A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.
", "endpoint": null, "raw": { "pluginid": "10011", "alertRef": "10011", "alert": "Cookie Without Secure Flag", "name": "Cookie Without Secure Flag", "riskcode": "1", "confidence": "2", "riskdesc": "Low (Medium)", "desc": "A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.
", "instances": [ { "id": "12", "uri": "https://staging.ipw.co.za", "nodeName": "https://staging.ipw.co.za", "method": "GET", "param": "cookiesession1", "attack": "", "evidence": "Set-Cookie: cookiesession1", "otherinfo": "" }, { "id": "10", "uri": "https://staging.ipw.co.za/robots.txt", "nodeName": "https://staging.ipw.co.za/robots.txt", "method": "GET", "param": "cookiesession1", "attack": "", "evidence": "Set-Cookie: cookiesession1", "otherinfo": "" }, { "id": "11", "uri": "https://staging.ipw.co.za/sitemap.xml", "nodeName": "https://staging.ipw.co.za/sitemap.xml", "method": "GET", "param": "cookiesession1", "attack": "", "evidence": "Set-Cookie: cookiesession1", "otherinfo": "" } ], "count": "3", "systemic": false, "solution": "Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted channel. Ensure that the secure flag is set for cookies containing such sensitive information.
", "otherinfo": "", "reference": "https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes.html
", "cweid": "614", "wascid": "13", "sourceid": "8" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Cookie without SameSite Attribute", "description": "A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.
", "endpoint": null, "raw": { "pluginid": "10054", "alertRef": "10054-1", "alert": "Cookie without SameSite Attribute", "name": "Cookie without SameSite Attribute", "riskcode": "1", "confidence": "2", "riskdesc": "Low (Medium)", "desc": "A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.
", "instances": [ { "id": "8", "uri": "https://staging.ipw.co.za", "nodeName": "https://staging.ipw.co.za", "method": "GET", "param": "cookiesession1", "attack": "", "evidence": "Set-Cookie: cookiesession1", "otherinfo": "" }, { "id": "9", "uri": "https://staging.ipw.co.za/robots.txt", "nodeName": "https://staging.ipw.co.za/robots.txt", "method": "GET", "param": "cookiesession1", "attack": "", "evidence": "Set-Cookie: cookiesession1", "otherinfo": "" }, { "id": "7", "uri": "https://staging.ipw.co.za/sitemap.xml", "nodeName": "https://staging.ipw.co.za/sitemap.xml", "method": "GET", "param": "cookiesession1", "attack": "", "evidence": "Set-Cookie: cookiesession1", "otherinfo": "" } ], "count": "3", "systemic": false, "solution": "Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.
", "otherinfo": "", "reference": "https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-same-site
", "cweid": "1275", "wascid": "13", "sourceid": "8" } }, { "tool": "zap", "type": "web", "severity": "low", "title": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", "description": "The web/application server is leaking version information via the \"Server\" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
", "endpoint": null, "raw": { "pluginid": "10036", "alertRef": "10036-2", "alert": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", "name": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", "riskcode": "1", "confidence": "3", "riskdesc": "Low (High)", "desc": "The web/application server is leaking version information via the \"Server\" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
", "instances": [ { "id": "16", "uri": "https://staging.ipw.co.za", "nodeName": "https://staging.ipw.co.za", "method": "GET", "param": "", "attack": "", "evidence": "Apache/2.4.62 (Debian)", "otherinfo": "" }, { "id": "18", "uri": "https://staging.ipw.co.za/", "nodeName": "https://staging.ipw.co.za/", "method": "GET", "param": "", "attack": "", "evidence": "Apache/2.4.62 (Debian)", "otherinfo": "" }, { "id": "13", "uri": "https://staging.ipw.co.za/robots.txt", "nodeName": "https://staging.ipw.co.za/robots.txt", "method": "GET", "param": "", "attack": "", "evidence": "Apache/2.4.62 (Debian)", "otherinfo": "" }, { "id": "15", "uri": "https://staging.ipw.co.za/sitemap.xml", "nodeName": "https://staging.ipw.co.za/sitemap.xml", "method": "GET", "param": "", "attack": "", "evidence": "Apache/2.4.62 (Debian)", "otherinfo": "" } ], "count": "4", "systemic": false, "solution": "Ensure that your web server, application server, load balancer, etc. is configured to suppress the \"Server\" header or provide generic details.
", "otherinfo": "", "reference": "https://httpd.apache.org/docs/current/mod/core.html#servertokens
https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff648552(v=pandp.10)
https://www.troyhunt.com/shhh-dont-let-your-response-headers/
", "cweid": "497", "wascid": "13", "sourceid": "8" } }, { "tool": "zap", "type": "web", "severity": "informational", "title": "Session Management Response Identified", "description": "The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to \"Auto-Detect\" then this rule will change the session management to use the tokens identified.
", "endpoint": null, "raw": { "pluginid": "10112", "alertRef": "10112", "alert": "Session Management Response Identified", "name": "Session Management Response Identified", "riskcode": "0", "confidence": "2", "riskdesc": "Informational (Medium)", "desc": "The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to \"Auto-Detect\" then this rule will change the session management to use the tokens identified.
", "instances": [ { "id": "3", "uri": "https://staging.ipw.co.za/sitemap.xml", "nodeName": "https://staging.ipw.co.za/sitemap.xml", "method": "GET", "param": "cookiesession1", "attack": "", "evidence": "cookiesession1", "otherinfo": "cookie:cookiesession1" } ], "count": "1", "systemic": false, "solution": "This is an informational alert rather than a vulnerability and so there is nothing to fix.
", "otherinfo": "cookie:cookiesession1
", "reference": "https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id/
", "cweid": "-1", "wascid": "-1", "sourceid": "6" } }, { "tool": "zap", "type": "web", "severity": "informational", "title": "Storable and Cacheable Content", "description": "The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where \"shared\" caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
", "endpoint": null, "raw": { "pluginid": "10049", "alertRef": "10049-3", "alert": "Storable and Cacheable Content", "name": "Storable and Cacheable Content", "riskcode": "0", "confidence": "2", "riskdesc": "Informational (Medium)", "desc": "The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where \"shared\" caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
", "instances": [ { "id": "2", "uri": "https://staging.ipw.co.za", "nodeName": "https://staging.ipw.co.za", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234." }, { "id": "17", "uri": "https://staging.ipw.co.za/", "nodeName": "https://staging.ipw.co.za/", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234." }, { "id": "6", "uri": "https://staging.ipw.co.za/robots.txt", "nodeName": "https://staging.ipw.co.za/robots.txt", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234." }, { "id": "4", "uri": "https://staging.ipw.co.za/sitemap.xml", "nodeName": "https://staging.ipw.co.za/sitemap.xml", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234." } ], "count": "4", "systemic": false, "solution": "Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
Expires: 0
This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
", "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.
", "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
", "cweid": "524", "wascid": "13", "sourceid": "1" } } ], "warnings": [ "worker_security.py / subfinder: 0 findings — no subdomains or lookup blocked; continuing", "worker_security.py / nuclei: 0 findings after 550s (limit 1200s) — site may block automated scans, need longer SCAN_NUCLEI_TIMEOUT, or no critical/high/medium templates matched" ], "target_name": "Staging" }