Website Vulnerability Scanner Report

 https://jscrambler.com

Summary

Overall risk level: Risk ratings: Scan information:

Medium High: 0 Start time: 2023-07-31 22:27:32 UTC+03
Medium: 3 Finish time: 2023-07-31 22:29:13 UTC+03

Low: 7 Scan duration: 1 min, 41 sec

Info: 9 Tests performed: 19/19

Scan status: Finished

Findings

 Insecure cookie setting: missing Secure flag CONFIRMED

Cookie
URL Evidence
Name

Set-Cookie: XSRF-
TOKEN=eyJpdiI6IjM4cFZFL09JaWtqeE0ydDhzWFlPMUE9PSIsInZhbHVlIjoicnhvVDdvbFNrbmRJMisrUHNZZW
k5cjVwTHp2d1BWQ0FFNDJNTXRaTU9VT21aQVkrU0NxY2ZPbEFRZEtMeUd5M2x0ekIrSHdqdFRpZndNWjBR
Q1VJaHRHdUJYZG9UWjlLVTVNdWx2cDRrTjViMkNBQXo3L3dpSWQ0a3o5d09tbC8iLCJtYWMiOiI5M2RlOWI
5ZTA0NjAyMDRlNjdjMDQ5MDJjNWU0OTgzMGMyMWMzZDhmMzIxMjVlNDFkM2JiYmIyOWViNGUwNmNkIiw
XSRF- idGFnIjoiIn0%3D; expires=Mon, 31 Jul 2023 21:27:33 GMT; Max-Age=7200; path=/; samesite=lax,
https://jscrambler.com
TOKEN jscrambler_session=eyJpdiI6IjFZVHZxOUhqWFBZbTNlUElaNVZJelE9PSIsInZhbHVlIjoiVVBsVkZSZUU3aGtYO
FVjZEVrQ0V0ZzZkWk9VRFpmS3hHdTRadlBBaE9Ka1cveWc1MU96ZGtNaGxSNC9kQk5RNW9wQm1PQWQy
WXlxWExOend5NWNGcTVFRGZtY3BJNlJ2V3RKdnkxZGpuMTAxejBSdnhybzJEL1A3QTkvQ2JSM20iLCJtYW
MiOiIyN2RiM2NiN2MzNThiMWQ2MmY2ZTYwMTdlOTJlMGM2NWJmNDdmNzNmMTZjMGRjYzk3NTk1ZDY4O
WNjZGNjNjg2IiwidGFnIjoiIn0%3D; expires=Mon, 31 Jul 2023 21:27:33 GMT; Max-Age=7200; path=/;
httponly; samesite=lax

 Details

Risk description:
Since the Secure flag is not set on the cookie, the browser will send it over an unencrypted channel (plain HTTP) if such a request is made.
Thus, the risk exists that an attacker will intercept the clear-text communication between the browser and the server and he will steal the
cookie of the user. If this is a session cookie, the attacker could gain unauthorized access to the victim's web session.

Recommendation:
Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted channel. Ensure
that the secure flag is set for cookies containing such sensitive information.

References:
https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/06-
Session_Management_Testing/02-Testing_for_Cookies_Attributes.html

Classification:
CWE : CWE-614
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Insecure cookie setting: missing HttpOnly flag CONFIRMED

Cookie
URL Evidence
Name

1/7
 The server responded with Set-Cookie header(s) that does not specify the HttpOnly flag:
Set-Cookie: XSRF-
TOKEN=eyJpdiI6IjM4cFZFL09JaWtqeE0ydDhzWFlPMUE9PSIsInZhbHVlIjoicnhvVDdvbFNrbmRJMisrUHNZZW
XSRF-
https://jscrambler.com k5cjVwTHp2d1BWQ0FFNDJNTXRaTU9VT21aQVkrU0NxY2ZPbEFRZEtMeUd5M2x0ekIrSHdqdFRpZndNWjBR
TOKEN
Q1VJaHRHdUJYZG9UWjlLVTVNdWx2cDRrTjViMkNBQXo3L3dpSWQ0a3o5d09tbC8iLCJtYWMiOiI5M2RlOWI
5ZTA0NjAyMDRlNjdjMDQ5MDJjNWU0OTgzMGMyMWMzZDhmMzIxMjVlNDFkM2JiYmIyOWViNGUwNmNkIiw
idGFnIjoiIn0%3D

 Details

Risk description:
A cookie has been set without the HttpOnly flag, which means that it can be accessed by the JavaScript code running inside the web page.
If an attacker manages to inject malicious JavaScript code on the page (e.g. by using an XSS attack) then the cookie will be accessible and it
can be transmitted to another site. In case of a session cookie, this could lead to session hijacking.

