第六周作业
作者：大肚皮狒狒
- 2023-09-25 广东
本文字数：46893 字
阅读完需：约 154 分钟
使用 Burp 的 Discover Content 功能爬取任意站点的目录，给出爬取过程的说明文档、站点树截图；
1,打开 Burp，设置 Proxy Listeners
2，本地开启靶场 http://localhost:8080/index.php
3，在 firefox 里面设置代理。
4，在 Burp HTTP history 中找到 http://localhost:8080/index.php 进行扫描
站点树截图
-------------------------------------------------------------------------------
分别使用 Burp Scan 的主动扫描和被动扫描功能对 DVWA 站点进行扫描，输出扫描报告
<html><head><title>Burp Scanner Report</title><meta http-equiv="Content-Security-Policy" content="default-src 'none';img-src 'self' data:;style-src 'unsafe-inline'" /><style type="text/css">body { background: #dedede; font-family: 'Droid sans', Helvetica, Arial, sans-serif; color: #404042; -webkit-font-smoothing: antialiased; }#container { width: 930px; padding: 0 15px; margin: 20px auto; background-color: #ffffff; }table { font-family: Arial, sans-serif; }a:link, a:visited { color: #ff6633; text-decoration: none; transform: 0.3s; }a:hover, a:active { color: #e24920; text-decoration: underline; }h1 { font-size: 1.6em; line-height: 1.4em; font-weight: normal; color: #404042; }h2 { font-size: 1.3em; line-height: 1.2em; padding: 0; margin: 0.8em 0 0.3em 0; font-weight: normal; color: #404042;}h4 { font-size: 1.0em; line-height: 1.2em; padding: 0; margin: 0.8em 0 0.3em 0; font-weight: bold; color: #404042;}.rule { height: 0px; border-top: 1px solid #404042; padding: 0; margin: 20px -15px 0 -15px; }.title { color: #ffffff; background: #ff6633; margin: 0 -15px 10px -15px; overflow: hidden; }.title h1 { color: #ffffff; padding: 10px 15px; margin: 0; font-size: 1.8em; }.title img { float: right; display: inline; padding: 1px; }.heading { background: #404042; margin: 0 -15px 10px -15px; padding: 0; display: inline-block; overflow: hidden; }.heading img { float: right; display: inline; margin: 8px 10px 0 10px; padding: 0; }.code { font-family: 'Courier New', Courier, monospace; }table.overview_table { border: 2px solid #e6e6e6; margin: 0; padding: 5px;}table.overview_table td.info { padding: 5px; background: #dedede; text-align: right; border-top: 2px solid #ffffff; border-right: 2px solid #ffffff; }table.overview_table td.info_end { padding: 5px; background: #dedede; text-align: right; border-top: 2px solid #ffffff; }table.overview_table td.colour_holder { padding: 0px; border-top: 2px solid #ffffff; border-right: 2px solid #ffffff; }table.overview_table td.colour_holder_end { padding: 0px; border-top: 2px solid #ffffff; }table.overview_table td.label { padding: 5px; font-weight: bold; }table.summary_table td { padding: 5px; background: #dedede; text-align: left; border-top: 2px solid #ffffff; border-right: 2px solid #ffffff; }table.summary_table td.icon { background: #404042; }.colour_block { padding: 5px; text-align: right; display: block; font-weight: bold; }.high_certain { border: 2px solid #f00; background: #f00; }.high_firm { border: 2px solid #f66; background: #f66; }.high_tentative { border: 2px solid #fcc; background: #fcc; }.medium_certain { border: 2px solid #f90; background: #f90; }.medium_firm { border: 2px solid #ffc266; background: #ffc266; }.medium_tentative { border: 2px solid #ffebcc; background: #ffebcc; }.low_certain { border: 2px solid #fe0; background: #fe0; }.low_firm { border: 2px solid #fff566; background: #fff566; }.low_tentative { border: 2px solid #fffccc; background: #fffccc; }.info_certain { border: 2px solid #ababab; background: #ababab; }.info_firm { border: 2px solid #cdcdcd; background: #cdcdcd; }.info_tentative { border: 2px solid #eee; background: #eee; }.row_total { border: 1px solid #dedede; background: #fff; }.grad_mark { padding: 4px; border-left: 1px solid #404042; display: inline-block; }.bar { margin-top: 3px; }.TOCH0 { font-size: 1.0em; font-weight: bold; word-wrap: break-word; }.TOCH1 { font-size: 0.8em; text-indent: -20px; padding-left: 50px; margin: 0; word-wrap: break-word; }.TOCH2 { font-size: 0.8em; text-indent: -20px; padding-left: 70px; margin: 0; word-wrap: break-word; }.BODH0 { font-size: 1.6em; line-height: 1.2em; font-weight: normal; padding: 10px 15px; margin: 0 -15px 10px -15px; display: inline-block; color: #ffffff; background-color: #ff6633; width: 100%; word-wrap: break-word; }.BODH0 a:link, .BODH0 a:visited, .BODH0 a:hover, .BODH0 a:active { color: #ffffff; text-decoration: none; }.BODH1 { font-size: 1.3em; line-height: 1.2em; font-weight: normal; padding: 13px 15px; margin: 0 -15px 0 -15px; display: inline-block; width: 100%; word-wrap: break-word; }.BODH1 a:link, .BODH1 a:visited, .BODH1 a:hover, .BODH1 a:active { color: #404042; text-decoration: none; }.BODH2 { font-size: 1.0em; font-weight: bold; line-height: 2.0em; width: 100%; word-wrap: break-word; }.PREVNEXT { font-size: 0.7em; font-weight: bold; color: #ffffff; padding: 3px 10px; border-radius: 10px;}.PREVNEXT:link, .PREVNEXT:visited { color: #ff6633 !important; background: #ffffff !important; border: 1px solid #ff6633 !important; text-decoration: none; }.PREVNEXT:hover, .PREVNEXT:active { color: #fff !important; background: #e24920 !important; border: 1px solid #e24920 !important; text-decoration: none; }.TEXT { font-size: 0.8em; padding: 0; margin: 0; word-wrap: break-word; }TD { font-size: 0.8em; }.HIGHLIGHT { background-color: #fcf446; }.rr_div { border: 2px solid #ff6633; width: 916px; word-wrap: break-word; -ms-word-wrap: break-word; margin: 0.8em 0; padding: 5px; font-size: 0.8em; max-height: 300px; overflow-y: auto; }
div.scan_issue_false_positive_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhHxZdNbBNXEIDHa8d/guCUJDLCoEKiHkJVELQKRYpAQhyqCjiBOICExA24kAOIA4WcCiKppR4bbqWoDQeCkBCQVkFABOGnEIJDI2IEQQHZwbjYsfy33sfM88T2uv5Zi6R80Whn5u3MvJ19L34LRvH5fFZVVb8TQnRrmvYnyiuUGEoK5S36R1B+RdkdiUQaOezjSSQSrZj0Fy5iCJpUJpP5I5VKreU0tUNPjElOUDLOWzMYq+HlJxQHpzVGLBZbgrFDMsscgLl82MmVnL4y1DYMeMOxcwbmfIeXdi5TGrzh8/koXkCQ1hSX00PvHIvf5RvnE9otuTVh4iv4Y/6uBZYFP7BpCJfFBUktCXEtzp7SWE1WcJqdYFWs0sYHPWk2m4+SLidAbdn5z87xgfCAUi1ZIWfbzsKD6APwvvKypzI2xQYbFm2ArhVdmQ5XxyqTyTQuB3C7naHepLW0WDO8RsBfkJOR6Ih4MvNEytjMmBgIDYh9Y/vk2JXQFQoTM+qM2OPbo4s7PHFY3Pr3lhTvpFcsvrE4N+YcdIqLwYtnZHGMt2FLYjITsm1kmy5RKQbDg3KMJjVLz8seXRzdU8i10DXd+K7RXVTTpuDTf4+tcMrZIB67h7XyeGwe2NG8A+rN9ewBsCt21kqz5bMt0OJoYQvgReKFk2oruBg2s88wrY5W6PuyD5bZl7EHoMnaxFp5KG4WmjDVVrAN37LPEFPJKbgXucdWbUzEJ1gD2Niwkd7vWgXbn+9LCWibFdL7uhf2Pt3LlnGuhq6CP+6XeoOlAfYv3Q9Yu82Cdv5FIk11+lYee35M7mFCExqcD54HxaRIuxqPoo8gkArA0Psh6J7slj7Kf2n1JWi2NpNZXzUTBeOKhv7pfjgXOAfP4s94pDo9kz2w9fFWeXVb3XDQcxBG20ehvb7gJwHfQwIlx/Hnx3XbJZgM8kiWA+MHRNudNrby9AX6dHHF27AMCVqEYzwXQ6y0G/tVNQLWfkiL8Dbbhuhc3gm+dh9bHwfW/pvWwPWsmaV41c8z15VAIHAZlVzVSCbCWm1EVH1csV2CJNVW3G43nWx/ZydMp6ZZy5LQEqxVprhz1SZANam23IaKovyICyJDOv2nK2Q4MgyqUNkqz/3ofday0P+Acq+Tlj8e8U+TnjuQuG+6b6RFuiOUDrEnT52pDg4tPwSnWk6xJ88R/xHoneqFsBpmTx4T/m1v3A4XvrrAniz49F78HegkPTeBdYPrGvvX91/GU8s37NLhUByw0LKQrTxRNVrxRESnIVediy3JY5T1uAP+G4Sd+XSH0lnwWP71fEwCc75Lp9ObuExl8H7qxFx/mHzB6Y3xST/NCqF3hgn+/4/TYmY/zzHxz1iAPs+nqBAKPWUYL6M49hvqNXyeA3wAUPUS+7uslXoAAAAASUVORK5CYII=)}div.scan_issue_high_certain_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAL3SURBVFhHvZfPaxNBFMdfN8ZQLTlEghEKFSNWExApFfEmeBL/gOKp9/4F8ebNW/8A7wW9F9RTe6iUerCkND21lzaiBi0YEUyjGb9v9226m7xNZrbiBx47MzvzvvPj7ezMBFnSIDo/S/QwAzNEd1CELBVgWVgbjj7iuQN7+4PoTZ7oK9Jn5xfRdQi+6MEhnmbIKhVjlpYCKxT8MtQ9+UP06oRoTty4wyOGk2fsbEg0kzFmYcGYtTUTo1qN1UPbHp7LsElxa8dPoito/C7qrG/T08YcHoriAPxOaQNfDczkNXE/Gp42NPikOfKNR5lELqe3gcHnMZ73REYHFa6OFGcrl0VtgFZLrx+3FseUyMXhNYf4e6VR3HiUGhwPWv1hq8P6MeHJk24S1fAp3ZVsMp0OUbMpmQgHB5IYy20M9Kmkgw7wtCBR80tsODqSRIQG5tASDLQWLoXfAewkLG7/qWijtZ8B7kBWNMnDeuRQ8MR/Y4s22v19SdjBmqztYbN5jMwFKbfjbDHgw5qs7fHeLmX2DIpxhzg4HWFtXoL7krdncAkcAjAKtOc8TEVZ8va02/Fl2NuThBvQrvBXgD9nCqKjTjkDIN/fiJz5BzPAcAfco4eJfnbaxmRHh4MwXffDGRiMBwegvc1BuCl5N8JP0XEDigLtD7wE60HWEZ72lRWixUUpSMX6xGeii5eJviGTC8r+G50vRJe8Ek5g+D2+lEI3JvH/KmMb4V+LI6zJ2n4GwTCLgt94ageIYSuVjFldNabbDQ4ju7vGzMzodRWDVg+fXtUXD8GP4blWWbWtrUA4Sr2u11UMWssiewr2MrsjGZ98k8jn9TZxix3JYuDF+EPpqA4Ui3qbU0s+lIbgWD4/thMplgA+j7tED0RmNGjAM6FfTNg4CDc2RBmMCUL44ovJDXFvB8dE4tUstKmp4J6Qzarv0Tbd1SwKrxkcJF9OFeNOo/NWl1Nsx3bwjPD1HA0e8UECRbdgRdg55L9DuAnbwd7+2v56TvQXGcdZcmkc3RsAAAAASUVORK5CYII=)}div.scan_issue_high_firm_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAALmSURBVFhHpZdNaxNRFIYnCTGokI2WIqQgtrWQQhfFIpZCA67EX2Bx199QcOHCnRvpQrpyZRGh/gcX3UjBhSI2brooVKyJmEoDgUy+ru87c4ZMJjcz904eOM25X+e9n9N7HVOq1eqVXq/3SCn1ajAYfIT9hLVgHdhf5H+DvYM9bTabN6XZ9LTb7QUEfSMi4xwfK7W351uj4WWxU/1+/0On01mVMPZwxAjygsG8qGG6XaUODpSqVJRynKGxMyHQdoCfXdhVCWtGq9W6hbafvChRzs6UKpVGhQNjmQbEqmIm70j4eDhtaPBb2o7DUerEae22VBoHMS/wc19k9KDC7VhxcnKiF5+ZkQqx/OGeErlRuOYQ/ywVJ8NR6jqwuSkVEuFpGd8T3HB+uQG6PbC9LYXJQOulyDpZ/uG0ZDKZ516OCaWSOCHKZXGSgdYO+rFE3+tAPp9/hswcfSMWNMuoy5sAtbDcO/Sz6EkBGU+8ElN0o52fF8cMalI7i/V4jMQ1yTdjbk6cEBYzQKhJ7Wwul3soeeZER8t0oSAJc6jNJXggaXOWl8URomlDoL2axVTYLR4pFkdPguX6B0C7zFOAaCkIjzrlDICidwxTEZ4Bi29AFHbA9V1LwtOu+zCZ4XIT/pCEHcFR5H7QHUsDoP2Vm/BI0nYEM5ByAxJof+ESHPpJSxYXHWdry3H29yUjFYeZWq12fXZ2toGE/ZdkOtx6vX7D8/BJfIv1sKfZ9C8orisZ5lDTEydIL+G/U88vMuD8XKmNjeFdoFxW6vRUCpOB1sB13dGPBy8JUp7M2troZYS2siKFyUBrV2SHGF/JePONigd2eSmVYtFfyQgKki+lcR2o16XSRCZfSgNwLb+X2IkUS4CYF91utyIy8aA+Z0L/MCHchOvrQ/GETYhYfJjclfBmxD7NAhKOIdqme5qF4ZohwOTHqQZ2Gp2f7nEaJXieI/BrCPB5/otCMI7yH36+o+w9fIvnueP8BxSS9SUfeqeFAAAAAElFTkSuQmCC)}div.scan_issue_high_tentative_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAOISURBVFhHvZfPS1RRFMfv+KMxE1MMJHARTaXkLpDEhS5CsEUbQxFxE/0BEkgLEYo2maSL0I0EBhoULsKFIpLoJoUEJWICsUWQ0Uxm0jBjM+PMnL7n3TPOvN6bH2+EPnDm3Xd/nO+5d+69716VL16v91QsFrtJRE8TicRb2FdYCBaF/UT+B9g0rC8QCJyTZjlxyTMj4XD4ktvtvg/HnS6Xq0b9+aPU6qpSGxtKBYO6UkWFUlevKtXertTZswp1j2BvEPAjtPXqSg7hHsfj8YfcQzgjCgaJ7t0jqqoiUtCws/Jyov5+osNDowm3hY8nSJ4Wt/kRCoXOo/E7wwuzv090+bK9qJ21tBwHwcCXFyN5UdxnJxqNXkOD79JWMzdnL5TNeCTSgM9feFwXGXtQ4YJFnHnwIOW4tZVoeJhoZESLeDxm4aS53XrkzPzgOSVyZvg/h/h7qWjmxg3tdHJSMtI4wnzr6bEGwLa4KJVM8GqxzgmecLr8H8Jh3ZumJsmwYW/PPoBpXpVWoPVYZDU8LOh9TMrNrKxoZ1NTkpGBujprAGtrUmhGtOpF3uj9c11kw/Y20fi4XobZqKw0i1dXZ23DmoY40m5EFNLZBbKwYBZnGxiQQntE062wW3XqrALhXjY0mMV5zzg4kAqZYW3Upgn9WiC9vVbx3V0pzMmEwlBsyotzRkfN4s3NTsT5b1hHK/qtXx0yP09UXJwS7+rKPVGt/OYAnOPzpT5KLpfeGeNxKXRGYQHcvavFS0uJXr2SzMLgALDVOYQ/uxwA9/xkhIvw88nYEJxQUqKfd+7oZ4FAe6sIp5x1ec+ftjZJnAxobxbhifOVQ4aGlPJ4lNrdlYyCWXX5fL4ztbW1+3hx67z/RsTv99cYKXwYXhhT4j/CmoY4g/d6+UTmZmuLqKND7wO87c7OSkH+QCsRiUQaRV7DhwQpz4zfbz0V80a0vCwV8gNaYyKbIuuRLAmfC9LFk9bXJxXywnQk41Vg0NjYGMWy6EahT7KsZJr1gYAkcrKHob8NHdxuNMcBMCj4gm/0rYxB8M3HjpYWSWQGPg/gu7usrOyzZGUGlfl4nrqYpDM4qP/35PDzMT3tEmIHfPHF5Iq4zw/L1SydnR2imRmipaWsX0G05ZU1BnN2NUuHT8xwMAlnfAPOCw4awb+2LLWTkLyew/EzCPD1/BsLwRLQPMDjI8peIu3geq7UX+xyemrcb22vAAAAAElFTkSuQmCC)}div.scan_issue_info_certain_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAMwSURBVFhHvZdPaBNBFMYna/7poRBrSoQeihFbkpsXT4VeRTwF2hw85Oyth4DgQU8tRisijQevYlDBk+hJaHOQQoWKkUhKpQiJaFFSCESbkGT83uS122ST7myq+cHLvn0z+763O7OTHaFLPp/3NhqNy1LKe61W6y2sCKvC6rBfiH+EPYFdq1QqZ/iy47O3t3ceSR+ziBZUVLPZfF6r1aKcxjl0x0hym5Jx3gMQl6lUSk5NTcnR0VE5Pz8vUSi3mnAhd+Ce5LR6VKvVs7j4XTuNlYWFBYluHZZMJrnVCnLlUeA59LOnXq9fxAXf+dqeBINBSwHj4+Pc2hvkLONwCX07MPioQIcJt9v92uVyhTikDcabvd4gZwCHVzSn2pE2BwXQmKOAFzriGHP2TBKJBHtHEvT5fC+hY50TNOHQoMX+JAyHwzIQCPSdhP3A9YssK1z0Q4/F6/UWcPcnVPQ/QzVAKwrbVEPg8XhuDEucIC1MyqTyUY0PVkbwlGodEtD8Dc3TBsbjynHEi8WiWFpaEnNzcxzRgzSVNipJ4/x6O9yfcrkscrmcKJVKSrRQKIj19XV1JLAOqLhDHgmMxQaKsCWdTlsWn8MWiUS4pz7QXjPwKMJIYMv09LRYXl4WeP0ExDhqMjY2xp4+0I7QZHBMJpOxPIGZmRludUbHUqwLlmv2TEZGRthzBhVw9CKuCZZY9hxRM/AUPvOJNoPebTfQ/kCTcI3Ptel1t4MUBe0NGoLV9unxGHAIVo2dnZ03cBzNgwHFuqmRthEKhejL9hkHtfgXc4A0SVu9hoZhLGJCNFWLBnZfP3bQ+49P/LvkqwIwGTYRUwEd8N3P3mBA6wGGMU/+wUKEP5VbaHjPp45xUFQOT/wm+2YB0Wi0jicxiyJ+cKgvvcQ0h+Un+sWg84fPzQIINHzF2Fy1K2J7e5s9k62tLfZ6g5y7yD3r9/u/cKg/6DyBWdqxMVlZWZHxeFzGYjGJt8DyZ0Q2OTkp8WEis9ksX9UGuWhjcgF99Onemtl9Dxw26svCDRzuw5xtzQ5DX8xIMPzNaTf723MkfggB2p5/IyFYC5q7OHxC21P4DrbnQvwF214N3RLEYxoAAAAASUVORK5CYII=)}div.scan_issue_info_firm_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAOPSURBVFhHxZdNaBNREMdfkiZp0lJoiBBLDwU9Jf1AK5WGHupRpAcRe7Kn3rz3IArtTUFLRdCDB/Ei+HkScxIqPQmGRFKaJmkQqVVSTJNSGtPEJvE/L9MN+dh0k7bxB4+dmd19Mztv9n0IraysrJj29/cvFwqFB/l8/iPaD7QUWhYtjubL5XLPcP/Gzs6OnV87Ont7e2fR6VNygqsmKCgE8yqTybi4G1V0fK2CvtjpdM6ivxmdTmdkswSdC6/XK8LhsEin08Llcgm32y30ej0/UQTv/kVbgH0OfaTZXEbNAFKp1GmLxfIWL7nZVMbS0pLw+/2sFRkZGRGjo6OslYMggtlsdqK9vf0bmxTKQwZ48Dyc+9ScE8gOSyWCwSBL1aAvp8lk8iKQi2xSKAsAD/S1tbV9wAsONmmGhqUe6LMbl/dUU0VLESUAGnME8FqLcxrzSgYGBliqyymz2fwOfiysl2oAXzCHYplltS4HRbi6ukp/iejv769ZhGrgL7lnMBhukSwDoLRgjEL4egPpJw0ykIMvF1pYhmw0Gu+0yjlBvpCFGSkjGhuuv9DMZGgV8PsHgdj0iOQ69KadY9oVPp9PeDwetmgDzq2opSuUgcfQbxbN6lCxxeNxsbu7K9vW1paIxWJie3tb3u/s7BTT09NSboAnOmSAJp1zbFAlEAiIxcVF1qqx2WxiamqKNW3g4z/r4fwM63Xp6ekR4+PjYmxsTHR305xSjtVqZUk78O2kv6CrqNbHbreLoaEhMTw8LAYHB9laAtM3Sw3RpW3mqKCjo4OlEphHWGoMCiBTFI8GZjaWGiKjRyGoL2MqNPu1lcC3n4rQx7pmmvzaKsg3TURfWP8ffMICpn8D4VjqoEEym5ubHhqCBLLwko0tg3w6HI6U/A2RhbsoiPpbmmMEvgrY4t8nWQaALIRhk4ZWAF8PsTOSG0tlIgqFQrQF11SQ2Liy1BQBZPw2y6UAsM/LIhOTCCLGJlVqbUAP25Qyv3FYuQY/yhlBCYDAje8Ym4nDgqDluJJkMslSbdBnEn1P4mwQZZOk5sEED/ehvUBAytlgY2NDLC8vU/WK9fX1msNAqyQtWrRY9fb2slX2RweTq3AeYZNCWQYOoExgx3sJ4jyanCMSiYSIRCIiGo2q1gBlYW1tTT5LwDGNywL6u1DLuSZO+nCqmYPjOTp+BAd0PP9JjtDy8JnE5SvuPYfcwPFciH+oJiV1ec52uwAAAABJRU5ErkJggg==)}div.scan_issue_info_tentative_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAANQSURBVFhHxZfPaxNBFMcna5s0thRsYn6QS0GhkJwUQfDmUaQHEXvyL/DuSUEvUkRFEfTgQbwI/jyJnjx4FJQohqSpiBgkqWnS9GfMr6br982+7JLNbtxsa/zAsG/ebN578+btTEY4JZ1Oe7e3t0+pqnpzZ2fnLdpPtCpaE62Mlmy32w8xfn5jYyPIP9s99Xr9MIw+ICd4OoKCQjBPG41Ggs0MDs0Ytq6RMc2sAXTq0tKSurCwoKZSKbVQKEidGQ7kOkQ/m+3Bw88uqtVq1O/3v/B4PCdY1QUcilKpxD2NcDgsIpEI97pBAJlmszk7Njb2nVU6Cj918OJROE/aOSdWVlZYMqhUKiz1Altxr9f7EYEcZ5VOVwB4YXpkZOQ1fmA9lT7gtyxZA5sH8HhFNaVpNPQAeM2fOXEeCARYMrDSWXDQ5/O9hJ/emkCxXMWAIzpFmMlk+hahHfA1z261IqS0YI2ymP0+qf3HUAzwlUBblEswOjp6eVjOCfKFjF2UMqKZwrOA5iPFsIDf3whkSkEk59B37RyfrVheXha5XI41zoDz/aiF05SBe+hf0NT24BygWhGtVks6JblWqwlst3Icyyji8biUB+C+BxmgTecIK2wpl8sin89zrxfscmJmZoZ7zsDk3ytwfoj7fRkfHxexWExEo1GBb5m1BtjAWHIOfMfpK5jUuv3B9iyCwaAIhUKWm46bAMBkz1ngBFpvM4riypTcirUq2iUuA2goKIQMdxzjdrZm4PsTFWGS+47ZqwDIN21EH7j/P3iHySjPIexJHQxIo1gsvqElqCALT1g5NMgn/sJV5WIiC/MoiLYcGQLwpWJrv0GyDABZWIROKoYBfN3BbpomWS/nbDZ7BQOOChKnGEuu+IKMX2LZCCCRSDSRiTkE8YtVttDJaAZrylJfSjg9z8JPjftGAAQGfsD47N+CoCPZTOdYtgM2V2F7DqfmN1ZJLC8meHka7TEC0u8GW1tb8j4Avdjc3LScMZ2SdCzToTUxMcFaaY8uJmcw9pVVOl0Z6ECZwLXrJMRbaHJq9AdkbW1NrK+v26abskDj9C4Bx1Qst2HvmJVzR9A/Zhga/uXUTOd6DsN34YCu53lyhEYXglU8PmPsEeQBrudC/AFTuKzU4nNa5gAAAABJRU5ErkJggg==)}div.scan_issue_low_certain_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAPTSURBVFhHvZfdaxRnFMafeSe7m0Sb2mzXGGqaFgOhadESqzWCoASxojFUIWAv0uv+ASklLW3oTS960dJ7bwTBBkVsiB9IQLzQi0bTBBqwTW1oDIr5otF87uxMn3f27O5sdnZ3JkJ/sDvnnJnd57xfZ97XQED6+xBta0W7odAOB+/DQDOvtbxGeF3kI9O0xxzg5vIibjR/gtn0L0tTNoGJq2iqUvicf3zaMBCXcJaKrS2IxQ+79sqTn2GvzzEfJGHjSgr4tvEUfndvFqFoAm6L96KXor18KCLhNIaJyu0nUd34GWKvH4XBbtE8u/MerOc5PZ2I4+AHrKCvoYvfPvgmMHkZ9RUxXOLNgxLKoip3InHwLsyqBonkeDrUAHv1sXh5jFtAR+NJPBI/Szp1D5MDaDWjeOAnrlGRV33FNfb6jFgFtJgOhqcG8aH4WfIS+PsK3jKBQWVgh4QKcFKrYuVjW5yH9pp4hXAoX1MOBvSckpBLNgE95pEK9JcS16T8uxippQmxSpKoVLg81Y8q8XMJyITbJ25x2Eq/JKzlv8QqDTV2qyp8LW46gSl2C8f8KzcSgNTKlFg5vLO/HFwdPdNXWUeIm4Ay8QUz4/AHw6+1ycURscrjapno0bb68xpiXKtn3TsB8WutFWwOZNGaWltVJnGCGVVLPBAvMwcyaE2trdj97RILzEYx1y+xBIuhtRW7ok38wGwcgjAT0Au1WxW7Ypf4gXFYdLzDELb7M1C7Ra+CmrQbDm+rN9sDpCZbiMJieXog+WJcrPCwPCP87CHe0utXmIKgtRW/N5V+Zg7ol1CRV3B5HIzoSXhP3FBkJl7Al5Av1H6gh+C2+KFILf2B5ekLWBj9VCLh0drG6Hlsiddiji+jmMT/F/T4z80jrvZ0Y4n+xXQ4HIa5FWY1y4iRv2UMyEWt7S5DI4XvWJW4iQ2GitYhvv8G6j96jrojE0gcGuE2rVHulodaTsrG99p2E3ijEw/ZJW4gCNv2nEMscUw8bplfeRe1H/wiXgAM/JjZrmcL0b37+IaZ/SpuUVQ0wS35CfFyRGp2p4ejDNQYc5bxpbi5BLr6sJ600GU7eCqh0Biq7DyeWbVxxntGyCvFb3+MScdGR6kk9NZ7bfaWeDmSi2OwSpRktnyB/9vV1Im8wpGXgObNTgxbFto4J+5KqICF37qZxJB4FOfLaH74lHi+jK8lcaCho7Dm+J6MNCWPZoJehipWx3fBP2xiUqI53JVl4Cc95qGOZl7KHU794LMvfzjdSOZ4TvO43kjw+g5/naBaBe1/+XlM4THGrgc/ngP/AaoMYrity1oNAAAAAElFTkSuQmCC)}div.scan_issue_low_firm_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAOzSURBVFhHrZfPaxNREMc3m82vGhPbUow/CoKlwVaLVIvWi2gPIlIQxNLe/Cd60aInD6KI4E08eBFUFAQVepDSgxTE2kohhZZS1KIGUtsmbZLuZpP1O5vpJmm22d3UDzx2Znb3zex7896+cQk2icVi3mg02qdpWp/L5TqJFoXchFsetBTkn7B9gzyWyWRGQ6HQMr23azY3N9vy+fwTVVWXcdW2N3ltRltffKw3VUnpNjyroL2UZbmTu3EOfTE6u0udlTvUHeQy2sbScy0xcV779V4wWi4br3wO7+ZyuXtLS0sB7rYK0ylIp9MHfD7fawzpOTYZqBuzwsrni0JBSbClxP5LGcEl+lgrUSgUZhFQv9/vX2STgchXA0VRuuF8ysw5oRVkU+cuKWTqnBBFsUOSpEn0fYZNBhUBZLPZI3j4A5xH2FQFOTJD9LawZA76bHS73e8op9ikYwRAc+7xeF7Vck64/YdZqsTdcJSlmrTAx5vynDACaG9vvwnnPazuCA2zaBLEToGZ0BWJRG6zXAyAhgXOR3SLDcycScEOlqyBr2H4jJKsB4AEGYHRTbIdzIbbvadiamtCvuBzmGQxmUw2wTCo37GJ2dc6GQFmCLunTwwGg9ehmK+fHXAHWlkqQitDspeEBvjoBizLKzQFXUWTfbZPgc0VUAWmoY8C6C2q9tk+3A5WQAWYgm4KwHH4Iu16ZRtSvSOAaeigAMy3NgvKnUp76/7phfRlWA/l01DHCjCgAOSi6IzyrK83B4BMAcwWZWdsbTyUC7tIwmkKYKqoOmMrB+pNQAJJOEUBfCmqzpAa2gT/wSEh3PWMLc7BCIy7aCvGbvgbuqPd8D8gJxKJZjEcDq8gkhdsdERBXRfU9AJOSQpb7EM+8VtO62dC+jViW4zRX0q/a0Fe/iOsTQ8KudVPuk7LsLFnFMl4SNetgHM6tJ7A0S+m7wM4LM7Bdl+/a4PVr1cN5wQdVJMzN1izBr4ekXOS9QCI+fn5O7hhmZDkTE1OslZC+TuGKUmxVpOZeDx+i+VSAJ2dnXSGH0AQcTY5BydmCxLwca21tTXLeikAIhAIfMcZvr9WEDTfUvg0ayW8zRdqnozR5yr6HsB0L7BJpyIAwuv1TiLKXrwwwaYqGk+9FTz7SmUDBRU+/pS1aqgwQZV0FificTZZw6XZA7RNKrPMWk5e0+TUHEq1rOl9OFXxMQ9rlWaWWBWnZo1qQjRbxanj8hziZTT6/x5Do0mXsH8kMcw/cKXy/KP98lwQ/gEfuhb/OCSbIgAAAABJRU5ErkJggg==)}div.scan_issue_low_tentative_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAASISURBVFhHvZdNaB1VFMfPzPtMXj6aD0xbixabkthAxUJpmoVCg+AHdaG0unDjQhcuXIjR2laNushCaUFddVPBjyIV3BQtEkgWkmBbUmxJSI0Wpc0jL0lf0pe85M3kzRv/587JPOd9JPNepT+4zDln7tz/mZk7d84lv4yPj4ez2ewztm1/lsvlBtFuoaXRTLR5xH9H+xrtlVQq1SqXbYomx7JkMpn2SCTyDgZ+QdO0FttaJePOMK3dvUx2dln10YJ1FKzbQ5HWp0gPNRL6rqH9iIQ/xrXjqlMZyibAd9zZ2XkcotxCtpWm1I33aeXWWQgvSi8vWqCWah96jRo6BmDXrCdyWtf1foyxKt08lEwgnU5vq6mp+QEX9bCfM5M0P9JN2fSUOr8Z4aYeajkwqJJgkMSEaZqHo9HoTRX4D7ocXdBxH8TH1sUZc+FX3+KMuTCCp/WeeLhLTdsTDoevIJEDEnLxPAF02Ik2igu2Skix9Ec/LU19pOxw8xMUfeBZWDpZxjRlEhfIWvlLnfOgR2hrb5z0cLMEFHOGYfTgSfwpfh5+55jNl5BAEfOjvfb0BbLT/5yRSJ5cbs1Ojr2szhe2zOxF6eWBvxbn3QD3FciE2y+ui50zyMArCDXuVxOsEE0LUmPXF+J5scw5sTzsxY1+ILaTAH9qED+pIgWYC6OYhQbFHn5DIsXo4VbSozvEyxOs3SWWF2j14Sl0sK0SCIVCxxAMsF1IILodd/gl1Ww/IpHS2NmUWA5aqIlCDXvF88JaeAp9ykYmEbQkgrXqbBVk5n6m5CWemHnqHnmbGh79VLxioLkCzWbdsqzn7kVcLVATb4nnEIztprr2E+KVhjVZWw8EAr0Sq4rFa69TdnlSPEe8pXsIS/IWiZSHtXU8ioPiV8zyzVO0Gv9OPMylpm4lHog+KJGNgfY+ngN3YTc4If9kZn+i5JXn+R0oP7rtCDU9dhbLb0z5PklxArY4vrGMBM0Od8pPSaP6zgFMuj6816KVfVMqvwIs3TjhiGshanr8HNXvercqcYavMhzTP6vxc+pY3/EJ1oeXlF0lBk/CCXH8g+WXie14VR2rBdpXdXyPWGsrI9LypFj3BrTH+BUMO65/6tpPUgDrvJW5LZGqGdZmZmZibW1td+BEnNh9w0gkEi3KwpL4FX+O9xPWVOIM/A78nbLOqY0xF6/a8789bccvbrETQ7vtlfh5OeMfaOVQGXWxtluSIaMBVK/HxC1JzpylxFBHQVWsYfkdxMQ8JP7mQP80/gPqD+auHpOTkx8iucvilmQ1fr5ESW6rUr0CruFG3V+lm0BXV5eJz+IokpiRUBHlZn1hMbIBXJS+CB13j+BZP3Hib+xmDpdLgnc+peB9wGZgzAWMfbSwIvYkwHD9jkQO4oIRCblEWg9hDTgOK1/Nc5ke2/mmeKXBWLwx6Ubp53/N4TIdE7MfE8bEAB7Wlqfs9O1vUHb/ghltSbQY+bJOoblleMVwxYwBzmAw3gH7gpNG8t+vf2r/C+vbcwz8OQR4ez7NQmg5aC7gcB3nvoVdwfac6F9oIodwSlO0xgAAAABJRU5ErkJggg==)}div.scan_issue_medium_certain_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAOxSURBVFhHvZffaxxVFMe/92azm8aQaEOaFJW2WIkmEqQQNUJByJNIFNoaqD74UAoiCAq2hDStL/2RYsQ8+C9ExFalFVHfRFChLQlEEqK0ImkCsbHRJMT82N2M3zN7dnd2dzZ7JwE/kMw9Z3b3e+6Zc8/ca+DIxKuItz6O7iqLbs/gabpa4WE3r9X8W+IPzfI6DoPvlv/Ft/Uf4i/aFakYwFofDiZiOO0BR4xBo7rzNLUBB17IjH/5FFhdgOchyc9/md7E5fhFjGZuhlM2AJnxE63o5wf6KSyzzGOqgPZjQOebeXHh46eAexNqQAJhsjCMFZwxH2FV3QWEBrDSj727LK5S+Hl15al/BDj5E9DwqDoCDNG3NKNGHmZjciOJnppB/K6uHFavOTb6cYjio6HiQk1DuLiwMq+DQjjLtngMt7yzeFZdOQoC8PqwP2bxNcVb1FVKak0HRYh4el2NUvibDzEVX0lNqcsnF4A8c68an20pLiyWptgn8OzLYtDEgv7cexe71JMPQAuuU83yyCzDgli4o4MKGHRs1uKcWpkAJC0UH/A9Lizd1UEAlwwozPIpb4B9hPgBVMfQRyfXliNhs3XNABGtTeCUjK33NhKc/XH/jiths124rQM3RFO0bboBLzGiWvW7sZMaUERTtG2VQbf63CkWu097iyVYDtG2bJddarszX/QIim1HqH3IMhWPqe3O+lLhY4iY/izUbpNVUJ8xIxKcdYQlWER9rhFFJpiBe5M6iI5lf45ePUJw2YU1JheobeVVqWY0shlYYz2EvIJdoPaYFOHPakcjW3gRG1AQao9abOJ7taOx8Bt3gCPAF2+oYxtQ28y9hweaa3CfvTGh7v8HPv8/19BoW4awwhcDd5PbIF4H7GYbsYVbRhdEU7T9Zch/l9iV0v4dF+q4ZznxA1/gy8A7rIG3xoAH9+nNyshmNZXEBzL2AzDn8atnMg4nXr8G7DusBtnTDrx2XY3KsPqHE5fhd69cI5qawvu8cVPN8siu+OFn1AjQ0gEkHJqqh3HLbbpa+QDar2DDJNHL9MypKzqxCnXsYX49haPBM0IuAMEM4o+Uh54tg5CmM3tDjQBz42W35QJ/8+8U0MuzQUHjKAhAiF/ALZNCF7/A00cZRl4Bpn9Ug8jL6JOX1SjFP5ik8Vz1+dKew51ROFsezbLIMqxrBv6Z5rpKqjOPVDu/H/1oFqTi4TQECu/8cFpM9nhuLF6UjQRdTzK3TbzGaC9SdIai49bgG/fjOfAfeU8viaUaLdcAAAAASUVORK5CYII=)}div.scan_issue_medium_firm_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAN0SURBVFhHpZfbaxNBFMYnmzQXCy1tTavUgqLS0qAPBdH6pPgkUhSFgkXoX1EQL9VXUUTEJ8GiiIWKCiK+iEIfRAWl4iWlohRRiklrKcRGs7mt39k92WyS2exu8oNh55zdne/sXM7OCLfE4/FgPp8/rGnalWKx+BzlJ0oaJYvyG/4PKHdRTqVSqY38WvNkMpkdaPQmi9SS/Kxpb24YRV3XXRRUoVCYUVU1xs14h74YjVykxvRWreQy+N5pTbt1QNPOi3JZX+YHDDiQS6hGuNkafHytIJ1Ob45EIg98Pt9+dpVZjgsxdVCIvyvssDCZESIQYqMMApjPZrMj4XB4kV0mCl9N8OAQxOek4kRelYuH2qTiBNoaDAaD7xDIXnaZVASAB7YGAoGneGETu2ohIRmtUa7IQZsduDyhOWV4DMwAaMwRwP264kR7H1eq6Kho145oKBR6aJ0TZgADAwNnIL6HTXuom9u2sGGhXeKTsxuTc5LrRgDULRA/p3vcIAuge5ArzkBrAr3QT3U9gJaWltNw+qnuik5Jd8t8NpAWemGC6goiCcFxUr/jFtnXdm7nijtIk7QVJIojMDaw3x2yieihBwjSJG3F7/cfYp97qr+WbJscUA/SpiEYZts90aoUX227BNpDCrrC2+ARYSQj60rwOP4loD1Iq8AmtTlg/eruhn96bWYi8ow18XjIAdVQAPi7NIC122WJyR0qTcJ5NrxRWor0c7L7PzgA7fc0CV+z7Y1SDzQ4AQloz9EQzBqmR7p24rcyJsTxO+xoiFlfIpFo7enpWYXhPZM0h5pMJrv0GlLibYyHdzIpTVv9qml5lR3uIU3S1veEsPtR4hgTd3/EP7+EmBkV4sdLw45iGY4/w2roNWwHKIBcLrcLm5O4ngcg/AW+y/pdN0wfLYsTK1hIj8bZcAZa10ic6mYiWlhYuIAbb9m0h3bFS5LHFl9gZ5Nioy4fFUU5y/VyALFYLIueGEUQCXZ5p4BteX1WcFg5AZ1/bJcDIHDjO45fI3WDoLzfK9k6bsNZobWbjVrQ5hraHsXZ4Bu7dCoCIGj/jkCG8cIrdtUy9liIPsuxgSbhsSk2akFbdDDZh62f+5xT92hWwmEZ4t08LldRbI9mjjgeTiVQ0Ai+ucNpNaXjORq+DgE6ni+REEoRmmu4fMK9e6h7OJ4L8R8qPqbiZvrQ7QAAAABJRU5ErkJggg==)}div.scan_issue_medium_tentative_rpt{width: 32px; height: 32px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAARXSURBVFhHvZdbbBRlFMf/M+3udsFUpJrKxSsQWjby0HhpFWkiICiBxBu+eONBHnyQxIgiXiAQA1ECij6YvkhEBILGRKMYU5UHgomaotQljSUEU9AWKMiGle6yu+P/zHc67G3Y2cXwS77Md87MfP8z893Oh6DE4/FwJpN5wHGcjblcrptlgCXJkmY5Rf9vLNtYnkgkEtfqaxWx9OrLyMjI1Egk8hIbftiyrCZcOA8c3Qsc/xlInTMPRa4CrpsBTJkHNFwNPnuB5XMGvJbvxs1D5fENQL64paVlFUWlhJBOAt+/DvR8yKj+0aeKCI0Bbn8WmLue9ehoIJtt217DNhh5KWUDSCaTE6LR6Kd86W7Xcf400NUODPe7ZkVu4GvPdLtBCAziUDqdXtTQ0HDEdeRh69WDD7ZRvMcTF/7cF1xcGNgPdL+iBr/SsmaEw+FfGMhd6vIoCIAP3FxfX/8VX7heXYa/e7RCbpoNzNsA3P8W0LEcGD9FbxTx0wfmzyls8xpevpQxZTwGrwukz1tbW/fxwTvUdZGtc4Ej3wGLu0wf55PLAJ89CfTuVEceT30DTJ2vhsdBlnbquGPC+wM64ErFMynTBZN4q1hcsOuBhe+pUUTypFYKmMlp+4bWTQDyWyj+muspZuBHIMsg7nxOHWUYw2nfOFmNPHy6h1or2N3Tpe4GEAqFVtJZJ/USGifyC98HYo+pw4dUQitKlF3ePFONQkSLf2GFW2ckEZbTdHIS10j/HmDbg2oo97wIzH9bjVKo+S81x9vZbHbhZYnLArXnBTWUpmlA56tqlEc0Rduuq6ubo77a+GIZcKpPDSLiS3/gkjxOHf6Its1f0aF29ezfxEn1iRpkMldLEW+cpI5LQ+02GQNnWW80rir442tg+2K2kjW2DNKHuE+Exxo7GAkJwFEjOOeGgC0tZlOyuJbJ5jOLg9oqWdkrUv0bQjcHmIjbIeDRHcC9L9ckLshbXGWqpJeiwpx1wG2Pm3ptpGQQHlIjOLL8Cm1LzbVGqH3A5nzkWlslt3Rq5fKgdo90AfOrKunktiHr/Nlj6qiZvdbg4ODY5ubmYRoR47tipIaGhprcGpfErTIdrySi6YoLtKdzd8qYWxX464DjfLTAcd4c5zjvTHOc33frjeBQK5dKpWKi7WVEjGg9s9eVapYneQJ4l9t4flYsC9HTTEBvvU8dlaH+Zu4D7g7mrR59fX2rGRyT/UsQ312akstCKql6cA7yQ72t0gsgFoulOS2WMIhBdZXiN+qLkxF/TvLXP0Id74xQsH7yxlGeZhb5BiEnn3LceDGD94NtnmHbS3g2OKwul4IABMnfGUgHX2ByX4T08+xVpt9HkTS9/Xk1ysO25GDSztQv+JojaToH5hoOmDQbKGS433F+/dhxDn/LIZ1VZyk6szaxmCNSLUjGzAa62JicgAMhQTP4XaNT7X9h9HjOhrdQQI7nx0WIJUfNM7z08t521qs4ngP/AVBE/q1Wmrg8AAAAAElFTkSuQmCC)}
@media print { body { width: 100%; color: #000000; position: relative; } #container { width: 98%; padding: 0; margin: 0; } h1 { color: #000000; } h2 { color: #000000;} .rule { margin: 20px 0 0 0; } .title { color: #000000; margin: 0 0 10px 0; padding: 10px 0; } .title h1 { color: #000000; } .title img { margin: -3px 0; } .heading { margin: 0 0 10px 0; } .BODH0 { color: #000000; } .BODH1 { color: #000000; } .PREVNEXT { visibility: hidden; display: none; } .rr_div { width: 98%; margin: 0.8em auto; max-height: none !important; overflow: hidden; }}
</style></head><body><div id="container"><div class="title"><img src="data:image/png;base64,R0lGODlhuAA6ANUAAHl8f9LT1P+ymaWnqf+MZldbX/T09GJmaenp6oSHit3e35udn4+SlP/ZzG5xdLy9v8fIyf9wQP/18rCytP/i2f+Wc/+DWf/Pv/95Tf+pjf/Fsv/s5f+ggP+zmf+8pf+fgP/Gs/+8pv+pjP/s5kxQVP9mM////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAAAAAALAAAAAC4ADoAAAb/QJNwSCwaj8ikcslsOp/QqHRKrVqv2Kx2y+16v+CweEwum8/otHrNbrvf8Lh8Tq/b7/h81RCYMBwkAhEEAhcbThYliouLBA1EiRlJFSUCQpSMjBEch0MNmZkEGkYGCwckqAUJDwZDCSQLSQskDEKADAgFqLu8vAu6vbwFCFZ8AwmnvQKZgxkaFEmgoKNCigTRikIR0prUJsvcjRJDEMDBtK27SeomqAAB5/HyuwFUyPOB4dYXRvqL0CasYStRzZ+iR98UDSLAkCGjCkIU9HIAiNeEdqjWZcQIwEACACABJOtVYJa7kCgTtJqCDxW4RR0CMrJUZJGRDYlKcCh4DYlN/5kEjTTIiUEIOJpEJHBY9AhAKlZCDDxI9gAjCY1XORqBRwJAEa5eu7TMxyhmJqRDfha5oJDnwIJBjVD4l7ASEgKKKkhEpeCIgr5WsQpxt5UwEbBexr5UZHZmv2xHfgr0CVmtEUyWjiJhWyIC4iXsjrAzfJi0kM9cFDPCIEHC2cdxa1Yu0TPy7NhFNGumXIJrAiahjYzuWph4aeOpW76MQEFCzkVo4R7ZIJn2W6BJPtndbbvE3mGgN4reaPp0edRbVHdu/hw67CMZ8rrlLR2JbkXRidhMdgAwkuBFDBfWcQOah1x6yh1kAl6g5AedABBCuJSCMtX2HnZIYFZXfkJwFv+BCVyhMoBg/5F3oIEFgoiKAwG06CIWqoUgm3szhiPJfN3VJxdTG94lnwnl7OKAf0QAWKSJKap4YojB1GKFag0RAAJQ+MEWzk44XrjIOEU0sE0JRfVYhFKLeIOAU7uMGKB4wiFZXIpM9pJkFOrBRKVdM0YY4XM3TpbjneHwU5c/FhgxgTlDHpnVeFmVpyScqaAEUj1PJliWCR2E0EADGDgIWRETlnCIn1oa5M1i3FjAZRFn8qJmYCU2euKjXzkKo6WLfLApNB/gqd+nRTAoCakzwiUNBhl0YpQ+oixx6C5OGjmEgG/WOuut+KAqnwhVFnsEZ9cQ+2tQlmESJhHcSdH/KioXSTuYm9ZCeu0VdS6iKgg0jvuWuGndRgR13Q6R7hQMoHIArIy+myR6tIqFq0IjzJVvv7jpq0ih9GEosEKrimlFMnst2qasC59nK70PlxDTlwFTjATARW35rSJhWmaCBF/euKyvVaAZIjFGIEBtvEQ7nG0mjU2sYxEayJcTh5hgabMJHiyi7MBSGABMAGg6WYRJYTnKMMNZ1KvynZ5WfDMGinhANV1ENE3h1Cawbd3OHAZN5BAepWLCA7tURQTgqAgutsnzVno0IwT06tiMm0begAZ2RzCOBHZX0oAEDWByt8ZEaFcCQlgbAYHBC0BQTx8jqVkRLQEoAEHBBk87/+vYK7qoO6VUHPP6OdouMogACI2rj6AmUMAyKKq6fASDGJdexAAtea2AOcEU4N/hS+JTwEpW9PGHMpoQYogS/kSAvBAUtLdIBR1/iYTEQUlPhEfYC/OqEOvKCbTC1TrOPHinhQA8YAEA0EAFiNexJWQgShD0QAOHcAEONCQDxRuCBwigMyNs0G3JYwhAmhCAY4QkARMAXxFmFxIGEFAIH9lfVD4CAVZJ6oa/0YMOd8jDHvrwh0AMohCnYAAV8m+IQ0QgSFZhgjOFZAH+GQBIGNAKBUgKARCQFJD4MyID0I4ECUCAFSPyEQDU8G9eOxP4BnBGIZgRiWIAgAMGIEUSDP8AHiEpAHhewYBfOEBFC6DjAAxAPUGOqAAOeMADEvAb6i0gAAhU3VVycYA6VoV6goMHpQxAgj9OS4Zw5AIAXiVHTfKPBBMQ2kVU9AB4TE9kpiQCSGplAgZ8D4YHo94BWhFLwv3PjqEEwyiHQL1YmqCS8PjlHUVmAuoRQWgdIULB2qgiE8xSCM4cgC5GFEsGHKAknwzmF4YJQxaRgFKqdOUn4RFINVFvikIAXAHaaABAqMQ81hyQK6UIgGHEsiTeDKc4uyBHOjrlkbQYgClIgAB1DmaZIcFmVwCQQxMowJ5rJME8q3nNakpRaC48J5BIIDuSPnSgBD3AE/nQyVOwqJr102olM515BOp5MiKAkGQ+h7BPr8yimCb4hRDA2Q5QotQK5OSpSA9wMBWB75wOlWgSjOnGd1yloxO4ihRNoDVd1OObIClAU4F5VC0k1TyrAyY8BCe0Fs2UmUTIKpEMcIAEuBIZKzFFM8OS1XNKhAF0LFhfyFpWLJxVRZTqZyscUABFfpOlrxTkBCSiUqf88RUgOYVOT2fGWcRiq0I4RR9IAL4DxKIrhjRiYZ9wWIkALRd9saLB+hJVE/TVbxNYqUUZsMQaXi+ewFhAKyZQ0WQuoKLNrEVlQ/K/1Tr3udCNrnSnS93qWve62M2udrfL3e5697tjCAIAOw==" width="184" height="58"><h1>Burp Scanner Report</h1></div><h1>Summary</h1><span class="TEXT">The table below shows the numbers of issues identified in different categories. Issues are classified according to severity as High, Medium, Low or Information. This reflects the likely impact of each issue for a typical organization. Issues are also classified according to confidence as Certain, Firm or Tentative. This reflects the inherent reliability of the technique that was used to identify the issue.