| Absence of Anti-CSRF Tokens |
|
| Anti-CSRF Tokens Check |
|
| Charset Mismatch |
|
| Content Security Policy (CSP) Header Not Set |
|
| Content Security Policy (CSP) Report-Only Header Found |
|
| Content-Type Header Empty |
|
| Content-Type Header Missing |
|
| Cookie No HttpOnly Flag |
|
| Cookie Poisoning |
|
| Cookie Slack Detector |
|
| Cookie with Invalid SameSite Attribute |
|
| Cookie with SameSite Attribute None |
|
| Cookie without SameSite Attribute |
|
| Cookie Without Secure Flag |
|
| CORS Header |
|
| CORS Misconfiguration |
|
| CORS Misconfiguration |
|
| CRLF Injection |
|
| Cross-Domain JavaScript Source File Inclusion |
|
| Cross-Domain Misconfiguration |
|
| CSP: Failure to Define Directive with No Fallback |
|
| CSP: Header & Meta |
|
| CSP: Malformed Policy (Non-ASCII) |
|
| CSP: Meta Policy Invalid Directive |
|
| CSP: Notices |
|
| CSP: script-src unsafe-eval |
|
| CSP: script-src unsafe-hashes |
|
| CSP: script-src unsafe-inline |
|
| CSP: style-src unsafe-hashes |
|
| CSP: style-src unsafe-inline |
|
| CSP: Wildcard Directive |
|
| CSP: X-Content-Security-Policy |
|
| CSP: X-WebKit-CSP |
|
| Deprecated Feature Policy Header Set |
|
| Directory Browsing |
|
| Directory Browsing |
|
| Emails Found in the Viewstate |
|
| HTTPS Content Available via HTTP |
|
| In Page Banner Information Leak |
|
| Information Disclosure - Sensitive Information in HTTP Referrer Header |
|
| Information Disclosure - Sensitive Information in URL |
|
| Insufficient Site Isolation Against Spectre Vulnerability |
|
| Insufficient Site Isolation Against Spectre Vulnerability |
|
| Insufficient Site Isolation Against Spectre Vulnerability |
|
| Loosely Scoped Cookie |
|
| Missing Anti-clickjacking Header |
|
| Modern Web Application |
|
| Multiple X-Frame-Options Header Entries |
|
| Non-Storable Content |
|
| Obsolete Content Security Policy (CSP) Header Found |
|
| Old Asp.Net Version in Use |
|
| Permissions Policy Header Not Set |
|
| Potential IP Addresses Found in the Viewstate |
|
| Proxy Disclosure |
|
| Re-examine Cache-control Directives |
|
| Referer Exposes Session ID |
|
| Retrieved from Cache |
|
| Retrieved from Cache |
|
| Secure Pages Include Mixed Content |
|
| Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) |
|
| Server Leaks its Webserver Application via "Server" HTTP Response Header Field |
|
| Server Leaks Version Information via "Server" HTTP Response Header Field |
|
| Session ID in URL Rewrite |
|
| Session ID in URL Rewrite |
|
| Split Viewstate in Use |
|
| Storable and Cacheable Content |
|
| Storable but Non-Cacheable Content |
|
| Strict-Transport-Security Defined via META (Non-compliant with Spec) |
|
| Strict-Transport-Security Disabled |
|
| Strict-Transport-Security Header Not Set |
|
| Strict-Transport-Security Header on Plain HTTP Response |
|
| Strict-Transport-Security Malformed Content (Non-compliant with Spec) |
|
| Strict-Transport-Security Max-Age Malformed (Non-compliant with Spec) |
|
| Strict-Transport-Security Missing Max-Age (Non-compliant with Spec) |
|
| Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) |
|
| Sub Resource Integrity Attribute Missing |
|
| Timestamp Disclosure - Unix |
|
| User Agent Fuzzer |
|
| User Controllable Charset |
|
| Viewstate without MAC Signature (Sure) |
|
| Viewstate without MAC Signature (Unsure) |
|
| X-AspNet-Version Response Header |
|
| X-Backend-Server Header Information Leak |
|
| X-ChromeLogger-Data (XCOLD) Header Information Leak |
|
| X-Content-Type-Options Header Missing |
|
| X-Debug-Token Information Leak |
|
| X-Frame-Options Defined via META (Non-compliant with Spec) |
|
| X-Frame-Options Setting Malformed |
|