message

Share this page:

Edit

Observations based on User Activity File

Non-Intrusive Cybersecurity and Privacy Observations based on User Activity File

Overview
Warning

General Security Checks

Check for Known Social Engineering VulnerabilitiesAre there any Malicious, Infected and Unsafe URLs used in your Web Application? These URLs can propogate Phishing or Malware Attacks

10.0/10

Scan Malwares, Unwanted Software, Social media phishing using Google Web Risk

Score calculation for Google Web Risk

    Formula :
        Nil

    *   If we found any URLs through Google Web Risk, then the score will be 0.
    *   Or else it will be 10.

No records found.

Submit Feedback

Check for Default Database CredentialsIs your Web Application, or any of its associated Sub-Domains, have default database credentials?

10.0/10

Get the list of open ports and verify if the corresponding application in the default credential list maps to the port

Score calculation for Default Credential Checks


Score   -   Description
    0   -   If any of the default application credentials were successful.
    10   -  If none of the default application credentials were successful.

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

Checks Done For	Status
cassandra
elasticsearch
maxdb
mysql
oracle
postgres
redis

Submit Feedback

Check for Directory Traversal VulnerabilitiesAre there any sensitive files present in your Web Application Domain?

10.0/10

Validate if a given website is vulnerable to Directory Traversal Attacks

Score calculation for Directory Traversal

    Formula :
        ((N-x)* w1 ) / ( N*(w1) ) * 10

    N   -   Total number of dorks checked
    x   -   Total number of vulnerabilites found


    Weightage for the below parameters: 
    - IsVulnerable?            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

Show entries

Filter:

Checks Done	Status
Admin Credentials
Open config files such as ini, yml, env etc.
Open log files containing username or passwords

Showing 1 to 3 of 3 entries

Submit Feedback

Check for Open System VulnerabilitiesAre there System Ports open in your Web Applicatio Domain, or any of its associated Sub-Domains?

10.0/10

Get the list of open ports and verify if the corresponding application in the default credential list maps to the port

Score calculation for Open Port Checks


Score   -   Description
    0   -   If any of the application ports are found to be open.
    10   -  If none of the application ports are found to be open.

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Open Ports`	`Predicted Application`
`None`	`None`

Submit Feedback

Check for SSL/TLS Certificate VulnerabilitiesDoes your Web Application use the appropriate level of SSL/TLS Certificates such as Protocol Version, Cipher Strength?

10.0/10

Get the site URL from the HAR file and validate the website for TLS protocol, keyxchange, cipher strength and if it has trusted certificates

Score calculation for SSLTLSAnalysis

    Formula :
        ((x* w1 + y* w2 + z * w3) / ( N*(w1+w2+w3) )) * 10

    N   -   Base of 10
    x   -   Protocol Score
    y   -   Cipher Strength Score
    z   -   Key Exchange Score

    Weightage for the below parameters: 
    - Protocol          w1
    - CipherStrength    w2
    - KeyExchange       w3

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

No records found.

Submit Feedback

Check for Publicly Available System Threats and VulnerabilitiesWe check for Known, Publicly Available System Vulnerabilities using Sandboxing technologies. We collect this information from AlienVault OTX Exchange

0.0/10

Scan Malwares in a domain from various tools and antivirus using AlienVault

Score calculation for Vulnerability in HTML page JS

    Formula :
        Nil

   *   If we found any Vuls through Alien vault malware, we will score by the following.

       Severity=5, means score 0
       Severity=4, means score 3
       Severity=3, means score 6
       Severity=2, means score 8

severity	Count
CRITICAL	3
HIGH	2
MEDIUM	3

Select samples of Malwares found through Sandboxing:

Show entries

Filter:

fileDescription	duration	score	severity

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	138	4.6	HIGH
PE32 executable (GUI) Intel 80386, for MS Windows	133	7.2	HIGH
PE32 executable (GUI) Intel 80386, for MS Windows	52	7.8	CRITICAL
PE32 executable (GUI) Intel 80386, for MS Windows	130	7.6	CRITICAL
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive	159	10	CRITICAL

Showing 1 to 5 of 5 entries

Submit Feedback

Privacy Checks

Check for PII in API Request CookiesAre there any Personally Identifiable Information in the API Request Cookies? This includes all APIs used by the Web Application. It is best practice to avoid PII information in API Requests, unless it is required.

