Web Application Report: Target and Filters

WAS Web Application Report
Web Application Report 01 May 2021
Each targeted web application is listed with the total number of detected vulnerabilities and sensitive content.
Mahesh Channappa unilever

uneve2mc4 Whitefield
Bangalore, Karnataka 560048
India
Target and Filters

Web Applications (1) atitudefoods.attingedigital.com.br/login
Status New, Active, Re-Opened
Detection Source Qualys, Burp, Bugcrowd
Security Risk Web Applications Vulnerabilities Sensitive Contents Information

Summary Gathered
1 11 0 40
Findings by Severity
CONFIDENTIAL AND PROPRIETARY INFORMATION.

Qualys provides the QualysGuard Service "As Is," without any warranty of any kind. Qualys makes no warranty that the information contained in this report is
complete or error-free. Copyright 2021, Qualys, Inc.
Vulnerabilities by Status
Vulnerabilities by Group

OWASP Top 10 2017 Vulnerabilities
Sensitive Information
Web Application Level 5 Level 4 Level 3 Level 2 Level 1
Contents Gathered
atitudefoods.attingedigital.com.br/ 0 0 6 4 1 0 40
login

Results(51)
Vulnerability (11)
Path Disclosure (2)
150004 Path-Based Vulnerability (2)
150004 Path-Based Vulnerability atitudefoods.attingedigital.com.br/login New
URL: https://atitudefoods.attingedigital.com.br/public/web.config
Finding # 13181224 Severity Confirmed Vulnerability - Level 2
Unique # 37d54359-51c6-4904-9189-857f89d0ef8a
Group Path Disclosure First Time Detected 30 Apr 2021 22:37 GMT+0630
CWE CWE-22 Last Time Detected 30 Apr 2021 22:37 GMT+0630
OWASP A5 Broken Access Control Last Time Tested 30 Apr 2021 22:37 GMT+0630
WASC WASC-15 APPLICATION MISCONFIGURATION Times Detected 1
WASC-16 DIRECTORY INDEXING
WASC-17 IMPROPER FILESYSTEM PERMISSIONS
CVSS V3 Base 5.3 CVSS V3 Temporal5 CVSS V3 Attack Vector Network
Details
Threat
A potentially sensitive file, directory, or directory listing was discovered on the Web server.
Impact
The contents of this file or directory may disclose sensitive information.
Solution
Verify that access to this file or directory is permitted. If necessary, remove it or apply access controls to it.
Detection Information
Parameter No param has been required for detecting the information.

Authentication In order to detect this vulnerability, the scan required authentication to be enabled.
Access Path Here is the path followed by the scanner to reach the exploitable URL:
https://atitudefoods.attingedigital.com.br/
https://atitudefoods.attingedigital.com.br/api/auth/check-re
Payloads

#1 Request
GET https://atitudefoods.attingedigital.com.br/public/web.config
Referer: https://atitudefoods.attingedigital.com.br/login
Cookie:
laravel_session=eyJpdiI6ImZNNFJMRGJpUlZBVmxtMWdhb2QwakE9PSIsInZhbHVlIjoiZ2ZtbFVPS3VNczFxNnZXR0loV0E3STNsNG80TFJyZ096M3ZNeXRGbFBmNnc4MW
XSRF-
TOKEN=eyJpdiI6IlM2M3FKeTV3N0pPWnJUL2t3WFltQnc9PSIsInZhbHVlIjoiR2s4N3lKNXlJOWlFTzRwSFRkV3NuenVTU3RydmdmNjZwWWtCRUlMR0g4MC8wTlNmMlp
Host: atitudefoods.attingedigital.com.br
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15
Accept: */*
Click this link to try to reproduce the vulnerability using above payload.Note that clicking this link may not lead to visible results, either because the vulnerability
requires context to be previously set (authentication, cookies...) or because the exploitation of the vulnerability does not lead to any visible proof.
#1 Response
comment:
Original URL is: https://atitudefoods.attingedigital.com.br/public/api/auth
Microsoft URL Rewrite Module for IIS

Download: https://www.iis.net/downloads/microsoft/url-rewrite
Debug Help: https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-failed-request-tracing-to-trace-rewrite-rules
-->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Imported Rule 1" stopProcessing="true">
<match url="^(.*)/$" ignoreCase="false" />
<conditions>
<add input="{REQUEST_FILENAME}" matchType="I
* The reflected string on the response webpage indicates that the vulnerability test was successful
150004 Path-Based Vulnerability atitudefoods.attingedigital.com.br/login New
URL: https://atitudefoods.attingedigital.com.br/webmail/
Unique # 6ce8e336-77e1-49e2-a754-889e5e013811
Group Path Disclosure First Time Detected 30 Apr 2021 22:37 GMT+0630
OWASP A5 Broken Access Control Last Time Tested 30 Apr 2021 22:37 GMT+0630
WASC-16 DIRECTORY INDEXING
WASC-17 IMPROPER FILESYSTEM PERMISSIONS
Details
Threat
A potentially sensitive file, directory, or directory listing was discovered on the Web server.
Impact
The contents of this file or directory may disclose sensitive information.
Solution
Verify that access to this file or directory is permitted. If necessary, remove it or apply access controls to it.


