ZAP Scanning Report

Risk Level	Number of Alerts
High	0
Medium	0
Low	1
Informational	1
False Positives:	0

名稱	Risk Level	Number of Instances
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)	Low	4
User Agent Fuzzer	Informational	12

名稱	Rule Type	Threshold	Strength
Directory Browsing	Active	MEDIUM	MEDIUM
CRLF Injection	Active	MEDIUM	MEDIUM
Path Traversal	Active	MEDIUM	MEDIUM
Remote File Inclusion	Active	MEDIUM	MEDIUM
Parameter Tampering	Active	MEDIUM	MEDIUM
Server Side Include	Active	MEDIUM	MEDIUM
GET for POST	Active	MEDIUM	MEDIUM
Cross Site Scripting (Reflected)	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent)	Active	MEDIUM	MEDIUM
Script Active Scan Rules	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent) - Prime	Active	MEDIUM	MEDIUM
Cross Site Scripting (Persistent) - Spider	Active	MEDIUM	MEDIUM
SQL 注入	Active	MEDIUM	MEDIUM
SQL 注入 - MySQL	Active	MEDIUM	MEDIUM
SQL 注入 - Hypersonic SQL	Active	MEDIUM	MEDIUM
SQL 注入 - Oracle	Active	MEDIUM	MEDIUM
SQL 注入 - PostgreSQL	Active	MEDIUM	MEDIUM
SQL 注入 - SQLite	Active	MEDIUM	MEDIUM
Cross Site Scripting (DOM Based)	Active	MEDIUM	MEDIUM
SQL 注入 - MsSQL	Active	MEDIUM	MEDIUM
ELMAH 資訊外洩	Active	MEDIUM	MEDIUM
Trace.axd Information Leak	Active	MEDIUM	MEDIUM
XSLT 注入	Active	MEDIUM	MEDIUM
.htaccess Information Leak	Active	MEDIUM	MEDIUM
.env 資訊外洩	Active	MEDIUM	MEDIUM
Server Side Code Injection	Active	MEDIUM	MEDIUM
Hidden File Finder	Active	MEDIUM	MEDIUM
XPath Injection	Active	MEDIUM	MEDIUM
遠端作業系統命令注入	Active	MEDIUM	MEDIUM
XML External Entity Attack	Active	MEDIUM	MEDIUM
Generic Padding Oracle	Active	MEDIUM	MEDIUM
Spring Actuator Information Leak	Active	MEDIUM	MEDIUM
SOAP Action Spoofing	Active	MEDIUM	MEDIUM
Log4Shell	Active	MEDIUM	MEDIUM
SOAP XML 注入	Active	MEDIUM	MEDIUM
Spring4Shell	Active	MEDIUM	MEDIUM
OpenSSL 心血漏洞	Active	MEDIUM	MEDIUM
緩衝區溢位	Active	MEDIUM	MEDIUM
Source Code Disclosure - CVE-2012-1823	Active	MEDIUM	MEDIUM
Format String Error	Active	MEDIUM	MEDIUM
Server Side Template Injection	Active	MEDIUM	MEDIUM
Remote Code Execution - CVE-2012-1823	Active	MEDIUM	MEDIUM
Cloud Metadata Potentially Exposed	Active	MEDIUM	MEDIUM
外部重新導向	Active	MEDIUM	MEDIUM
Server Side Template Injection (Blind)	Active	MEDIUM	MEDIUM
Source Code Disclosure - /WEB-INF folder	Active	MEDIUM	MEDIUM
Session Management Response Identified	Passive	MEDIUM	-
Verification Request Identified	Passive	MEDIUM	-
Private IP Disclosure	Passive	MEDIUM	-
Session ID in URL Rewrite	Passive	MEDIUM	-