10.0/10

Check for PII in API Request Cookies

Score calculation for DLP

    Formula :
        10-(Avg weight/No.of.entries)

    *   Weight will be differ from infoTypes.
    *   The minimum weight will be taken for specific infoTypes.
    *   All entries will be consider. Because the info which we found  through DLP is posssible for leakage of info about users.

Show entries

Filter:

Category	Checks Done For	Status
Critical	Creditcard,IBan Code,TIN, SSN, Passport,Vehicle Number
Others	Email, Phone number, Ethnicity, MacAddress,Gender,Last Name, Location, etc.

Showing 1 to 2 of 2 entries

Submit Feedback

Check for PII in API Request HeadersAre there any Personally Identifiable Information in the API Request Headers? This includes all APIs used by the Web Application. It is best practice to completely avoid PII information in API Requests, unless it is required.

10.0/10

Check for PII in API Request Headers

Score calculation for DLP

    Formula :
        10-(Avg weight/No.of.entries)

    *   Weight will be differ from infoTypes.
    *   The minimum weight will be taken for specific infoTypes.
    *   All entries will be consider. Because the info which we found  through DLP is posssible for leakage of info about users.

Show entries

Filter:

Category	Checks Done For	Status
Critical	Creditcard,IBan Code,TIN, SSN, Passport,Vehicle Number
Others	Email, Phone number, Ethnicity, MacAddress,Gender,Last Name, Location, etc.

Showing 1 to 2 of 2 entries

Submit Feedback

Check for PII in API Request QueriesAre there any Personally Identifiable Information in the API GET Requests? This includes all APIs used by the Web Application. It is best practice to completely avoid PII information in API GET Requests parameters.

10.0/10

Check for PII in API Request Queries

Score calculation for DLP

    Formula :
        10-(Avg weight/No.of.entries)

    *   Weight will be differ from infoTypes.
    *   The minimum weight will be taken for specific infoTypes.
    *   All entries will be consider. Because the info which we found  through DLP is posssible for leakage of info about users.

Show entries

Filter:

Category	Checks Done For	Status
Critical	Creditcard,IBan Code,TIN, SSN, Passport,Vehicle Number
Others	Email, Phone number, Ethnicity, MacAddress,Gender,Last Name, Location, etc.

Showing 1 to 2 of 2 entries

Submit Feedback

Check for PII in API Response Bodies from the Web ApplicationAre there any Personally Identifiable Information in the Body of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Check for PII in API Response Bodies from the Web Application

Score calculation for DLP

    Formula :
        10-(Avg weight/No.of.entries)

    *   Weight will be differ from infoTypes.
    *   The minimum weight will be taken for specific infoTypes.
    *   All entries will be consider. Because the info which we found  through DLP is posssible for leakage of info about users.

Show entries

Filter:

Category	Checks Done For	Status
Critical	Creditcard,IBan Code,TIN, SSN, Passport,Vehicle Number
Others	Email, Phone number, Ethnicity, MacAddress,Gender,Last Name, Location, etc.

Showing 1 to 2 of 2 entries

Submit Feedback

Check for PII in API Cookies from the Web ApplicationAre there any Personally Identifiable Information set in the Cookies of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Check for PII in API Cookies from the Web Application

Score calculation for DLP

    Formula :
        10-(Avg weight/No.of.entries)

    *   Weight will be differ from infoTypes.
    *   The minimum weight will be taken for specific infoTypes.
    *   All entries will be consider. Because the info which we found  through DLP is posssible for leakage of info about users.