</span><br><br><table cellpadding="0" cellspacing="0" class="overview_table"> <tr> <td width="70"> </td> <td width="90"> </td> <td colspan="4" height="40" align="center" class="label">Confidence</td> </tr> <tr> <td width="70"> </td> <td width="90"> </td> <td width="82" height="30" class="info">Certain</td> <td width="82" height="30" class="info">Firm</td> <td width="82" height="30" class="info">Tentative</td> <td width="82" height="30" class="info_end">Total</td> </tr> <tr> <td rowspan="4" valign="middle" class="label">Severity</td> <td class="info" height="30">High</td> <td class="colour_holder"><span class="colour_block high_certain">2</span></td> <td class="colour_holder"><span class="colour_block high_firm">0</span></td> <td class="colour_holder"><span class="colour_block high_tentative">0</span></td> <td class="colour_holder_end"><span class="colour_block row_total">2</span></td> </tr> <tr> <td class="info" height="30">Medium</td> <td class="colour_holder"><span class="colour_block medium_certain">0</span></td> <td class="colour_holder"><span class="colour_block medium_firm">0</span></td> <td class="colour_holder"><span class="colour_block medium_tentative">0</span></td> <td class="colour_holder_end"><span class="colour_block row_total">0</span></td> </tr> <tr> <td class="info" height="30">Low</td> <td class="colour_holder"><span class="colour_block low_certain">1</span></td> <td class="colour_holder"><span class="colour_block low_firm">1</span></td> <td class="colour_holder"><span class="colour_block low_tentative">0</span></td> <td class="colour_holder_end"><span class="colour_block row_total">2</span></td> </tr> <tr> <td class="info" height="30">Information</td> <td class="colour_holder"><span class="colour_block info_certain">5</span></td> <td class="colour_holder"><span class="colour_block info_firm">4</span></td> <td class="colour_holder"><span class="colour_block info_tentative">0</span></td> <td class="colour_holder_end"><span class="colour_block row_total">9</span></td> </tr></table><br><span class="TEXT">The chart below shows the aggregated numbers of issues identified in each category. Solid colored bars represent issues with a confidence level of Certain, and the bars fade as the confidence level falls.</span><br><br><table cellpadding="0" cellspacing="0" class="overview_table"> <tr> <td width="70"> </td> <td width="90"> </td> <td colspan="6" height="40" align="center" class="label">Number of issues</td> </tr> <tr> <td width="70"> </td> <td width="90"> </td> <td width="125"><span class="grad_mark">0</span></td> <td width="125"><span class="grad_mark">1</span></td> <td width="125"><span class="grad_mark">2</span></td> <td width="125"><span class="grad_mark">3</span></td> <td width="125"><span class="grad_mark">4</span></td> </tr> <tr> <td rowspan="3" valign="middle" class="label">Severity</td> <td class="info">High</td> <td colspan="5" height="30"> <table cellpadding="0" cellspacing="0"><tr><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP8AAAAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjY0RDFGNDAzODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjY0RDFGNDA0ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6NjREMUY0MDE4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6NjREMUY0MDI4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="250" height="16"></td><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP9mZgAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjY0RDFGNDA3ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjY0RDFGNDA4ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6NjREMUY0MDU4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6NjREMUY0MDY4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="0" height="16"></td><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP/MzAAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjg0Q0E0ODg0ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjg0Q0E0ODg1ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6NjREMUY0MDk4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6NjREMUY0MEE4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="0" height="16"></td></tr></table> </td> <td> </td> </tr> <tr> <td class="info">Medium</td> <td colspan="5" height="30"> <table cellpadding="0" cellspacing="0"><tr><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP+ZAAAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjg0Q0E0ODg4ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjg0Q0E0ODg5ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6ODRDQTQ4ODY4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6ODRDQTQ4ODc4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="0" height="16"></td><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP/CZgAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjg0Q0E0ODhDODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjg0Q0E0ODhEODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6ODRDQTQ4OEE4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6ODRDQTQ4OEI4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="0" height="16"></td><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP/rzAAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOkI1MDMwNTM3ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOkI1MDMwNTM4ODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6ODRDQTQ4OEU4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6QjUwMzA1MzY4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="0" height="16"></td></tr></table> </td> <td> </td> </tr> <tr> <td class="info">Low</td> <td colspan="5" height="30"> <table cellpadding="0" cellspacing="0"><tr><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP/uAAAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOkI1MDMwNTNCODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOkI1MDMwNTNDODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6QjUwMzA1Mzk4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6QjUwMzA1M0E4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="125" height="16"></td><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP/1ZgAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOkI1MDMwNTNGODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOkI1MDMwNTQwODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6QjUwMzA1M0Q4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6QjUwMzA1M0U4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="125" height="16"></td><td><img class="bar" src="data:image/png;base64,R0lGODlhAQABAIAAAP/8zAAAACH/C1hNUCBEYXRhWE1QPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS4zLWMwMTEgNjYuMTQ1NjYxLCAyMDEyLzAyLzA2LTE0OjU2OjI3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M2IChNYWNpbnRvc2gpIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOkU2OTVBQzRBODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOkU2OTVBQzRCODk3QjExRTJCMkY1QUI4QUUwNzNBMzFDIj4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6RTY5NUFDNDg4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6RTY5NUFDNDk4OTdCMTFFMkIyRjVBQjhBRTA3M0EzMUMiLz4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4B//79/Pv6+fj39vX08/Lx8O/u7ezr6uno5+bl5OPi4eDf3t3c29rZ2NfW1dTT0tHQz87NzMvKycjHxsXEw8LBwL++vby7urm4t7a1tLOysbCvrq2sq6qpqKempaSjoqGgn56dnJuamZiXlpWUk5KRkI+OjYyLiomIh4aFhIOCgYB/fn18e3p5eHd2dXRzcnFwb25tbGtqaWhnZmVkY2JhYF9eXVxbWllYV1ZVVFNSUVBPTk1MS0pJSEdGRURDQkFAPz49PDs6OTg3NjU0MzIxMC8uLSwrKikoJyYlJCMiISAfHh0cGxoZGBcWFRQTEhEQDw4NDAsKCQgHBgUEAwIBAAAh+QQAAAAAACwAAAAAAQABAAACAkQBADs=" width="0" height="16"></td></tr></table> </td> <td> </td> </tr></table>