Insecure JSF ViewState	Passive	MEDIUM	-
Vulnerable JS Library (Powered by Retire.js)	Passive	MEDIUM	-
Charset Mismatch	Passive	MEDIUM	-
Cookie No HttpOnly Flag	Passive	MEDIUM	-
Cookie Without Secure Flag	Passive	MEDIUM	-
Re-examine Cache-control Directives	Passive	MEDIUM	-
Cross-Domain JavaScript Source File Inclusion	Passive	MEDIUM	-
Content-Type Header Missing	Passive	MEDIUM	-
Anti-clickjacking Header	Passive	MEDIUM	-
X-Content-Type-Options Header Missing	Passive	MEDIUM	-
Application Error Disclosure	Passive	MEDIUM	-
Information Disclosure - Debug Error Messages	Passive	MEDIUM	-
Information Disclosure - Sensitive Information in URL	Passive	MEDIUM	-
Information Disclosure - Sensitive Information in HTTP Referrer Header	Passive	MEDIUM	-
Information Disclosure - Suspicious Comments	Passive	MEDIUM	-
Open Redirect	Passive	MEDIUM	-
Cookie Poisoning	Passive	MEDIUM	-
User Controllable Charset	Passive	MEDIUM	-
User Controllable HTML Element Attribute (Potential XSS)	Passive	MEDIUM	-
WSDL File Detection	Passive	MEDIUM	-
Loosely Scoped Cookie	Passive	MEDIUM	-
Viewstate	Passive	MEDIUM	-
Directory Browsing	Passive	MEDIUM	-
Heartbleed OpenSSL Vulnerability (Indicative)	Passive	MEDIUM	-
Strict-Transport-Security Header	Passive	MEDIUM	-
HTTP Server Response Header	Passive	MEDIUM	-
Content Security Policy (CSP) Header Not Set	Passive	MEDIUM	-
X-Backend-Server Header Information Leak	Passive	MEDIUM	-
Secure Pages Include Mixed Content	Passive	MEDIUM	-
HTTP to HTTPS Insecure Transition in Form Post	Passive	MEDIUM	-
HTTPS to HTTP Insecure Transition in Form Post	Passive	MEDIUM	-
User Controllable JavaScript Event (XSS)	Passive	MEDIUM	-
Big Redirect Detected (Potential Sensitive Information Leak)	Passive	MEDIUM	-
Retrieved from Cache	Passive	MEDIUM	-
X-ChromeLogger-Data (XCOLD) Header Information Leak	Passive	MEDIUM	-
Cookie without SameSite Attribute	Passive	MEDIUM	-
CSP	Passive	MEDIUM	-
X-Debug-Token Information Leak	Passive	MEDIUM	-
Username Hash Found	Passive	MEDIUM	-
X-AspNet-Version Response Header	Passive	MEDIUM	-
PII Disclosure	Passive	MEDIUM	-
Stats Passive Scan Rule	Passive	MEDIUM	-
Absence of Anti-CSRF Tokens	Passive	MEDIUM	-
Timestamp Disclosure	Passive	MEDIUM	-
Hash Disclosure	Passive	MEDIUM	-
跨網域設定錯誤	Passive	MEDIUM	-
Weak Authentication Method	Passive	MEDIUM	-
Reverse Tabnabbing	Passive	MEDIUM	-
Modern Web Application	Passive	MEDIUM	-
Authentication Request Identified	Passive	MEDIUM	-

