripting	0
Subdomain takeover	0
Blind SQL Injection	0
Unrestricted File Upload	0
Vulnerable software	0
Internal Server Error	1
Resource consumption	0
Review Webserver Metafiles for Information Leakage	0
Fingerprint web technology	1
HTTP Methods	0
TLS/SSL misconfigurations	0

Description: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. Examples of such code include HTML code and client-side scripts.

This is dope

                                    GET /riri?foo=bar HTTP/1.1

curl "http://perdu.com/riri?foo=bar"

None

Solutions: The best way to protect a web application from XSS attacks is ensure that the application performs validation of all headers, cookies, query strings, form fields, and hidden fields. Encoding user supplied output in the server side can also defeat XSS vulnerabilities by preventing inserted scripts from being transmitted to users in an executable form. Applications can gain significant protection from javascript based attacks by converting the following characters in all generated output to the appropriate HTML entity encoding: <, >, &, ', (, ), #, %, ; , +, -

Description: An error occurred on the server's side, preventing it to process the request. It may be the sign of a vulnerability.

This is the way

                                    GET /fifi HTTP/1.1

curl "http://perdu.com/fifi"

None

Solutions: More information about the error should be found in the server logs.

Description: The use of a web technology can be deducted due to the presence of its specific fingerprints.

loulou

                                    GET /?foo=bar HTTP/1.1

curl "http://perdu.com/?foo=bar"

None