<div class="rule"></div><h1>Contents</h1><p class="TOCH0"><a href="#1">1. Cleartext submission of password</a></p><p class="TOCH1"><a href="#1.1">1.1. http://localhost:8080/</a></p><p class="TOCH1"><a href="#1.2">1.2. http://localhost:8080/login.php</a></p><p class="TOCH0"><a href="#2">2. Cookie without HttpOnly flag set</a></p><p class="TOCH0"><a href="#3">3. Unencrypted communications</a></p><p class="TOCH0"><a href="#4">4. Path-relative style sheet import</a></p><p class="TOCH0"><a href="#5">5. Input returned in response (reflected)</a></p><p class="TOCH1"><a href="#5.1">5.1. http://localhost:8080/ [name of an arbitrarily supplied URL parameter]</a></p><p class="TOCH1"><a href="#5.2">5.2. http://localhost:8080/login.php [URL path filename]</a></p><p class="TOCH1"><a href="#5.3">5.3. http://localhost:8080/login.php [name of an arbitrarily supplied URL parameter]</a></p><p class="TOCH1"><a href="#5.4">5.4. http://localhost:8080/robots.txt [URL path filename]</a></p><p class="TOCH0"><a href="#6">6. Frameable response (potential Clickjacking)</a></p><p class="TOCH1"><a href="#6.1">6.1. http://localhost:8080/</a></p><p class="TOCH1"><a href="#6.2">6.2. http://localhost:8080/index.php</a></p><p class="TOCH1"><a href="#6.3">6.3. http://localhost:8080/login.php</a></p><p class="TOCH0"><a href="#7">7. Robots.txt file</a></p><br><div class="rule"></div><span class="BODH0" id="1">1. <a href="https://portswigger.net/knowledgebase/issues/details/00300100_cleartextsubmissionofpassword">Cleartext submission of password</a></span><br><a class="PREVNEXT" href="#2">Next</a><br><br><span class="TEXT">There are 2 instances of this issue:<ul><li><a href="#1.1">/</a></li><li><a href="#1.2">/login.php</a></li></ul></span><h2>Issue background</h2><span class="TEXT"><p>Some applications transmit passwords over unencrypted connections, making them vulnerable to interception. To exploit this vulnerability, an attacker must be suitably positioned to eavesdrop on the victim's network traffic. This scenario typically occurs when a client communicates with the server over an insecure connection such as public Wi-Fi, or a corporate or home network that is shared with a compromised computer. Common defenses such as switched networks are not sufficient to prevent this. An attacker situated in the user's ISP or the application's hosting infrastructure could also perform this attack. Note that an advanced adversary could potentially target any connection made over the Internet's core infrastructure.</p><p>Vulnerabilities that result in the disclosure of users' passwords can result in compromises that are extremely difficult to investigate due to obscured audit trails. Even if the application itself only handles non-sensitive information, exposing passwords puts users who have re-used their password elsewhere at risk.</p></span><h2>Issue remediation</h2><span class="TEXT"><p>Applications should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.</p></span><h2>Vulnerability classifications</h2><span class="TEXT"><ul><li><a href="https://cwe.mitre.org/data/definitions/319.html">CWE-319: Cleartext Transmission of Sensitive Information</a></li></ul></span><br><br><div class="rule"></div><span class="BODH1" id="1.1">1.1. http://localhost:8080/</span><br><a class="PREVNEXT" href="#1.2">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_high_certain_rpt'></div></td><td>Severity: </td><td><b>High</b></td></tr><tr><td>Confidence: </td><td><b>Certain</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The page contains a form with the following action URL, which is submitted over clear-text HTTP:<ul><li>http://localhost:8080/login.php</li></ul>The form contains the following password field:<ul><li>password</li></ul></span><h2>Request</h2><div class="rr_div"><span>GET /login.php HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br>Cookie: security=impossible; PHPSESSID=tg5g9e7n5ir97jolccgisc50b7; <br><br></span></div><h2>Response</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 15:11:32 GMT<br>Server: Apache/2.4.10 (Debian)<br>Expires: Tue, 23 Jun 2009 12:00:00 GMT<br>Cache-Control: no-cache, must-revalidate<br>Pragma: no-cache<br>Vary: Accept-Encoding<br>Content-Length: 1523<br>Connection: close<br>Content-Type: text/html;charset=utf-8<br><br><br><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><br><br><html xmlns="http://www.w3.org/1999/xhtml"><br><br> <head><br><br> <meta http-equiv="Content<br><b>...[SNIP]...</b><br><div id="content"><br><br> <span class="HIGHLIGHT"><form action="login.php" method="post"></span><br><br> <fieldset><br><b>...[SNIP]...</b><br></label> <span class="HIGHLIGHT"><input type="password" class="loginInput" AUTOCOMPLETE="off" size="20" name="password"></span><br /><br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH1" id="1.2">1.2. http://localhost:8080/login.php</span><br><a class="PREVNEXT" href="#1.1">Previous</a> <a class="PREVNEXT" href="#5.1">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_high_certain_rpt'></div></td><td>Severity: </td><td><b>High</b></td></tr><tr><td>Confidence: </td><td><b>Certain</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/login.php</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The page contains a form with the following action URL, which is submitted over clear-text HTTP:<ul><li>http://localhost:8080/login.php</li></ul>The form contains the following password field:<ul><li>password</li></ul></span><h2>Request</h2><div class="rr_div"><span>GET /login.php HTTP/1.1<br>Host: localhost:8080<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0<br>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8<br>Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2<br>Accept-Encoding: gzip, deflate<br>Connection: close<br>Cookie: PHPSESSID=eiscgbn8k9cmqddnjr761qeqd1; security=impossible<br>Upgrade-Insecure-Requests: 1<br>Sec-Fetch-Dest: document<br>Sec-Fetch-Mode: navigate<br>Sec-Fetch-Site: none<br>Sec-Fetch-User: ?1<br><br></span></div><h2>Response</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 14:05:57 GMT<br>Server: Apache/2.4.10 (Debian)<br>Expires: Tue, 23 Jun 2009 12:00:00 GMT<br>Cache-Control: no-cache, must-revalidate<br>Pragma: no-cache<br>Vary: Accept-Encoding<br>Content-Length: 1523<br>Connection: close<br>Content-Type: text/html;charset=utf-8<br><br><br><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><br><br><html xmlns="http://www.w3.org/1999/xhtml"><br><br> <head><br><br> <meta http-equiv="Content<br><b>...[SNIP]...</b><br><div id="content"><br><br> <span class="HIGHLIGHT"><form action="login.php" method="post"></span><br><br> <fieldset><br><b>...[SNIP]...</b><br></label> <span class="HIGHLIGHT"><input type="password" class="loginInput" AUTOCOMPLETE="off" size="20" name="password"></span><br /><br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH0" id="2">2. <a href="https://portswigger.net/knowledgebase/issues/details/00500600_cookiewithouthttponlyflagset">Cookie without HttpOnly flag set</a></span><br><a class="PREVNEXT" href="#1">Previous</a> <a class="PREVNEXT" href="#3">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_low_firm_rpt'></div></td><td>Severity: </td><td><b>Low</b></td></tr><tr><td>Confidence: </td><td><b>Firm</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The following cookie was issued by the application and does not have the HttpOnly flag set:<ul><li><b>PHPSESSID</b></li></ul>The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.</span><h2>Issue background</h2><span class="TEXT"><p>If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure makes certain client-side attacks, such as cross-site scripting, slightly harder to exploit by preventing them from trivially capturing the cookie's value via an injected script.</p></span><h2>Issue remediation</h2><span class="TEXT"><p>There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.</p><p>You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing. </p></span><h2>References</h2><span class="TEXT"><ul><li><a href='https://www.owasp.org/index.php/HttpOnly'>Configuring HttpOnly</a></li></ul></span><h2>Vulnerability classifications</h2><span class="TEXT"><ul><li><a href="https://cwe.mitre.org/data/definitions/16.html">CWE-16: Configuration</a></li></ul></span><h2>Request</h2><div class="rr_div"><span>GET / HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br><br></span></div><h2>Response</h2><div class="rr_div"><span>HTTP/1.1 302 Found<br>Date: Sun, 24 Sep 2023 15:11:32 GMT<br>Server: Apache/2.4.10 (Debian)<br><span class="HIGHLIGHT">Set-Cookie: PHPSESSID=tg5g9e7n5ir97jolccgisc50b7; path=/</span><br>Expires: Thu, 19 Nov 1981 08:52:00 GMT<br>Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0<br>Pragma: no-cache<br>Set-Cookie: PHPSESSID=tg5g9e7n5ir97jolccgisc50b7; path=/; httponly<br>Set-Cookie: security=impossible; httponly<br>Location: login.php<br>Content-Length: 0<br>Connection: close<br>Content-Type: text/html; charset=UTF-8<br><br></span></div><div class="rule"></div><span class="BODH0" id="3">3. <a href="https://portswigger.net/knowledgebase/issues/details/01000200_unencryptedcommunications">Unencrypted communications</a></span><br><a class="PREVNEXT" href="#2">Previous</a> <a class="PREVNEXT" href="#4">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_low_certain_rpt'></div></td><td>Severity: </td><td><b>Low</b></td></tr><tr><td>Confidence: </td><td><b>Certain</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/</b></td></tr></table><h2>Issue description</h2><span class="TEXT"><p>The application allows users to connect to it over unencrypted connections. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the application and obtain any information the user supplies. Furthermore, an attacker able to modify traffic could use the application as a platform for attacks against its users and third-party websites. Unencrypted connections have been exploited by ISPs and governments to track users, and to inject adverts and malicious JavaScript. Due to these concerns, web browser vendors are planning to visually flag unencrypted connections as hazardous.</p><p>To exploit this vulnerability, an attacker must be suitably positioned to eavesdrop on the victim's network traffic. This scenario typically occurs when a client communicates with the server over an insecure connection such as public Wi-Fi, or a corporate or home network that is shared with a compromised computer. Common defenses such as switched networks are not sufficient to prevent this. An attacker situated in the user's ISP or the application's hosting infrastructure could also perform this attack. Note that an advanced adversary could potentially target any connection made over the Internet's core infrastructure.</p><p>Please note that using a mixture of encrypted and unencrypted communications is an ineffective defense against active attackers, because they can easily remove references to encrypted resources when these references are transmitted over an unencrypted connection.</p></span><h2>Issue remediation</h2><span class="TEXT"><p>Applications should use transport-level encryption (SSL/TLS) to protect all communications passing between the client and the server. The Strict-Transport-Security HTTP header should be used to ensure that clients refuse to access the server over an insecure connection.</p></span><h2>References</h2><span class="TEXT"><ul><li><a href="https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure">Marking HTTP as non-secure</a></li><li><a href="https://wiki.mozilla.org/Security/Server_Side_TLS">Configuring Server-Side SSL/TLS</a></li><li><a href="https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security">HTTP Strict Transport Security</a></li></ul></span><h2>Vulnerability classifications</h2><span class="TEXT"><ul><li><a href="https://cwe.mitre.org/data/definitions/326.html">CWE-326: Inadequate Encryption Strength</a></li></ul></span><div class="rule"></div><span class="BODH0" id="4">4. <a href="https://portswigger.net/knowledgebase/issues/details/00200328_pathrelativestylesheetimport">Path-relative style sheet import</a></span><br><a class="PREVNEXT" href="#3">Previous</a> <a class="PREVNEXT" href="#5">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_firm_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Firm</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The application may be vulnerable to path-relative style sheet import (PRSSI) attacks. The first four conditions for an exploitable vulnerability are present (see issue background):<ol><li>The original response contains a path-relative style sheet import (see response 1).</li><li>When superfluous path-like data is placed into the URL following the original filename (see request 2), the application's response still contains a path-relative style sheet import (see response 2).</li><li>Response 2 can be made to render in a browser's quirks mode. The page does not contain a doctype directive, and so it will always be rendered in quirks mode. Further, the response does not prevent itself from being framed, so an attacker can frame the response within a page that they control, to force it to be rendered in quirks mode. (Note that this technique is IE-specific and due to P3P restrictions might sometimes limit the impact of a successful attack.)</li><li>When the path-relative style sheet import in response 2 is requested (see request 3) the application returns something other than the CSS response that was supposed to be imported (see response 3).</li></ol>It was not verified whether condition 5 holds (see issue background), and you should manually investigate whether it is possible to manipulate some text within response 3, to enable full exploitation of this issue.</span><h2>Issue background</h2><span class="TEXT"><p>Path-relative style sheet import vulnerabilities arise when the following conditions hold:</p><ol><li>A response contains a style sheet import that uses a path-relative URL (for example, the page at "/original-path/file.php" might import "styles/main.css").</li><li>When handling requests, the application or platform tolerates superfluous path-like data following the original filename in the URL (for example, "/original-path/file.php/extra-junk/"). When superfluous data is added to the original URL, the application's response still contains a path-relative stylesheet import.</li><li>The response in condition 2 can be made to render in a browser's quirks mode, either because it has a missing or old doctype directive, or because it allows itself to be framed by a page under an attacker's control.</li><li>When a browser requests the style sheet that is imported in the response from the modified URL (using the URL "/original-path/file.php/extra-junk/styles/main.css"), the application returns something other than the CSS response that was supposed to be imported. Given the behavior described in condition 2, this will typically be the same response that was originally returned in condition 1.</li><li>An attacker has a means of manipulating some text within the response in condition 4, for example because the application stores and displays some past input, or echoes some text within the current URL.</li></ol><p>Given the above conditions, an attacker can execute CSS injection within the browser of the target user. The attacker can construct a URL that causes the victim's browser to import as CSS a different URL than normal, containing text that the attacker can manipulate.</p><p>Being able to inject arbitrary CSS into the victim's browser may enable various attacks, including:</p><ul> <li>Executing arbitrary JavaScript using IE's expression() function.</li><li>Using CSS selectors to read parts of the HTML source, which may include sensitive data such as anti-CSRF tokens.</li><li>Capturing any sensitive data within the URL query string by making a further style sheet import to a URL on the attacker's domain, and monitoring the incoming Referer header.</li></ul></span><h2>Issue remediation</h2><span class="TEXT"><p>The root cause of the vulnerability can be resolved by not using path-relative URLs in style sheet imports. Aside from this, attacks can also be prevented by implementing all of the following defensive measures: </p><ul><li>Setting the HTTP response header "X-Frame-Options: deny" in all responses. One method that an attacker can use to make a page render in quirks mode is to frame it within their own page that is rendered in quirks mode. Setting this header prevents the page from being framed.</li><li>Setting a modern doctype (e.g. "<!doctype html>") in all HTML responses. This prevents the page from being rendered in quirks mode (unless it is being framed, as described above).</li><li>Setting the HTTP response header "X-Content-Type-Options: nosniff" in all responses. This prevents the browser from processing a non-CSS response as CSS, even if another page loads the response via a style sheet import.</li></ul></span><h2>References</h2><span class="TEXT"><ul><li><a href="http://blog.portswigger.net/2015/02/prssi.html">Detecting and exploiting path-relative stylesheet import (PRSSI) vulnerabilities</a></li></ul></span><h2>Vulnerability classifications</h2><span class="TEXT"><ul><li><a href="https://cwe.mitre.org/data/definitions/16.html">CWE-16: Configuration</a></li></ul></span><h2>Request 1</h2><div class="rr_div"><span>GET /login.php HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br>Referer: http://localhost:8080/<br>Cookie: PHPSESSID=1b1pa1mmoc8t19ojlpl0lbiic2; security=impossible<br><br></span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 15:11:32 GMT<br>Server: Apache/2.4.10 (Debian)<br>Expires: Tue, 23 Jun 2009 12:00:00 GMT<br>Cache-Control: no-cache, must-revalidate<br>Pragma: no-cache<br>Vary: Accept-Encoding<br>Content-Length: 1523<br>Connection: close<br>Content-Type: text/html;charset=utf-8<br><br><br><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><br><br><html xmlns="http://www.w3.org/1999/xhtml"><br><br> <head><br><br> <meta http-equiv="Content<br><b>...[SNIP]...</b><br></title><br><br> <span class="HIGHLIGHT"><link rel="stylesheet" type="text/css" href="dvwa/css/login.css" /></span><br><br> </head><br><b>...[SNIP]...