Show entries

Filter:

Category	Checks Done For	Status
Critical	Creditcard,IBan Code,TIN, SSN, Passport,Vehicle Number
Others	Email, Phone number, Ethnicity, MacAddress,Gender,Last Name, Location, etc.

Showing 1 to 2 of 2 entries

Submit Feedback

Check for PII in API Response Headers from the Web ApplicationAre there any Personally Identifiable Information set in the Headers of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Check for PII in API Response Headers from the Web Application

Score calculation for DLP

    Formula :
        10-(Avg weight/No.of.entries)

    *   Weight will be differ from infoTypes.
    *   The minimum weight will be taken for specific infoTypes.
    *   All entries will be consider. Because the info which we found  through DLP is posssible for leakage of info about users.

Show entries

Filter:

Category	Checks Done For	Status
Critical	Creditcard,IBan Code,TIN, SSN, Passport,Vehicle Number
Others	Email, Phone number, Ethnicity, MacAddress,Gender,Last Name, Location, etc.

Showing 1 to 2 of 2 entries

Submit Feedback

Check for PII in CacheAre there any Personally Identifiable Information in Caches?

10.0/10

Check for PII in Cache

Score calculation for DLP

    Formula :
        10-(Avg weight/No.of.entries)

    *   Weight will be differ from infoTypes.
    *   The minimum weight will be taken for specific infoTypes.
    *   All entries will be consider. Because the info which we found  through DLP is posssible for leakage of info about users.

Show entries

Filter:

Category	Checks Done For	Status
Critical	Creditcard,IBan Code,TIN, SSN, Passport,Vehicle Number
Others	Email, Phone number, Ethnicity, MacAddress,Gender,Last Name, Location, etc.

Showing 1 to 2 of 2 entries

Submit Feedback

Check for Data Exfiltration through CookiesDoes your Web Application set Cookies that are Not Secure? Third Party Cookies such as Marketing or Advertisement related? Does it contain any tracking related cookies?

4.0/10

Get the cookies from the HAR file of a given URL and analyse and generate a report

    Formula :
        (((N-x)* w1 + (N-y)* w2 + (N-z) * w3) / ( N*(w1+w2+w3) )) * 10

    N   -   Total number of cookies in my report
    x   -   Total number of insecure cookies
    y   -   Total number of non HTtpOnly cookies
    z   -   Total number of Third Party cookies

    Weightage for the below parameters: 
    - Secure?            w1
    - HttpOnly            w2
    - Classification    w3

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

Total Cookie count	Secure	`Non Secure`	HttpOnly	`Non HttpOnly`	FirstParty	`ThirdParty`
25	3	`22`	3	`22`	25	`0`

Submit Feedback

Application Security Checks

Check for JSON Web Token (JWT) VulnerabilitiesIf your Web Application uses JWT, does it expose any known vulnerabilities in JWT Claims?

10.0/10

Get the JWT from the given response/request, and validate it for various vulnerabilities

Score calculation for JWT Analyzer

    Formula :
        (N-x)* w1  / ( N*(w1)) * 10

    N   -   Total number of checks for each JWT in my report
    x   -   Total number of failed JWT token checks


    Weightage for the below parameters: 
    - Validation Failed?            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

Checks Done
No JWT Found

Submit Feedback

Check for HTTP Strict Transport Security in API ResponsesHSTS Header forces HTTPS upon first visit. This is a fairly old header. Modern Applications should redirect HTTP to HTTPS and should handle at the Application or the Gateway layer

10.0/10

Strict-Transport-Security response header (HSTS) lets a web site tell browsers that it should only be accessed using HTTPS and not HTTP

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Host`	`URL`	`Vulnerability Found`
`None`	`None`	`None`

Submit Feedback

Check for Content Security Policy Statements in API ResponsesDoes the Web Application set the right CSP statements for enforcing security?

