ZAP Full Scan Report about nodegoat HOT 1 OPEN

• Site: https://nodegoat.azurewebsites.net
  New Alerts

  • Content-Type Header Missing [10019] total: 3:
    • https://nodegoat.azurewebsites.net/sitemap.xml
    • https://nodegoat.azurewebsites.net/
    • https://nodegoat.azurewebsites.net/robots.txt

  Resolved Alerts

  • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 20:
  • User Agent Fuzzer [10104] total: 20:
  • X-Content-Type-Options Header Missing [10021] total: 20:
  • Cookie Slack Detector [90027] total: 20:
  • Cross Site Scripting (Reflected) [40012] total: 2:
  • X-Frame-Options Header Not Set [10020] total: 16:
  • Information Disclosure - Suspicious Comments [10027] total: 15:
  • Modern Web Application [10109] total: 15:
  • Content Security Policy (CSP) Header Not Set [10038] total: 17:
  • Incomplete or No Cache-control and Pragma HTTP Header Set [10015] total: 19:
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:
  • CSP Scanner: Wildcard Directive [10055] total: 2:
  • Anti-CSRF Tokens Check [20012] total: 3:
  • Timestamp Disclosure - Unix [10096] total: 5:
  • Reverse Tabnabbing [10108] total: 1:
  • SQL Injection [40018] total: 2:
  • Apache Range Header DoS (CVE-2011-3192) [10053] total: 7:
  • Cross Site Scripting (Reflected) [40012] total: 1:
  • Cookie Without SameSite Attribute [10054] total: 2:
  • Backup File Disclosure [10095] total: 1:
  • Cookie Without Secure Flag [10011] total: 2:
  • Directory Browsing [0] total: 2:
  • Application Error Disclosure [90022] total: 1:

View the following link to download the report.
RunnerID:197445715

from nodegoat.