</b><br></span></div><h2>Request 2</h2><div class="rr_div"><span>GET /login.php<span class="HIGHLIGHT">/sfew6t/</span> HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br>Referer: http://localhost:8080/<br>Cookie: PHPSESSID=v5m327r17tfpb284s58f3vvvb5; security=impossible<br><br></span></div><h2>Response 2</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 15:11:47 GMT<br>Server: Apache/2.4.10 (Debian)<br>Expires: Tue, 23 Jun 2009 12:00:00 GMT<br>Cache-Control: no-cache, must-revalidate<br>Pragma: no-cache<br>Vary: Accept-Encoding<br>Content-Length: 1523<br>Connection: close<br>Content-Type: text/html;charset=utf-8<br><br><br><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><br><br><html xmlns="http://www.w3.org/1999/xhtml"><br><br> <head><br><br> <meta http-equiv="Content<br><b>...[SNIP]...</b><br></title><br><br> <span class="HIGHLIGHT"><link rel="stylesheet" type="text/css" href="dvwa/css/login.css" /></span><br><br> </head><br><b>...[SNIP]...</b><br></span></div><h2>Request 3</h2><div class="rr_div"><span>GET <span class="HIGHLIGHT">/login.php/sfew6t/dvwa/css/login.css</span> HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br>Referer: http://localhost:8080/<br>Cookie: PHPSESSID=g7dtq2j4e9gmgfauivl3rdad04; security=impossible<br><br></span></div><h2>Response 3</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 15:11:47 GMT<br>Server: Apache/2.4.10 (Debian)<br>Expires: Tue, 23 Jun 2009 12:00:00 GMT<br>Cache-Control: no-cache, must-revalidate<br>Pragma: no-cache<br>Vary: Accept-Encoding<br>Content-Length: 1523<br>Connection: close<br>Content-Type: text/html;charset=utf-8<br><br><br><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><br><br><html xmlns="http://www.w3.org/1999/xhtml"><br><br> <head><br><br> <meta http-equiv="Content<br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH0" id="5">5. <a href="https://portswigger.net/knowledgebase/issues/details/00400c00_inputreturnedinresponsereflected">Input returned in response (reflected)</a></span><br><a class="PREVNEXT" href="#4">Previous</a> <a class="PREVNEXT" href="#6">Next</a><br><br><span class="TEXT">There are 4 instances of this issue:<ul><li><a href="#5.1">/ [name of an arbitrarily supplied URL parameter]</a></li><li><a href="#5.2">/login.php [URL path filename]</a></li><li><a href="#5.3">/login.php [name of an arbitrarily supplied URL parameter]</a></li><li><a href="#5.4">/robots.txt [URL path filename]</a></li></ul></span><h2>Issue background</h2><span class="TEXT"><p>Reflection of input arises when data is copied from a request and echoed into the application's immediate response.</p><p>Input being returned in application responses is not a vulnerability in its own right. However, it is a prerequisite for many client-side vulnerabilities, including cross-site scripting, open redirection, content spoofing, and response header injection. Additionally, some server-side vulnerabilities such as SQL injection are often easier to identify and exploit when input is returned in responses. In applications where input retrieval is rare and the environment is resistant to automated testing (for example, due to a web application firewall), it might be worth subjecting instances of it to focused manual testing. </p></span><h2>Vulnerability classifications</h2><span class="TEXT"><ul><li><a href="https://cwe.mitre.org/data/definitions/20.html">CWE-20: Improper Input Validation</a></li><li><a href="https://cwe.mitre.org/data/definitions/116.html">CWE-116: Improper Encoding or Escaping of Output</a></li></ul></span><br><br><div class="rule"></div><span class="BODH1" id="5.1">5.1. http://localhost:8080/ [name of an arbitrarily supplied URL parameter]</span><br><a class="PREVNEXT" href="#1.2">Previous</a> <a class="PREVNEXT" href="#5.2">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_certain_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Certain</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The name of an arbitrarily supplied URL parameter is copied into the application's response.</span><h2>Request 1</h2><div class="rr_div"><span>GET /login.php/<span class="HIGHLIGHT">'%22%3e%3csvg%2fonload%3dfetch%60%2f%2f48aozntrt3hpxol4x6q63ova71du1npff39q0ep%5c.burpcollaborator.net%60%3e</span> HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br>Referer: http://localhost:8080/<br>Cookie: PHPSESSID=vo98ov4mehug6q104krh684kc2; security=impossible<br><br></span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 404 Not Found<br>Date: Sun, 24 Sep 2023 15:12:03 GMT<br>Server: Apache/2.4.10 (Debian)<br>Content-Length: 385<br>Connection: close<br>Content-Type: text/html; charset=iso-8859-1<br><br><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><br><html><head><br><title>404 Not Found</title><br></head><body><br><h1>Not Found</h1><br><p>The requested URL /login.php/<span class="HIGHLIGHT">'&quot;&gt;&lt;svg/onload=fetch`//48aozntrt3hpxol4x6q63ova71du1npff39q0ep\.burpcollaborator.net`&gt;</span> was not found on this server.</p><br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH1" id="5.2">5.2. http://localhost:8080/login.php [URL path filename]</span><br><a class="PREVNEXT" href="#5.1">Previous</a> <a class="PREVNEXT" href="#5.3">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_certain_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Certain</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/login.php</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The value of the URL path filename is copied into the application's response.</span><h2>Request 1</h2><div class="rr_div"><span>GET /login.php<span class="HIGHLIGHT">vii6ari4k1</span> HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br>Referer: http://localhost:8080/<br>Cookie: PHPSESSID=i7ck8nnl3u24ck6cttfnp5ho63; security=impossible<br><br></span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 404 Not Found<br>Date: Sun, 24 Sep 2023 15:11:46 GMT<br>Server: Apache/2.4.10 (Debian)<br>Content-Length: 294<br>Connection: close<br>Content-Type: text/html; charset=iso-8859-1<br><br><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><br><html><head><br><title>404 Not Found</title><br></head><body><br><h1>Not Found</h1><br><p>The requested URL /login.php<span class="HIGHLIGHT">vii6ari4k1</span> was not found on this server.</p><br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH1" id="5.3">5.3. http://localhost:8080/login.php [name of an arbitrarily supplied URL parameter]</span><br><a class="PREVNEXT" href="#5.2">Previous</a> <a class="PREVNEXT" href="#5.4">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_certain_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Certain</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/login.php</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The name of an arbitrarily supplied URL parameter is copied into the application's response.</span><h2>Request 1</h2><div class="rr_div"><span>POST /login.php/<span class="HIGHLIGHT">'%22%3e%3csvg%2fonload%3dfetch%60%2f%2fz44jvipmpydktjhzt1m1zjr53w9pxhl9bx5kx8m%5c.burpcollaborator.net%60%3e</span> HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br>Referer: http://localhost:8080/login.php<br>Content-Type: application/x-www-form-urlencoded<br>Content-Length: 97<br>Cookie: PHPSESSID=dfo6os3gtkct848ur27cg02ka1; security=impossible<br><br>username=PWIMdJUx&password=h5H%21f0h%21J0&Login=Login&user_token=bbf0701022fe45a0558a2c58750f5940</span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 404 Not Found<br>Date: Sun, 24 Sep 2023 15:12:03 GMT<br>Server: Apache/2.4.10 (Debian)<br>Content-Length: 385<br>Connection: close<br>Content-Type: text/html; charset=iso-8859-1<br><br><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><br><html><head><br><title>404 Not Found</title><br></head><body><br><h1>Not Found</h1><br><p>The requested URL /login.php/<span class="HIGHLIGHT">'&quot;&gt;&lt;svg/onload=fetch`//z44jvipmpydktjhzt1m1zjr53w9pxhl9bx5kx8m\.burpcollaborator.net`&gt;</span> was not found on this server.</p><br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH1" id="5.4">5.4. http://localhost:8080/robots.txt [URL path filename]</span><br><a class="PREVNEXT" href="#5.3">Previous</a> <a class="PREVNEXT" href="#6.1">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_certain_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Certain</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/robots.txt</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The value of the URL path filename is copied into the application's response.</span><h2>Request 1</h2><div class="rr_div"><span>GET /robots.txt<span class="HIGHLIGHT">uyz6najs9c</span> HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br><br></span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 404 Not Found<br>Date: Sun, 24 Sep 2023 15:11:39 GMT<br>Server: Apache/2.4.10 (Debian)<br>Content-Length: 295<br>Connection: close<br>Content-Type: text/html; charset=iso-8859-1<br><br><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><br><html><head><br><title>404 Not Found</title><br></head><body><br><h1>Not Found</h1><br><p>The requested URL /robots.txt<span class="HIGHLIGHT">uyz6najs9c</span> was not found on this server.