Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s), Hash Disclosure - SHA-1
Opened this issue · 0 comments
ALERT IN QUESTION
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
DESCRIPTION
The web/application server is leaking information via one or more "X-Powered-By" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to.
SOLUTION
Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-Powered-By" headers.
REFERENCE
http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx
http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
EVIDENCE
PHP/5.4.12
ALERT IN QUESTION
Hash Disclosure - SHA-1
DESCRIPTION
A hash was disclosed by the web server - SHA-1
OTHER INFO
6fe1a50c8db02cfd7e0f401bfc4b8cfe23ff38fe
SOLUTION
Ensure that hashes that are used to protect credentials or other resources are not leaked by the web server or database. There is typically no requirement for password hashes to be accessible to the web browser.
REFERENCE
https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure
http://projects.webappsec.org/w/page/13246936/Information%20Leakage
http://openwall.info/wiki/john/sample-hashes
ATTACK
6fe1a50c8db02cfd7e0f401bfc4b8cfe23ff38fe
EVIDENCE
6fe1a50c8db02cfd7e0f401bfc4b8cfe23ff38fe