0.0/10

CSP provides advanced protection for Cross Site Scripting and Injection Vulnerabilities

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

Show entries

Filter:

`Host`	`URL`	`Vulnerability Found`

`ad.doubleclick.net`	`/activity;dc_pre=CPur09P3pOsCFZmTpwodRxwDDg;src=6386697;type=mppmz0;cat=pphom0;ord=845767471805;gtm=2oi4f0;auiddc=884195379.1596666275;u1=;u2=;u3=0;u4=;u5=;u6=main:mktg:business::home-merchant:::;u7=www.paypal.com;u8=;u9=c0b6f38c1730a123f9c0cb13fd3d831b;u10=us;~oref=https://www.paypal.com/`	`Content-Security-Policy header should be present`
`s94483084.t.eloqua.com`	`/visitor/v200/svrGP`	`Content-Security-Policy header should be present`
`www.paypalobjects.com`	`/webstatic/icon/pp32.png`	`Content-Security-Policy header should be present`
`www.paypalobjects.com`	`/pa/mi/3p/gtag/analytics.js`	`Content-Security-Policy header should be present`
`www.paypalobjects.com`	`/helpcenter/smartchat/sales/v1/open-chat.js`	`Content-Security-Policy header should be present`
`www.paypalobjects.com`	`/marketing/web/us/en/home-merchant/rml_bg.jpg`	`Content-Security-Policy header should be present`
`www.paypalobjects.com`	`/activation/js/marketingIntentsV2.js`	`Content-Security-Policy header should be present`
`www.paypalobjects.com`	`/pa/js/min/pa.js`	`Content-Security-Policy header should be present`
`www.paypalobjects.com`	`/pa/mi/3p/gtag/gtag.js`	`Content-Security-Policy header should be present`
`www.paypalobjects.com`	`/marketing-resources/css/1b/fa89f17d37eb3f97e39b926835ba73c0a3fd63.css`	`Content-Security-Policy header should be present`

Showing 1 to 10 of 15 entries

Submit Feedback

Check for HTTP Public Key Pinning (HPKP) in API ResponsesHPKP is a deprecated feature. Setting this feature can potentially cause disruptions to Web Application Availability

10.0/10

HPKP is a Trust of First Use approach.Modern web applications should not tie themselves to specific Public Keys

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Host`	`URL`	`Vulnerability Found`
`None`	`None`	`None`

Submit Feedback

Check for Certificate Transarency in API ResponsesAre the Certificate Transparency Headers properly set for Max-Age, Enforce and Report-URI? Is the Report-URI hosted by a 3rd Party?

5.0/10

Expect-CT headers prevents the usage of wrongly issued certificates for a site and makes sure that they do not go unnoticed

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Vulnerability Found`
`Expect-CT header not present in one or more requests`

Submit Feedback

Verify X-Frame-Option in API Response HeadersX-Frame-Option controls if 3rd party sites can embed. This can potentially be used to avoid Click-Jacking vulnerabilities

10.0/10

Sites can use X-Frame-Option to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Host`	`URL`	`Vulnerability Found`
`None`	`None`	`None`

Submit Feedback

Check for Access Control Header in API Response HeadersDoes the Web Application appropriately set Accesss-Control-Allow-Origin in API Response Headers?

10.0/10

The Access-Control-Allow-Origin response header indicates whether the response can be shared with requesting code from the given origin

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Host`	`URL`	`Vulnerability Found`
`None`	`None`	`None`

Submit Feedback

Check for MIME-type Sniffing Opt Out through X-Content-Type-Options HeaderDoes the Web Application appropriately set X-Content-Type-Options in API Response Headers?

10.0/10

X-Content-Type-Options prevents the browser from doing MIME-type sniffing

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Host`	`URL`	`Vulnerability Found`
`None`	`None`	`None`

Submit Feedback

Check for Referrer Policy in API Response HeadersDoes the Web Application appropriately set Referer-Policy in API Response Headers?

10.0/10

The Referrer-Policy HTTP header controls how much referrer information (sent via the Referer header) should be included with requests.

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Host`	`URL`	`Vulnerability Found`
`None`	`None`	`None`

Submit Feedback

Check for E-Tag settings in API Response HeadersE-Tags are used for Concurrency Control. Does your Web Application have weaker tags?