</p><br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH0" id="6">6. <a href="https://portswigger.net/knowledgebase/issues/details/005009a0_frameableresponsepotentialclickjacking">Frameable response (potential Clickjacking)</a></span><br><a class="PREVNEXT" href="#5">Previous</a> <a class="PREVNEXT" href="#7">Next</a><br><br><span class="TEXT">There are 3 instances of this issue:<ul><li><a href="#6.1">/</a></li><li><a href="#6.2">/index.php</a></li><li><a href="#6.3">/login.php</a></li></ul></span><h2>Issue description</h2><span class="TEXT"><p>If a page fails to set an appropriate X-Frame-Options or Content-Security-Policy HTTP header, it might be possible for a page controlled by an attacker to load it within an iframe. This may enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. By inducing victim users to perform actions such as mouse clicks and keystrokes, the attacker can cause them to unwittingly carry out actions within the application that is being targeted. This technique allows the attacker to circumvent defenses against cross-site request forgery, and may result in unauthorized actions.</p><p>Note that some applications attempt to prevent these attacks from within the HTML page itself, using "framebusting" code. However, this type of defense is normally ineffective and can usually be circumvented by a skilled attacker.</p><p>You should determine whether any functions accessible within frameable pages can be used by application users to perform any sensitive actions within the application. </p></span><h2>Issue remediation</h2><span class="TEXT"><p>To effectively prevent framing attacks, the application should return a response header with the name <b>X-Frame-Options</b> and the value <b>DENY</b> to prevent framing altogether, or the value <b>SAMEORIGIN</b> to allow framing only by pages on the same origin as the response itself. Note that the SAMEORIGIN header can be partially bypassed if the application itself can be made to frame untrusted websites.</p></span><h2>References</h2><span class="TEXT"><ul><li><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options">X-Frame-Options</a></li></ul></span><h2>Vulnerability classifications</h2><span class="TEXT"><ul><li><a href="https://cwe.mitre.org/data/definitions/693.html">CWE-693: Protection Mechanism Failure</a></li></ul></span><br><br><div class="rule"></div><span class="BODH1" id="6.1">6.1. http://localhost:8080/</span><br><a class="PREVNEXT" href="#5.4">Previous</a> <a class="PREVNEXT" href="#6.2">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_firm_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Firm</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/</b></td></tr></table><h2>Request 1</h2><div class="rr_div"><span>GET /login.php HTTP/1.1<br>Host: localhost:8080<br>Accept-Encoding: gzip, deflate<br>Accept: */*<br>Accept-Language: en-US,en-GB;q=0.9,en;q=0.8<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36<br>Connection: close<br>Cache-Control: max-age=0<br>Cookie: security=impossible; PHPSESSID=tg5g9e7n5ir97jolccgisc50b7; <br><br></span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 15:11:32 GMT<br>Server: Apache/2.4.10 (Debian)<br>Expires: Tue, 23 Jun 2009 12:00:00 GMT<br>Cache-Control: no-cache, must-revalidate<br>Pragma: no-cache<br>Vary: Accept-Encoding<br>Content-Length: 1523<br>Connection: close<br>Content-Type: text/html;charset=utf-8<br><br><br><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><br><br><html xmlns="http://www.w3.org/1999/xhtml"><br><br> <head><br><br> <meta http-equiv="Content<br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH1" id="6.2">6.2. http://localhost:8080/index.php</span><br><a class="PREVNEXT" href="#6.1">Previous</a> <a class="PREVNEXT" href="#6.3">Next</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_firm_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Firm</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/index.php</b></td></tr></table><h2>Request 1</h2><div class="rr_div"><span>GET /index.php HTTP/1.1<br>Host: localhost:8080<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0<br>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8<br>Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2<br>Accept-Encoding: gzip, deflate<br>Referer: http://localhost:8080/login.php<br>Connection: close<br>Cookie: PHPSESSID=eiscgbn8k9cmqddnjr761qeqd1; security=impossible<br>Upgrade-Insecure-Requests: 1<br>Sec-Fetch-Dest: document<br>Sec-Fetch-Mode: navigate<br>Sec-Fetch-Site: same-origin<br>Sec-Fetch-User: ?1<br><br></span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 14:06:11 GMT<br>Server: Apache/2.4.10 (Debian)<br>Expires: Tue, 23 Jun 2009 12:00:00 GMT<br>Cache-Control: no-cache, must-revalidate<br>Pragma: no-cache<br>Vary: Accept-Encoding<br>Content-Length: 7274<br>Connection: close<br>Content-Type: text/html;charset=utf-8<br><br><br><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><br><br><html xmlns="http://www.w3.org/1999/xhtml"><br><br> <head><br> <meta http-equiv="Content-T<br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH1" id="6.3">6.3. http://localhost:8080/login.php</span><br><a class="PREVNEXT" href="#6.2">Previous</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_firm_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Firm</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/login.php</b></td></tr></table><h2>Request 1</h2><div class="rr_div"><span>GET /login.php HTTP/1.1<br>Host: localhost:8080<br>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0<br>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8<br>Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2<br>Accept-Encoding: gzip, deflate<br>Connection: close<br>Cookie: PHPSESSID=eiscgbn8k9cmqddnjr761qeqd1; security=impossible<br>Upgrade-Insecure-Requests: 1<br>Sec-Fetch-Dest: document<br>Sec-Fetch-Mode: navigate<br>Sec-Fetch-Site: none<br>Sec-Fetch-User: ?1<br><br></span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 14:05:57 GMT<br>Server: Apache/2.4.10 (Debian)<br>Expires: Tue, 23 Jun 2009 12:00:00 GMT<br>Cache-Control: no-cache, must-revalidate<br>Pragma: no-cache<br>Vary: Accept-Encoding<br>Content-Length: 1523<br>Connection: close<br>Content-Type: text/html;charset=utf-8<br><br><br><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><br><br><html xmlns="http://www.w3.org/1999/xhtml"><br><br> <head><br><br> <meta http-equiv="Content<br><b>...[SNIP]...</b><br></span></div><div class="rule"></div><span class="BODH0" id="7">7. <a href="https://portswigger.net/knowledgebase/issues/details/00600600_robotsdottxtfile">Robots.txt file</a></span><br><a class="PREVNEXT" href="#6">Previous</a><br><h2>Summary</h2><table cellpadding="0" cellspacing="0" class="summary_table"><tr><td rowspan="4" class="icon" valign="top" align="center"><div class='scan_issue_info_certain_rpt'></div></td><td>Severity: </td><td><b>Information</b></td></tr><tr><td>Confidence: </td><td><b>Certain</b></td></tr><tr><td>Host: </td><td><b>http://localhost:8080</b></td></tr><tr><td>Path: </td><td><b>/robots.txt</b></td></tr></table><h2>Issue detail</h2><span class="TEXT">The web server contains a robots.txt file.</span><h2>Issue background</h2><span class="TEXT"><p>The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site that robots are allowed, or not allowed, to crawl and index.</p><p>The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.</p></span><h2>Issue remediation</h2><span class="TEXT"><p>The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honor the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorized access.</p></span><h2>Vulnerability classifications</h2><span class="TEXT"><ul><li><a href="https://cwe.mitre.org/data/definitions/200.html">CWE-200: Information Exposure</a></li></ul></span><h2>Request 1</h2><div class="rr_div"><span>GET <span class="HIGHLIGHT">/robots.txt</span> HTTP/1.1<br>Host: localhost<br>Connection: close<br>Cookie: PHPSESSID=eiscgbn8k9cmqddnjr761qeqd1; security=impossible<br><br></span></div><h2>Response 1</h2><div class="rr_div"><span>HTTP/1.1 200 OK<br>Date: Sun, 24 Sep 2023 15:11:33 GMT<br>Server: Apache/2.4.10 (Debian)<br>Last-Modified: Wed, 04 Jan 2017 09:34:35 GMT<br>ETag: "1a-545417e2380c0"<br>Accept-Ranges: bytes<br>Content-Length: 26<br>Connection: close<br>Content-Type: text/plain<br><br>User-agent: *<br>Disallow: /</span></div><div class="rule"></div><span class="TEXT"><br>Report generated by Burp Suite <a href="https://portswigger.net/vulnerability-scanner/">web vulnerability scanner</a> v2020.2, at Sun Sep 24 23:22:22 CST 2023.<br><br></span></div></body></html>
复制代码
见附件
Burp Intruder 爆破题目
没有找到词典。自己随便写了下东西爆破了。。。
在不依赖于 DVWA 后端数据库的情况，如何通过前端验证的方法判断 DVWA 中的注入点是数字型注入还是字符型注入？（提示：用假设法进行逻辑判断）
发送报文，看反应。
划线
评论
复制
发布于: 刚刚阅读数: 5
大肚皮狒狒
关注
还未添加个人签名 2020-03-25 加入
还未添加个人简介
评论