Recommendation:
Ensure that the HttpOnly flag is set for all cookies.

References:
https://owasp.org/www-community/HttpOnly

Classification:
CWE : CWE-1004
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Vulnerabilities found for server-side software UNCONFIRMED 

Risk Affected
CVSS CVE Summary Exploit
Level software

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products,
mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an jquery
 4.3 CVE-2019-11358 N/A
unsanitized source object contained an enumerable __proto__ property, it could 1.10.2
extend the native Object.prototype.

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from
untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation jquery
 4.3 CVE-2020-11022 N/A
methods (i.e. .html(), .append(), and others) may execute untrusted code. This 1.10.2
problem is patched in jQuery 3.5.0.

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML
containing <option> elements from untrusted sources - even after sanitizing it - to jquery
 4.3 CVE-2020-11023 N/A
one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may 1.10.2
execute untrusted code. This problem is patched in jQuery 3.5.0.

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a

jquery
 4.3 CVE-2015-9251 cross-domain Ajax request is performed without the dataType option, causing N/A
1.10.2
text/javascript responses to be executed.

 Details

Risk description:
These vulnerabilities expose the affected applications to the risk of unauthorized access to confidential data and possibly to denial of
service attacks. An attacker could search for an appropriate exploit (or create one himself) for any of these vulnerabilities and use it to
attack the system.

Recommendation:
We recommend you to upgrade the affected software to the latest version in order to eliminate the risk of these vulnerabilities.

Classification:
CWE : CWE-1026
OWASP Top 10 - 2013 : A9 - Using Components with Known Vulnerabilities
OWASP Top 10 - 2017 : A9 - Using Components with Known Vulnerabilities

 Missing security header: Content-Security-Policy CONFIRMED

2/7
 URL Evidence

https://jscrambler.com Response headers do not include the HTTP Content-Security-Policy security header

 Details

Risk description:
The Content-Security-Policy (CSP) header activates a protection mechanism implemented in web browsers which prevents exploitation of
Cross-Site Scripting vulnerabilities (XSS). If the target application is vulnerable to XSS, lack of this header makes it easily exploitable by
attackers.

Recommendation:
Configure the Content-Security-Header to be sent with each HTTP response in order to apply the specific policies needed by the
application.

References:
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

Classification:
CWE : CWE-693
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Missing security header: X-Frame-Options CONFIRMED

URL Evidence

https://jscrambler.com Response headers do not include the HTTP X-Frame-Options security header

 Details

Risk description:
Because the X-Frame-Options header is not sent by the server, an attacker could embed this website into an iframe of a third party
website. By manipulating the display attributes of the iframe, the attacker could trick the user into performing mouse clicks in the
application, thus performing activities without user consent (ex: delete user, subscribe to newsletter, etc). This is called a Clickjacking attack
and it is described in detail here:
https://owasp.org/www-community/attacks/Clickjacking

Recommendation:
We recommend you to add the X-Frame-Options HTTP header with the values DENY or SAMEORIGIN to every page that you want to be
protected against Clickjacking attacks.

References:
https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html

Classification:
CWE : CWE-693
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Missing security header: X-Content-Type-Options CONFIRMED

URL Evidence

https://jscrambler.com Response headers do not include the X-Content-Type-Options HTTP security header

 Details

Risk description:
The HTTP header X-Content-Type-Options is addressed to the Internet Explorer browser and prevents it from reinterpreting the content of
a web page (MIME-sniffing) and thus overriding the value of the Content-Type header). Lack of this header could lead to attacks such as
Cross-Site Scripting or phishing.

Recommendation:

3/7
 We recommend setting the X-Content-Type-Options header such as X-Content-Type-Options: nosniff .

References:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options

Classification:
CWE : CWE-693
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Missing security header: Referrer-Policy CONFIRMED

URL Evidence

Response headers do not include the Referrer-Policy HTTP security header as well as the <meta> tag with name
https://jscrambler.com
'referrer' is not present in the response.

 Details

Risk description:
The Referrer-Policy HTTP header controls how much referrer information the browser will send with each request originated from the current
web application.
For instance, if a user visits the web page "http://example.com/pricing/" and it clicks on a link from that page going to e.g.
"https://www.google.com", the browser will send to Google the full originating URL in the Referer header, assuming the Referrer-Policy
header is not set. The originating URL could be considered sensitive information and it could be used for user tracking.

