ZAP by Checkmarx Scanning
Report
Site: http://testphp.vulnweb.com
Generated on Sun, 16 Feb 2025 18:59:10
ZAP Version: 2.16.0
ZAP by Checkmarx
Summary of Alerts
Risk Level Number of Alerts
High 0
Medium 2
Low 3
Informational 1
Alerts
Number of
Name Risk Level
Instances
Content Security Policy (CSP) Header Not Set Medium 1
Missing Anti-clickjacking Header Medium 1
Server Leaks Information via "X-Powered-By"
Low 1
HTTP Response Header Field(s)
Server Leaks Version Information via "Server"
Low 2
HTTP Response Header Field
X-Content-Type-Options Header Missing Low 2
Charset Mismatch (Header Versus Meta Content-
Informational 1
Type Charset)
Alert Detail
Medium Content Security Policy (CSP) Header Not Set
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate
certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks.
These attacks are used for everything from data theft to site defacement or distribution of
Description malware. CSP provides a set of standard HTTP headers that allow website owners to
declare approved sources of content that browsers should be allowed to load on that page
— covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable
objects such as Java applets, ActiveX, audio and video files.
URL http://testphp.vulnweb.com/
Method GET
Attack
Evidence
Other
Info
Instances 1
Ensure that your web server, application server, load balancer, etc. is configured to set the
Solution
Content-Security-Policy header.
https://developer.mozilla.org/en-US/docs/Web/Security/CSP
/Introducing_Content_Security_Policy
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
Reference https://www.w3.org/TR/CSP/
https://w3c.github.io/webappsec-csp/
https://web.dev/articles/csp
https://caniuse.com/#feat=contentsecuritypolicy
https://content-security-policy.com/
CWE Id 693
WASC Id 15
Plugin Id 10038
Medium Missing Anti-clickjacking Header
The response does not protect against 'ClickJacking' attacks. It should include either
Description
Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options.
URL http://testphp.vulnweb.com/
Method GET
Attack
Evidence
Other
Info
Instances 1
Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP
headers. Ensure one of them is set on all web pages returned by your site/app.
Solution If you expect the page to be framed only by pages on your server (e.g. it's part of a
FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page
to be framed, you should use DENY. Alternatively consider implementing Content Security
Policy's "frame-ancestors" directive.
Reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
CWE Id 1021
WASC Id 15
Plugin Id 10020
Low Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
The web/application server is leaking information via one or more "X-Powered-By" HTTP
response headers. Access to such information may facilitate attackers identifying other
Description
frameworks/components your web application is reliant upon and the vulnerabilities such
components may be subject to.
URL http://testphp.vulnweb.com/
Method GET
Attack
Evidence X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1
Other
Info
Instances 1
Ensure that your web server, application server, load balancer, etc. is configured to
Solution
suppress "X-Powered-By" headers.
https://owasp.org/www-project-web-security-testing-guide/v42/4-
Web_Application_Security_Testing/01-Information_Gathering/08-
Reference
Fingerprint_Web_Application_Framework
https://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
CWE Id 200
WASC Id 13
Plugin Id 10037
Low Server Leaks Version Information via "Server" HTTP Response Header Field
The web/application server is leaking version information via the "Server" HTTP response
Description header. Access to such information may facilitate attackers identifying other vulnerabilities
your web/application server is subject to.
URL http://testphp.vulnweb.com/
Method GET
Attack
Evidence nginx/1.19.0
Other
Info
URL http://testphp.vulnweb.com/style.css
Method GET
Attack
Evidence nginx/1.19.0
Other
Info
Instances 2
Ensure that your web server, application server, load balancer, etc. is configured to
Solution
suppress the "Server" header or provide generic details.
https://httpd.apache.org/docs/current/mod/core.html#servertokens
Reference https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff648552(v=pandp.10)
https://www.troyhunt.com/shhh-dont-let-your-response-headers/
CWE Id 200
WASC Id 13
Plugin Id 10036
Low X-Content-Type-Options Header Missing
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows
older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response
body, potentially causing the response body to be interpreted and displayed as a content
Description
type other than the declared content type. Current (early 2014) and legacy versions of
Firefox will use the declared content type (if one is set), rather than performing MIME-
sniffing.
URL http://testphp.vulnweb.com/
Method GET
Attack
Evidence
Other This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still
Info affected by injection issues, in which case there is still concern for browsers sniffing pages
away from their actual content type. At "High" threshold this scan rule will not alert on client
or server error responses.
URL http://testphp.vulnweb.com/style.css
Method GET
Attack
Evidence
This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still
Other affected by injection issues, in which case there is still concern for browsers sniffing pages
Info away from their actual content type. At "High" threshold this scan rule will not alert on client
or server error responses.
Instances 2
Ensure that the application/web server sets the Content-Type header appropriately, and
that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.
Solution
If possible, ensure that the end user uses a standards-compliant and modern web browser
that does not perform MIME-sniffing at all, or that can be directed by the web application
/web server to not perform MIME-sniffing.
https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer
Reference /compatibility/gg622941(v=vs.85)
https://owasp.org/www-community/Security_Headers
CWE Id 693
WASC Id 15
Plugin Id 10021
Informational Charset Mismatch (Header Versus Meta Content-Type Charset)
This check identifies responses where the HTTP Content-Type header declares a charset
different from the charset defined by the body of the HTML or XML. When there's a charset
mismatch between the HTTP header and content body Web browsers can be forced into an
undesirable content-sniffing mode to determine the content's correct character set.
Description
An attacker could manipulate content on the page to be interpreted in an encoding of their
choice. For example, if an attacker can control content at the beginning of the page, they
could inject script using UTF-7 encoded text and manipulate some browsers into
interpreting that text.
URL http://testphp.vulnweb.com/
Method GET
Attack
Evidence
Other There was a charset mismatch between the HTTP Header and the META content-type
Info encoding declarations: [UTF-8] and [iso-8859-2] do not match.
Instances 1
Force UTF-8 for all text content in both the HTTP header and meta tags in HTML or
Solution
encoding declarations in XML.
Reference https://code.google.com/p/browsersec/wiki/Part2#Character_set_handling_and_detection
CWE Id 436
WASC Id 15
Plugin Id 90011