10.0/10

Etags are similar to fingerprints and might be used for tracking purposes

Score calculation for Header Check

    Formula :
        (N-x)* w1  / ( N*(w1) ) * 10

    N   -   Total number of header checks in my report
    x   -   Total number of failed header checks


    Weightage for the below parameters: 
    - HeaderCheck            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`Host`	`URL`	`Vulnerability Found`
`None`	`None`	`None`

Submit Feedback

Check for Javascript Vulnerabilities in Web ApplicationDoes the Web Application, across all the APIs, contain any known Javascript Vulnerabilities?

10.0/10

Find Vulnerable data in JS files using RetireJS

Score calculation for Vulnerability in JS

    Formula :
        Nil

    *   If we found any Vuls through RetireJS, we will score by the following.

        H or M > 10,  then the score will be 2,
        M < 10 or L > 20, then the score will be 5,
        L < 20 and L > 10, then the score will be 7,
        L < 10 and L > 5, then the score will be 8,
        L and L < 5, then the score will be 9,

        H   -   High Vulnerability Count
        M   -   Medium Vulnerability Count
        L   -   Low Vulnerability Count

No records found.

Submit Feedback

Verify Session Token in URLs for Cross-Site Request Forgery VulnerabilitiesDoes the Web Application exhibit any Session Token pattern in the GET Requests calls, and if so, Is it vulnerable for Cross Session Attacks?

10.0/10

Score calculation for Session Token Checks

    Formula :
        (N-x)* w1  / ( N*(w1)) * 10

    N   -   Total number of session token checks for each URL in my report
    x   -   Total number of failed session token checks


    Weightage for the below parameters: 
    - Status Check Failed?            w1

Score	Aspect
0-5	Unacceptable
5-7	Adequate
7-8	Good
8-10	Excellent

`URL`	`Vulnerabilities Found`
`None`	`None`

Submit Feedback

Check for PII in HTML generated by the Web ApplicationAre there any Personally Identifiable Information in the HTML Page generated by the Web Application?

10.0/10

Verify sensitive information from HAR file Content(only HTML and JS)

Score calculation for Application Security

    Formula :
        10-(Avg weight/No.of.entries)

    *   Weight will be differ from infoTypes.
    *   The minimum weight will be taken for specific infoTypes.
    *   All entries will be consider. Because the info which we found through DLP is possible for leakage of info about users.

Category	Checks Done For	Status
Critical	Encryption key, Json Web Token, Password and Weak Password Hash

Submit Feedback

Check for Cross Site Scripting (XSS) Vulnerabilities in HTML code generated by the Web ApplicationIs your Web Application, particularly in In-Line Scripts in HTML, vulnerable to Cross Site Scripting Attacks?

10.0/10

Find Vulnerable data in JavaScripts and Find Vulnerable URL's using XSSStrike

Score calculation for Vulnerability in HTML page JS

    Formula :
        Nil

    *   If we found any Vuls through XSS Strike Scanner, we will score by the following.

        H or M > 10,  then the score will be 2,
        M < 10,  then the score will be 5,

        H   -   High Vulnerability Count
        M   -   Medium Vulnerability Count

No records found.

Submit Feedback

8.9 / 10

How we calculate Scoring?

Scoring is between 0 and 10, with 10 being the Best Score and 100% COMPLIANT.

Scoring Logic:
[NUMERATOR] / [DENOMINATOR] x 10.

Expand each check to see the detailed description for the NUMERATOR and the DENOMINATOR sections, and Evidence Records.

Each evidence record is in one of 3 states:

COMPLIANT: The resource and attributes PASS the check

NON_COMPLIANT: The resource or attributes FAIL the check

NOT_DETERMINED: We are quite not sure

NOT_DETERMINED status is when the system cannot process the request and we can neither declare COMPLIANT or NON_COMPLIANT. These records are EXCLUDED from the scoring logic.

