Skip to content

Commit 632165b

Browse files
aymaneallaouiaymaneallaoui
committed
refactor:refactor the readme file
1 parent 150bc88 commit 632165b

File tree

4 files changed

+168
-1
lines changed

4 files changed

+168
-1
lines changed

‎README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
# GoHTTPScanner
1+
# Kafka HTTP Scanner
2+
3+
![terminal](docs/image/terminal.png)
24

35
An advanced HTTP security vulnerability scanner that detects a wide range of web application vulnerabilities.
46

‎docs/image/terminal.png

723 KB
Loading

‎report.json

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"target": "https://www.hackthissite.org",
3+
"timestamp": "2025-03-23T23:09:59Z",
4+
"duration": "25.395962239s",
5+
"vulnerabilities": [
6+
{
7+
"id": "CLICKJACK-01",
8+
"name": "Clickjacking Vulnerability",
9+
"description": "The application is vulnerable to clickjacking attacks",
10+
"severity": "MEDIUM",
11+
"cvss": 6.5,
12+
"detail": "The application does not set X-Frame-Options or CSP frame-ancestors directive",
13+
"remediation": "Set X-Frame-Options header to DENY or SAMEORIGIN, or use CSP frame-ancestors directive",
14+
"reference": "https://owasp.org/www-community/attacks/Clickjacking"
15+
},
16+
{
17+
"id": "HEADER-01",
18+
"name": "Missing X-Frame-Options Header",
19+
"description": "The X-Frame-Options header is not set, which may allow clickjacking attacks",
20+
"severity": "MEDIUM",
21+
"cvss": 5.8,
22+
"detail": "X-Frame-Options header prevents a web page from being displayed in a frame on another domain",
23+
"remediation": "Add X-Frame-Options header with value DENY or SAMEORIGIN",
24+
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options"
25+
},
26+
{
27+
"id": "HEADER-03",
28+
"name": "Missing X-Content-Type-Options Header",
29+
"description": "The X-Content-Type-Options header is not set",
30+
"severity": "LOW",
31+
"cvss": 3.7,
32+
"detail": "X-Content-Type-Options prevents MIME type sniffing",
33+
"remediation": "Add X-Content-Type-Options header with value nosniff",
34+
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options"
35+
},
36+
{
37+
"id": "INFO-01",
38+
"name": "Server Information Disclosure",
39+
"description": "The server header discloses version information",
40+
"severity": "LOW",
41+
"cvss": 3.1,
42+
"detail": "Server header contains: HackThisSite",
43+
"remediation": "Configure the server to provide minimal information in the Server header",
44+
"reference": "https://www.owasp.org/index.php/Fingerprint_Web_Server_(OTG-INFO-002)"
45+
},
46+
{
47+
"id": "HTTP-SMUGGLE-01",
48+
"name": "HTTP Request Smuggling (CL.TE)",
49+
"description": "The server is vulnerable to HTTP request smuggling using Content-Length and Transfer-Encoding headers",
50+
"severity": "HIGH",
51+
"cvss": 8.1,
52+
"detail": "The server appears to process both Content-Length and Transfer-Encoding headers, which can lead to request smuggling attacks.",
53+
"evidence": "Server accepted malformed request with conflicting headers",
54+
"remediation": "Configure the server to reject requests with both Content-Length and Transfer-Encoding headers or ensure consistent handling.",
55+
"reference": "https://portswigger.net/web-security/request-smuggling"
56+
},
57+
{
58+
"id": "HTTP-SMUGGLE-02",
59+
"name": "HTTP Request Smuggling (TE.CL)",
60+
"description": "The server is vulnerable to HTTP request smuggling using Transfer-Encoding and Content-Length headers",
61+
"severity": "HIGH",
62+
"cvss": 8.1,
63+
"detail": "The server appears to process Transfer-Encoding over Content-Length, which can lead to request smuggling attacks.",
64+
"evidence": "Server accepted malformed request with conflicting headers",
65+
"remediation": "Configure the server to reject requests with both Content-Length and Transfer-Encoding headers or ensure consistent handling.",
66+
"reference": "https://portswigger.net/web-security/request-smuggling"
67+
}
68+
],
69+
"stats": {
70+
"critical": 0,
71+
"high": 2,
72+
"medium": 2,
73+
"low": 2,
74+
"info": 0,
75+
"total": 6
76+
}
77+
}

