Security audit
Information exposure
Audit id: security.exposure.
Checks
- Software versions shown in page headers
- Folder contents open to visitors
- Technical error details shown to visitors
- Settings or backup files publicly reachable
- Readable source code files published
- Secrets left in page code or comments
- Robots file reveals sensitive paths
- Cookie name reveals the software used
- Test version of software running live
- Secrets inside data sent to the browser
- Test site shows up in search results
Findings
- The live site runs a development build or a development server
- A page shows a server error message or stack trace
- A configuration file, backup, source map or directory listing is open to anyone
- The session cookie has its framework's default name
- robots.txt names paths that look private
- A key or password is in the data the framework hands to the browser
- A key or password is readable in the page source
- A staging or test host of the site shows up in Google search
- Response headers name the server software and its version