Warnings

Warnings PrivacyBison publishes warnings when it learns a service has announced a data breach or is found misusing user data. If you believe a warning should be published for PrivacyBison.com

Submit Feedback

Share this page:

Observations based on User Activity File

General Security Checks

Check for Known Social Engineering VulnerabilitiesAre there any Malicious, Infected and Unsafe URLs used in your Web Application? These URLs can propogate Phishing or Malware Attacks 10.0/10

Check for Known Social Engineering VulnerabilitiesAre there any Malicious, Infected and Unsafe URLs used in your Web Application? These URLs can propogate Phishing or Malware Attacks

10.0/10

Score calculation for Google Web Risk

Check for Default Database CredentialsIs your Web Application, or any of its associated Sub-Domains, have default database credentials? 10.0/10

Check for Default Database CredentialsIs your Web Application, or any of its associated Sub-Domains, have default database credentials?

10.0/10

Score calculation for Default Credential Checks

Check for Directory Traversal VulnerabilitiesAre there any sensitive files present in your Web Application Domain? 10.0/10

Check for Directory Traversal VulnerabilitiesAre there any sensitive files present in your Web Application Domain?

10.0/10

Score calculation for Directory Traversal

Check for Open System VulnerabilitiesAre there System Ports open in your Web Applicatio Domain, or any of its associated Sub-Domains? 10.0/10

Check for Open System VulnerabilitiesAre there System Ports open in your Web Applicatio Domain, or any of its associated Sub-Domains?

10.0/10

Score calculation for Open Port Checks

Check for SSL/TLS Certificate VulnerabilitiesDoes your Web Application use the appropriate level of SSL/TLS Certificates such as Protocol Version, Cipher Strength? 10.0/10

Check for SSL/TLS Certificate VulnerabilitiesDoes your Web Application use the appropriate level of SSL/TLS Certificates such as Protocol Version, Cipher Strength?

10.0/10

Score calculation for SSLTLSAnalysis

Check for Publicly Available System Threats and VulnerabilitiesWe check for Known, Publicly Available System Vulnerabilities using Sandboxing technologies. We collect this information from AlienVault OTX Exchange 0.0/10

Check for Publicly Available System Threats and VulnerabilitiesWe check for Known, Publicly Available System Vulnerabilities using Sandboxing technologies. We collect this information from AlienVault OTX Exchange

0.0/10

Score calculation for Vulnerability in HTML page JS

Select samples of Malwares found through Sandboxing:

Privacy Checks

Check for PII in API Request CookiesAre there any Personally Identifiable Information in the API Request Cookies? This includes all APIs used by the Web Application. It is best practice to avoid PII information in API Requests, unless it is required. 10.0/10

Check for PII in API Request CookiesAre there any Personally Identifiable Information in the API Request Cookies? This includes all APIs used by the Web Application. It is best practice to avoid PII information in API Requests, unless it is required.

10.0/10

Score calculation for DLP

Check for PII in API Request HeadersAre there any Personally Identifiable Information in the API Request Headers? This includes all APIs used by the Web Application. It is best practice to completely avoid PII information in API Requests, unless it is required. 10.0/10

Check for PII in API Request HeadersAre there any Personally Identifiable Information in the API Request Headers? This includes all APIs used by the Web Application. It is best practice to completely avoid PII information in API Requests, unless it is required.

10.0/10

Score calculation for DLP

Check for PII in API Request QueriesAre there any Personally Identifiable Information in the API GET Requests? This includes all APIs used by the Web Application. It is best practice to completely avoid PII information in API GET Requests parameters. 10.0/10

Check for PII in API Request QueriesAre there any Personally Identifiable Information in the API GET Requests? This includes all APIs used by the Web Application. It is best practice to completely avoid PII information in API GET Requests parameters.

