QCEO 2021.12.09 웹취약점 점검 결과 (Medium 1, Low 3, Informational 3)
[Medium 1]
=======================================================================
Unencrypted password form
The HTTP protocol by itself is clear text, meaning that any data that is transmitted via HTTP can be captured and the contents viewed.
To keep data private, and prevent it from being intercepted, HTTP is often tunnelled through either Secure Sockets Layer (SSL), or Transport Layer Security (TLS). When either of these encryption standards are used it is referred to as HTTPS.
Cyber-criminals will often attempt to compromise credentials passed from the client to the server using HTTP. This can be conducted via various different Man-in-The-Middle (MiTM) attacks or through network packet captures.
Arachni discovered that the affected page contains a password input, however, the value of the field is not sent to the server utilising HTTPS. Therefore it is possible that any submitted credential may become compromised.
http://192.168.120.166:8000/ password
=======================================================================
[Low 3]
=L1======================================================================
Password field with auto-complete 1
In typical form-based web applications, it is common practice for developers to allow autocomplete within the HTML form to improve the usability of the page. With autocomplete enabled (default), the browser is allowed to cache previously entered form values.
For legitimate purposes, this allows the user to quickly re-enter the same data when completing the form multiple times.
When autocomplete is enabled on either/both the username and password fields, this could allow a cyber-criminal with access to the victim’s computer the ability to have the victim’s credentials automatically entered as the cyber-criminal visits the affected page.
Arachni has discovered that the affected page contains a form containing a password field that has not disabled autocomplete.
http://192.168.120.166:8000/
=======================================================================
=L2======================================================================
Common administration interface 1
An administration interface was identified and should be reviewed.
http://192.168.120.166:8000/admin/login/?next=/admin/
=======================================================================
=L3======================================================================
Missing 'X-Frame-Options' header 1
Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.
The server didn’t return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack.
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page inside a frame or iframe. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.
http://192.168.120.166:8000/static/css/login.css
=======================================================================
[Informational 3]
=I1======================================================================
Allowed HTTP methods 1
There are a number of HTTP methods that can be used on a webserver (OPTIONS, HEAD, GET, POST, PUT, DELETE etc.). Each of these methods perform a different function and each have an associated level of risk when their use is permitted on the webserver.
A client can use the OPTIONS method within a request to query a server to determine which methods are allowed.
Cyber-criminals will almost always perform this simple test as it will give a very quick indication of any high-risk methods being permitted by the server.
Arachni discovered that several methods are supported by the server.
http://192.168.120.166:8000/
=======================================================================
=I2======================================================================
Interesting response 1
The server responded with a non 200 (OK) nor 404 (Not Found) status code. This is a non-issue, however exotic HTTP response status codes can provide useful insights into the behavior of the web application and assist with the penetration test.
http://192.168.120.166:8000/
=======================================================================
=I3======================================================================
HttpOnly cookie 1
HTTP by itself is a stateless protocol. Therefore the server is unable to determine which requests are performed by which client, and which clients are authenticated or unauthenticated.
The use of HTTP cookies within the headers, allows a web server to identify each individual client and can therefore determine which clients hold valid authentication, from those that do not. These are known as session cookies.
When a cookie is set by the server (sent the header of an HTTP response) there are several flags that can be set to configure the properties of the cookie and how it is to be handled by the browser.
The HttpOnly flag assists in the prevention of client side-scripts (such as JavaScript) accessing and using the cookie.
This can help prevent XSS attacks targeting the cookies holding the client’s session token (setting the HttpOnly flag does not prevent, nor safeguard against XSS vulnerabilities themselves).
http://192.168.120.166:8000/
=======================================================================
