WSTG-V42-CONF-05 on ZAP

.env Information Leak

Mon, 01 Jan 0001 00:00:00 +0000

One or more .env files seems to have been located on the server. These files often expose infrastructure or administrative account credentials, API or APP keys, or other sensitive configuration information.

.htaccess Information Leak

Mon, 01 Jan 0001 00:00:00 +0000

htaccess files can be used to alter the configuration of the Apache Web Server software to enable/disable additional functionality and features that the Apache Web Server software has to offer.

ELMAH Information Leak

Mon, 01 Jan 0001 00:00:00 +0000

The Error Logging Modules and Handlers (ELMAH [elmah.axd]) HTTP Module was found to be available. This module can leak a significant amount of valuable information.

Hidden File Found

Mon, 01 Jan 0001 00:00:00 +0000

A sensitive file was identified as accessible or available. This may leak administrative, configuration, or credential information which can be leveraged by a malicious individual to further attack the system or conduct social engineering efforts.

Properties File Disclosure - /WEB-INF folder

Mon, 01 Jan 0001 00:00:00 +0000

A Java class in the /WEB-INF folder disclosed the presence of the properties file. Properties file are not intended to be publicly accessible, and typically contain configuration information, application credentials, or cryptographic keys.

Source Code Disclosure - /WEB-INF Folder

Mon, 01 Jan 0001 00:00:00 +0000

Java source code was disclosed by the web server in Java class files in the WEB-INF folder. The class files can be dis-assembled to produce source code which very closely matches the original source code.

Spring Actuator Information Leak

Mon, 01 Jan 0001 00:00:00 +0000

Spring Actuator for Health is enabled and may reveal sensitive information about this application. Spring Actuators can be used for real monitoring purposes, but should be used with caution as to not expose too much information about the application or the infrastructure running it.

Trace.axd Information Leak

Mon, 01 Jan 0001 00:00:00 +0000

The ASP.NET Trace Viewer (trace.axd) was found to be available. This component can leak a significant amount of valuable information.