‎report2.json

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"target": "https://www.hackthissite.org",
3+
"timestamp": "2025-03-24T00:32:43Z",
4+
"duration": "20.002003241s",
5+
"vulnerabilities": [
6+
{
7+
"id": "HEADER-01",
8+
"name": "Missing X-Frame-Options Header",
9+
"description": "The X-Frame-Options header is not set, which may allow clickjacking attacks",
10+
"severity": "MEDIUM",
11+
"cvss": 5.8,
12+
"detail": "X-Frame-Options header prevents a web page from being displayed in a frame on another domain",
13+
"remediation": "Add X-Frame-Options header with value DENY or SAMEORIGIN",
14+
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options"
15+
},
16+
{
17+
"id": "HEADER-03",
18+
"name": "Missing X-Content-Type-Options Header",
19+
"description": "The X-Content-Type-Options header is not set",
20+
"severity": "LOW",
21+
"cvss": 3.7,
22+
"detail": "X-Content-Type-Options prevents MIME type sniffing",
23+
"remediation": "Add X-Content-Type-Options header with value nosniff",
24+
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options"
25+
},
26+
{
27+
"id": "INFO-01",
28+
"name": "Server Information Disclosure",
29+
"description": "The server header discloses version information",
30+
"severity": "LOW",
31+
"cvss": 3.1,
32+
"detail": "Server header contains: HackThisSite",
33+
"remediation": "Configure the server to provide minimal information in the Server header",
34+
"reference": "https://www.owasp.org/index.php/Fingerprint_Web_Server_(OTG-INFO-002)"
35+
},
36+
{
37+
"id": "SQLI-02",
38+
"name": "Time-Based Blind SQL Injection",
39+
"description": "The application appears vulnerable to time-based blind SQL injection",
40+
"severity": "CRITICAL",
41+
"cvss": 8.5,
42+
"detail": "The application response time increased significantly with a time-delay SQL payload",
43+
"evidence": "Payload: '; WAITFOR DELAY '0:0:2'--, Response time: 1.5005967230000001 seconds",
44+
"remediation": "Use parameterized queries or prepared statements",
45+
"reference": "https://owasp.org/www-community/attacks/Blind_SQL_Injection"
46+
},
47+
{
48+
"id": "HTTP-SMUGGLE-01",
49+
"name": "HTTP Request Smuggling (CL.TE)",
50+
"description": "The server is vulnerable to HTTP request smuggling using Content-Length and Transfer-Encoding headers",
51+
"severity": "HIGH",
52+
"cvss": 8.1,
53+
"detail": "The server appears to process both Content-Length and Transfer-Encoding headers, which can lead to request smuggling attacks.",
54+
"evidence": "Server accepted malformed request with conflicting headers",
55+
"remediation": "Configure the server to reject requests with both Content-Length and Transfer-Encoding headers or ensure consistent handling.",
56+
"reference": "https://portswigger.net/web-security/request-smuggling"
57+
},
58+
{
59+
"id": "HTTP-SMUGGLE-02",
60+
"name": "HTTP Request Smuggling (TE.CL)",
61+
"description": "The server is vulnerable to HTTP request smuggling using Transfer-Encoding and Content-Length headers",
62+
"severity": "HIGH",
63+
"cvss": 8.1,
64+
"detail": "The server appears to process Transfer-Encoding over Content-Length, which can lead to request smuggling attacks.",
65+
"evidence": "Server accepted malformed request with conflicting headers",
66+
"remediation": "Configure the server to reject requests with both Content-Length and Transfer-Encoding headers or ensure consistent handling.",
67+
"reference": "https://portswigger.net/web-security/request-smuggling"
68+
},
69+
{
70+
"id": "CLICKJACK-01",
71+
"name": "Clickjacking Vulnerability",
72+
"description": "The application is vulnerable to clickjacking attacks",
73+
"severity": "MEDIUM",
74+
"cvss": 6.5,
75+
"detail": "The application does not set X-Frame-Options or CSP frame-ancestors directive",
76+
"remediation": "Set X-Frame-Options header to DENY or SAMEORIGIN, or use CSP frame-ancestors directive",
77+
"reference": "https://owasp.org/www-community/attacks/Clickjacking"
78+
}
79+
],
80+
"stats": {
81+
"critical": 1,
82+
"high": 2,
83+
"medium": 2,
84+
"low": 2,
85+
"info": 0,
86+
"total": 7
87+
}
88+
}

0 commit comments

Comments
 (0)