10.0/10

Score calculation for DLP

Check for PII in API Response Bodies from the Web ApplicationAre there any Personally Identifiable Information in the Body of the API Responses? This includes all API Responses from the Web Application. 10.0/10

Check for PII in API Response Bodies from the Web ApplicationAre there any Personally Identifiable Information in the Body of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Score calculation for DLP

Check for PII in API Cookies from the Web ApplicationAre there any Personally Identifiable Information set in the Cookies of the API Responses? This includes all API Responses from the Web Application. 10.0/10

Check for PII in API Cookies from the Web ApplicationAre there any Personally Identifiable Information set in the Cookies of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Score calculation for DLP

Check for PII in API Response Headers from the Web ApplicationAre there any Personally Identifiable Information set in the Headers of the API Responses? This includes all API Responses from the Web Application. 10.0/10

Check for PII in API Response Headers from the Web ApplicationAre there any Personally Identifiable Information set in the Headers of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Score calculation for DLP

Check for PII in CacheAre there any Personally Identifiable Information in Caches? 10.0/10

Check for PII in CacheAre there any Personally Identifiable Information in Caches?

10.0/10

Score calculation for DLP

Check for Data Exfiltration through CookiesDoes your Web Application set Cookies that are Not Secure? Third Party Cookies such as Marketing or Advertisement related? Does it contain any tracking related cookies? 4.0/10

Check for Data Exfiltration through CookiesDoes your Web Application set Cookies that are Not Secure? Third Party Cookies such as Marketing or Advertisement related? Does it contain any tracking related cookies?

4.0/10

Score calculation for Cookie Analyzer

Application Security Checks

Check for JSON Web Token (JWT) VulnerabilitiesIf your Web Application uses JWT, does it expose any known vulnerabilities in JWT Claims? 10.0/10

Check for JSON Web Token (JWT) VulnerabilitiesIf your Web Application uses JWT, does it expose any known vulnerabilities in JWT Claims?

10.0/10

Score calculation for JWT Analyzer

Check for HTTP Strict Transport Security in API ResponsesHSTS Header forces HTTPS upon first visit. This is a fairly old header. Modern Applications should redirect HTTP to HTTPS and should handle at the Application or the Gateway layer 10.0/10

Check for HTTP Strict Transport Security in API ResponsesHSTS Header forces HTTPS upon first visit. This is a fairly old header. Modern Applications should redirect HTTP to HTTPS and should handle at the Application or the Gateway layer

10.0/10

Score calculation for Header Check

Check for Content Security Policy Statements in API ResponsesDoes the Web Application set the right CSP statements for enforcing security? 0.0/10

Check for Content Security Policy Statements in API ResponsesDoes the Web Application set the right CSP statements for enforcing security?

0.0/10

Score calculation for Header Check

Check for HTTP Public Key Pinning (HPKP) in API ResponsesHPKP is a deprecated feature. Setting this feature can potentially cause disruptions to Web Application Availability 10.0/10

Check for HTTP Public Key Pinning (HPKP) in API ResponsesHPKP is a deprecated feature. Setting this feature can potentially cause disruptions to Web Application Availability

10.0/10

Score calculation for Header Check

Check for Certificate Transarency in API ResponsesAre the Certificate Transparency Headers properly set for Max-Age, Enforce and Report-URI? Is the Report-URI hosted by a 3rd Party? 5.0/10

Check for Certificate Transarency in API ResponsesAre the Certificate Transparency Headers properly set for Max-Age, Enforce and Report-URI? Is the Report-URI hosted by a 3rd Party?

Check for Known Social Engineering VulnerabilitiesAre there any Malicious, Infected and Unsafe URLs used in your Web Application? These URLs can propogate Phishing or Malware Attacks

10.0/10

Check for Default Database CredentialsIs your Web Application, or any of its associated Sub-Domains, have default database credentials?

10.0/10

Check for Directory Traversal VulnerabilitiesAre there any sensitive files present in your Web Application Domain?

10.0/10

Check for Open System VulnerabilitiesAre there System Ports open in your Web Applicatio Domain, or any of its associated Sub-Domains?

10.0/10

Check for SSL/TLS Certificate VulnerabilitiesDoes your Web Application use the appropriate level of SSL/TLS Certificates such as Protocol Version, Cipher Strength?

