
Burp Scanner Report HTML
Summary
The table below shows the numbers of issues identified in different categories. Issues are classified according to severity as High, Medium, Low or Information. This reflects the likely impact of each issue for a typical organization. Issues are also classified according to confidence as Certain, Firm or Tentative. This reflects the inherent reliability of the technique that was used to identify the issue.
|
|
Confidence |
|
|
Certain |
Firm |
Tentative |
Total |
Severity |
High |
0 |
0 |
0 |
0 |
Medium |
0 |
0 |
0 |
0 |
Low |
1 |
0 |
0 |
1 |
Information |
0 |
0 |
0 |
0 |
The chart below shows the aggregated numbers of issues identified in each category. Solid colored bars represent issues with a confidence level of Certain, and the bars fade as the confidence level falls.
|
|
Number of issues |
|
|
0 |
1 |
2 |
3 |
4 |
Severity |
High |
|
|
Medium |
|
|
Low |
|
|
Contents
1. Strict transport security not enforced
1.1. http://1.1.1.1/dradis/sessions
1. Strict transport security not enforced
There are 1 instances of this issue:
Summary
|
Severity: |
Low |
Confidence: |
Certain |
Host: |
https://github.com/dradis/dradis-burp |
Path: |
/ |
Issue description
The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption, and use the application as a platform for attacks against its users. This attack is performed by rewriting HTTPS links as HTTP, so that if a targeted user follows a link to the site from an HTTP page, their browser never attempts to use an encrypted connection. The sslstrip tool automates this process.
To exploit this vulnerability, an attacker must be suitably positioned to intercept and modify the victim's network traffic.This scenario typically occurs when a client communicates with the server over an insecure connection such as public Wi-Fi
, or a corporate or home network that is shared with a compromised computer. Common defenses such as switched networks are not sufficient to prevent this. An attacker situated in the user's ISP or the application's hosting infrastructure could also perform this attack. Note that an advanced adversary could potentially target any connection made over the Internet's core infrastructure.
Issue remediation
The application should instruct web browsers to only access the application using HTTPS. To do this, enable HTTP Strict Transport Security (HSTS) by adding a response header with the name 'Strict-Transport-Security' and the value 'max-age=expireTime', where expireTime is the time in seconds that browsers should remember that the site should only be accessed using HTTPS. Consider adding the 'includeSubDomains' flag if appropriate.
Note that because HSTS is a "trust on first use" (TOFU) protocol, a user who has never accessed the application will never have seen the HSTS header, and will therefore still be vulnerable to SSL stripping attacks. To mitigate this risk, you can optionally add the 'preload' flag to the HSTS header, and submit the domain for review by browser vendors.
References
Vulnerability classifications
1.1. http://1.1.1.1/dradis/sessions
Next
Summary
|
Severity: |
High |
Confidence: |
Certain |
Host: |
http://1.1.1.1 |
Path: |
/dradis/sessions |
Issue detail
The page contains a form with the following action URL, which is submitted over clear-text HTTP:- http://1.1.1.1/dradis/sessions
The form contains the following password field:
Request
GET / HTTP/1.1
Host: github.com/dradis/dradis-burp
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:66.0) Gecko/20100101 Firefox/66.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en,es-ES;q=0.8,es;q=0.5,en-US;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Cookie: hpage=1; AMCV_2387401053DB208C0A490D4C%40AdobeOrg=-1891778711%7CMCIDTS%7C17970%7CMCMID%7C21612935572021633722025223033275851039%7CMCAAMLH-1553169173%7C6%7CMCAAMB-1553169173%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1552571573s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C2.4.0; uid=W9g/8Fux09NcLDHUBLt6Ag==#b4a7fa78e6c4983b02b41f0c993c2043; uid_ns=W9g/8Fux09NcLDHUBLt6Ag==; dtm_dds=3/14/2019%7C; s_lv=1538401711844; asaleatorio=v6|NO; _cb_ls=1; _cb=CHsEZNVjLgK9Eh3g; _chartbeat2=.1538380775140.1552564528405.0000000000000001.DULUU_5XcVyr-M7oTDU5YBMxsZ0.2; __gads=ID=06fd97433187c959:T=1538380762:S=ALNI_MZNHKQ5IoHIQX9fc91pDzlf7PDN4g; pbsconsent=BOU8kdHOU8kdHABABAENBq-AAAAht7_______9______9uz_Gv_v_f__33e8__9v_l_7_-___u_-33d4-_1vX99yfm1-7ftr3tp_86ues2_Xur_959_-njE; _v__chartbeat3=ChrB4_B73EobCceMDU; kppid=W9g/8Fux09NcLDHUBLt6Ag==; assegmento=v14|#feminismo; asnumdisplays=v14|1; aslastdisplay=v14|1552564374379; _fbp=fb.1.1552564376436.938848531; hst=1552520446_153124; cto_lwid=a6243aac-07e7-4c94-b258-b67ada2611d6; cto_idcpy=fec01c29-01e9-4fa7-b32d-b9ca0b82f535
Upgrade-Insecure-Requests: 1
Response
HTTP/1.1 200 OK
Server: nginx/1.3.5 epet/0.8.0.2
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=10
Content-Length: 361046
Vary: Accept-Encoding
Date: Thu, 02 May 2019 09:39:41 GMT
Connection: close
Set-Cookie: eptz=ES; path=/; domain=.github.com/dradis/dradis-burp
Set-Cookie: ak_bmsc=B2AE61FE579F4E9ADD81AF3E8BA2B9495C7AF27CEB620000DDBACA5C8327AB7C~plqa0dlFUk69S2EZU8MlTQI/GS+BP8NBdEoTcsdaugLA/WMoI2CFXYV1uhfrS8b/TJW4wY7jK+J88eP76x5h46tZrxSTfqGTFH0kzRnxB8ek5KcCAGpVsC9tqQ78yHBbup5wJzfFSrwvAcEHsnhioKB5D2/2nOLmiyfGPpFemjhnoORzbaV8bWK+4xyD9uo61YxWMEm3cMF06MMDmW/hjj0Sh8qZ28XlWmUtt3G0iMTE4=; expires=Thu, 02 May 2019 11:39:41 GMT; max-age=7200; path=/; domain=.github.com/dradis/dradis-burp; HttpOnly
<!DOCTYPE html>
<html lang="es">
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="format-detection" content="address=no,email=no,telephone=no">
<meta nam
...[SNIP]...
Report generated by Burp Suite web vulnerability scanner v2.0.20beta, at Thu May 02 10:52:22 WEST 2019.