Recommendation:
The Referrer-Policy header should be configured on the server side to avoid user tracking and inadvertent information leakage. The value
no-referrer of this header instructs the browser to omit the Referer header entirely.

References:
https://developer.mozilla.org/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns

Classification:
CWE : CWE-693
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Missing security header: X-XSS-Protection CONFIRMED

URL Evidence

https://jscrambler.com Response headers do not include the HTTP X-XSS-Protection security header

 Details

Risk description:
The X-XSS-Protection HTTP header instructs the browser to stop loading web pages when they detect reflected Cross-Site Scripting
(XSS) attacks. Lack of this header exposes application users to XSS attacks in case the web application contains such vulnerability.

Recommendation:
We recommend setting the X-XSS-Protection header to X-XSS-Protection: 1; mode=block .

References:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

Classification:
CWE : CWE-693
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Robots.txt file found CONFIRMED

URL

4/7
 https://jscrambler.com/robots.txt

 Details

Risk description:
There is no particular security risk in having a robots.txt file. However, this file is often misused by website administrators to try to hide some
web pages from the users. This should not be considered a security measure because these URLs can be easily read directly from the
robots.txt file.

Recommendation:
We recommend you to manually review the entries from robots.txt and remove the ones which lead to sensitive locations in the website (ex.
administration panels, configuration files, etc).

References:
https://www.theregister.co.uk/2015/05/19/robotstxt/

Classification:
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Server software and technology found UNCONFIRMED 

Software / Version Category

PHP 8.1.21 Programming languages

Laravel Web frameworks

jQuery CDN CDN

cdnjs CDN

Cloudflare CDN

Livewire Web frameworks, Miscellaneous

Alpine.js JavaScript frameworks

Linkedin Insight Tag Analytics

jQuery UI 1.11.4 JavaScript libraries

jQuery 1.10.2 JavaScript libraries

Highlight.js JavaScript libraries

Google Tag Manager Tag managers

Google Analytics Analytics

HSTS Security

 Details

Risk description:
An attacker could use this information to mount specific attacks against the identified software type and version.

Recommendation:
We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating
system: HTTP server headers, HTML meta information, etc.

References:
https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/01-Information_Gathering/02-
Fingerprint_Web_Server.html

Classification:
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

5/7
 Security.txt file is missing CONFIRMED

URL

Missing: https://jscrambler.com/.well-known/security.txt

 Details

Risk description:
We have detected that the server is missing the security.txt file. There is no particular risk in not creating a valid Security.txt file for your
server. However, this file is important because it offers a designated channel for reporting vulnerabilities and security issues.

Recommendation:
We recommend you to implement the security.txt file according to the standard, in order to allow researchers or users report any security
issues they find, improving the defensive mechanisms of your server.

References:
https://securitytxt.org/

Classification:
OWASP Top 10 - 2013 : A5 - Security Misconfiguration
OWASP Top 10 - 2017 : A6 - Security Misconfiguration

 Website is accessible.

 Nothing was found for client access policies.

 Nothing was found for use of untrusted certificates.

 Nothing was found for enabled HTTP debug methods.

 Nothing was found for secure communication.

 Nothing was found for directory listing.

 Nothing was found for missing HTTP header - Strict-Transport-Security.

 Nothing was found for domain too loose set for cookies.

Scan coverage information

List of tests performed (19/19)

 Checking for website accessibility...
 Checking for missing HTTP header - Content Security Policy...
 Checking for missing HTTP header - X-Frame-Options...
 Checking for missing HTTP header - X-Content-Type-Options...
 Checking for missing HTTP header - Referrer...
 Checking for Secure flag of cookie...
 Checking for missing HTTP header - X-XSS-Protection...
 Checking for HttpOnly flag of cookie...

6/7
  Checking for website technologies...
 Checking for vulnerabilities of server-side software...
 Checking for client access policies...
 Checking for robots.txt file...
 Checking for absence of the security.txt file...
 Checking for use of untrusted certificates...
 Checking for enabled HTTP debug methods...
 Checking for secure communication...
 Checking for directory listing...
 Checking for missing HTTP header - Strict-Transport-Security...
 Checking for domain too loose set for cookies...

Scan parameters
Website URL: https://jscrambler.com
Scan type: Light
Authentication: False

Scan stats
Unique Injection Points Detected: 60
URLs spidered: 1
Total number of HTTP requests: 9
Average time until a response was
272ms
received:

7/7