10.0/10

Check for Publicly Available System Threats and VulnerabilitiesWe check for Known, Publicly Available System Vulnerabilities using Sandboxing technologies. We collect this information from AlienVault OTX Exchange

0.0/10

Check for PII in API Request CookiesAre there any Personally Identifiable Information in the API Request Cookies? This includes all APIs used by the Web Application. It is best practice to avoid PII information in API Requests, unless it is required.

10.0/10

Check for PII in API Request HeadersAre there any Personally Identifiable Information in the API Request Headers? This includes all APIs used by the Web Application. It is best practice to completely avoid PII information in API Requests, unless it is required.

10.0/10

Check for PII in API Request QueriesAre there any Personally Identifiable Information in the API GET Requests? This includes all APIs used by the Web Application. It is best practice to completely avoid PII information in API GET Requests parameters.

10.0/10

Check for PII in API Response Bodies from the Web ApplicationAre there any Personally Identifiable Information in the Body of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Check for PII in API Cookies from the Web ApplicationAre there any Personally Identifiable Information set in the Cookies of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Check for PII in API Response Headers from the Web ApplicationAre there any Personally Identifiable Information set in the Headers of the API Responses? This includes all API Responses from the Web Application.

10.0/10

Check for PII in CacheAre there any Personally Identifiable Information in Caches?

10.0/10

Check for Data Exfiltration through CookiesDoes your Web Application set Cookies that are Not Secure? Third Party Cookies such as Marketing or Advertisement related? Does it contain any tracking related cookies?

4.0/10

Check for JSON Web Token (JWT) VulnerabilitiesIf your Web Application uses JWT, does it expose any known vulnerabilities in JWT Claims?

10.0/10

Check for HTTP Strict Transport Security in API ResponsesHSTS Header forces HTTPS upon first visit. This is a fairly old header. Modern Applications should redirect HTTP to HTTPS and should handle at the Application or the Gateway layer

10.0/10

Check for Content Security Policy Statements in API ResponsesDoes the Web Application set the right CSP statements for enforcing security?

0.0/10

Check for HTTP Public Key Pinning (HPKP) in API ResponsesHPKP is a deprecated feature. Setting this feature can potentially cause disruptions to Web Application Availability

10.0/10

Check for Certificate Transarency in API ResponsesAre the Certificate Transparency Headers properly set for Max-Age, Enforce and Report-URI? Is the Report-URI hosted by a 3rd Party?

5.0/10

Verify X-Frame-Option in API Response HeadersX-Frame-Option controls if 3rd party sites can embed. This can potentially be used to avoid Click-Jacking vulnerabilities

10.0/10

Check for Access Control Header in API Response HeadersDoes the Web Application appropriately set Accesss-Control-Allow-Origin in API Response Headers?

10.0/10

Check for MIME-type Sniffing Opt Out through X-Content-Type-Options HeaderDoes the Web Application appropriately set X-Content-Type-Options in API Response Headers?

10.0/10

Check for Referrer Policy in API Response HeadersDoes the Web Application appropriately set Referer-Policy in API Response Headers?

10.0/10

Check for E-Tag settings in API Response HeadersE-Tags are used for Concurrency Control. Does your Web Application have weaker tags?

10.0/10

Check for Javascript Vulnerabilities in Web ApplicationDoes the Web Application, across all the APIs, contain any known Javascript Vulnerabilities?

10.0/10

Verify Session Token in URLs for Cross-Site Request Forgery VulnerabilitiesDoes the Web Application exhibit any Session Token pattern in the GET Requests calls, and if so, Is it vulnerable for Cross Session Attacks?

10.0/10

Check for PII in HTML generated by the Web ApplicationAre there any Personally Identifiable Information in the HTML Page generated by the Web Application?

10.0/10

Check for Cross Site Scripting (XSS) Vulnerabilities in HTML code generated by the Web ApplicationIs your Web Application, particularly in In-Line Scripts in HTML, vulnerable to Cross Site Scripting Attacks?

10.0/10