Sites

http://wade0125studio.ddns.net

HTTP Response Code	Number of Responses
429 Too Many Requests	25
404 Not Found	188
405 Method Not Allowed	15
200 OK	54

No Authentication Statistics Found

Parameter Name	Type	Flags	Times Used	# Values

Alert Detail

Low	Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
Description	The web/application server is leaking information via one or more "X-Powered-By" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to.

URL	http://wade0125studio.ddns.net
方法	GET
Parameter
攻擊
Evidence	X-Powered-By:
Show / hide Request and Response
要求標頭 - size: 246 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 845 bytes.	HTTP/1.1 200 OK Date: Fri, 24 May 2024 16:52:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 470 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 470 bytes.	<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link rel=icon href="https://icoholder.com/files/img/f0794c16c06c9e501fd236e1765a430f.jpeg" type="image/x-icon" /> <link rel="stylesheet" href="../static/css/index.css"> <title>BingX</title> <style> </style> </head> <body> </body> </html>
URL	http://wade0125studio.ddns.net/robots.txt
方法	GET
Parameter
攻擊
Evidence	X-Powered-By:
Show / hide Request and Response
要求標頭 - size: 257 bytes.	GET http://wade0125studio.ddns.net/robots.txt HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 845 bytes.	HTTP/1.1 200 OK Date: Fri, 24 May 2024 16:52:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 20 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 20 bytes.	This is a robots.txt
URL	http://wade0125studio.ddns.net/sitemap.xml
方法	GET
Parameter
攻擊
Evidence	X-Powered-By:
Show / hide Request and Response
要求標頭 - size: 258 bytes.	GET http://wade0125studio.ddns.net/sitemap.xml HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 845 bytes.	HTTP/1.1 200 OK Date: Fri, 24 May 2024 16:52:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 21 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 21 bytes.	This is a sitemap.xml
URL	http://wade0125studio.ddns.net/static/css/index.css
方法	GET
Parameter
攻擊
Evidence	X-Powered-By:
Show / hide Request and Response
要求標頭 - size: 308 bytes.	GET http://wade0125studio.ddns.net/static/css/index.css HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://wade0125studio.ddns.net
要求本體 - size: 0 bytes.
回應標頭 - size: 1,017 bytes.	HTTP/1.1 200 OK Date: Fri, 24 May 2024 16:52:53 GMT Content-Disposition: inline; filename=index.css Content-Type: text/css; charset=utf-8 Content-Length: 249 Last-Modified: Fri, 24 May 2024 11:30:16 GMT Cache-Control: no-cache, no-store, must-revalidate ETag: "1716550216.120982-249-968429405" Date: Fri, 24 May 2024 16:52:53 GMT Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 249 bytes.	body { margin: 0; padding: 0; font-family: Arial, sans-serif; background-image: url("../static/imgs/e301c4f8-0158-4511-8cb8-036bc0cc6f14.jpg"); background-size: cover; background-position: center; height: 100vh; }
Instances	4
Solution	Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-Powered-By" headers.
Reference	http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
標籤	OWASP_2021_A01 WSTG-v42-INFO-08 OWASP_2017_A03
CWE Id	200
WASC Id	13
Plugin Id	10037

Informational	User Agent Fuzzer
Description	Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.

URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Evidence
Show / hide Request and Response
要求標頭 - size: 185 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Evidence
Show / hide Request and Response
要求標頭 - size: 185 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Evidence
Show / hide Request and Response
要求標頭 - size: 185 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1) pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Evidence
Show / hide Request and Response
要求標頭 - size: 197 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Evidence
Show / hide Request and Response
要求標頭 - size: 263 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0 pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Evidence
Show / hide Request and Response
要求標頭 - size: 250 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Evidence
Show / hide Request and Response
要求標頭 - size: 213 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0 pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Evidence
Show / hide Request and Response
要求標頭 - size: 207 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Evidence
Show / hide Request and Response
要求標頭 - size: 218 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp) pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Evidence
Show / hide Request and Response
要求標頭 - size: 271 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4 pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Evidence
Show / hide Request and Response
要求標頭 - size: 276 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16 pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
URL	http://wade0125studio.ddns.net
方法	GET
Parameter	Header User-Agent
攻擊	msnbot/1.1 (+http://search.msn.com/msnbot.htm)
Evidence
Show / hide Request and Response
要求標頭 - size: 181 bytes.	GET http://wade0125studio.ddns.net HTTP/1.1 host: wade0125studio.ddns.net user-agent: msnbot/1.1 (+http://search.msn.com/msnbot.htm) pragma: no-cache cache-control: no-cache
要求本體 - size: 0 bytes.
回應標頭 - size: 860 bytes.	HTTP/1.1 429 TOO MANY REQUESTS Date: Fri, 24 May 2024 16:53:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 117 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 X-Powered-By: X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Feature-Policy: none X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen X-Robots-Tag: none X-DNS-Prefetch-Control: off Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; img-src 'self'; manifest-src 'self'; frame-src 'self'; Connection: close
回應本體 - size: 117 bytes.	<!doctype html> <html lang=en> <title>429 Too Many Requests</title> <h1>Too Many Requests</h1> <p>5 per 1 minute</p>
Instances	12
Solution
Reference	https://owasp.org/wstg
標籤
CWE Id
WASC Id
Plugin Id	10104

ZAP Scanning Report

Generated on 週六, 25 5月 2024 00:56:17

ZAP Version: 2.14.0

ZAP is supported by the Crash Override Open Source Fellowship

Summary of Alerts

警示

Passing Rules

Sites

http://wade0125studio.ddns.net

No Authentication Statistics Found

Alert Detail