Payloads
#1 Request
GET https://atitudefoods.attingedigital.com.br/webmail/
Cookie:
laravel_session=eyJpdiI6ImZNNFJMRGJpUlZBVmxtMWdhb2QwakE9PSIsInZhbHVlIjoiZ2ZtbFVPS3VNczFxNnZXR0loV0E3STNsNG80TFJyZ096M3ZNeXRGbFBmNnc4MW
XSRF-
TOKEN=eyJpdiI6IlM2M3FKeTV3N0pPWnJUL2t3WFltQnc9PSIsInZhbHVlIjoiR2s4N3lKNXlJOWlFTzRwSFRkV3NuenVTU3RydmdmNjZwWWtCRUlMR0g4MC8wTlNmMlp
Accept: */*
#1 Response
comment:
Original URL is: https://atitudefoods.attingedigital.com.br/
HTTP/1.1 200 OK
Information Disclosure (9)

150120 Session Cookie (Authentication Related) Does Not Contain The "secure" Attribute (1)
150120 Session Cookie (Authentication Related) atitudefoods.attingedigital.com.br/login New
Does Not Contain The "secure" Attribute
URL: https://atitudefoods.attingedigital.com.br/
Unique # 92c14e40-1410-45c0-bdf4-0be771a16d5a
Group Information Disclosure First Time Detected 30 Apr 2021 22:37 GMT+0630
OWASP A2 Broken Authentication Last Time Tested 30 Apr 2021 22:37 GMT+0630
A3 Sensitive Data Exposure
WASC WASC-4 INSUFFICIENT TRANSPORT LAYER PROTECTION Times Detected 1
CVSS V3 Base 6.5 CVSS V3 Temporal6.2 CVSS V3 Attack Vector Network
Details
Threat
The session cookie used to identify authenticated users of the Web application does not contain the "secure" attribute.
Impact
Cookies with the "secure" attribute are only permitted to be sent via HTTPS. Session cookies sent via HTTP expose an unsuspecting user to sniffing attacks that
could lead to user impersonation or compromise of the application account.
Solution
If the associated risk of a compromised account is high, apply the "secure" attribute to session cookies and force all sensitive requests to be sent via HTTPS.

Cookie Name(s) laravel_session, XSRF-TOKEN

Authentication In order to detect this vulnerability, no authentication has been required.
Payloads
#1 Request
GET https://atitudefoods.attingedigital.com.br/
Accept: */*
#1 Response
laravel_session=
302 Found
Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Cache-Control: no-cache, private
Set-Cookie: XSRF-
TOKEN=eyJpdiI6IlViVEVFcm14a09sSmkzSGVLWXNOS2c9PSIsInZhbHVlIjoiRVpzV3Z4R0xUL20vUkNjN1RXdDI2czNuQUZ3REp4ZTdyeDAvMVA0K1paL0tCL0Frb04ydnBoYzdVNlVMTW5zazB
expires=Fri, 30-Apr-2021 19:10:09 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6IlE4YkU5NkFxV2hFMFZDQjd5SWtGTUE9PSIsInZhbHVlIjoibU11cjJyZG43cUJxOWJGTjBjNzBUMWRZaEdhVHJsMkpMRVR4dlNUenZEcytUZzIvV1RYNDdkYUZxTWEvQ
expires=Fri, 30-Apr-2021 19:10:09 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Location: https://atitudefoods.attingedigital.com.br
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
XSRF-TOKEN=
302 Found
Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
150121 Session Cookie (Authentication Related) Does Not Contain The "HTTPOnly" Attribute (1)
150121 Session Cookie (Authentication Related) atitudefoods.attingedigital.com.br/login New
Does Not Contain The "HTTPOnly" Attribute
Unique # 76f7c457-20e3-42c6-b69f-4d04dc609589
OWASP A2 Broken Authentication Last Time Tested 30 Apr 2021 22:37 GMT+0630
A3 Sensitive Data Exposure

Details
Threat
The session cookie used to identify authenticated users of the Web application does not contain the "HTTPOnly" attribute.
Impact
Cookies without the "HTTPOnly" attribute are permitted to be accessed via JavaScript. Cross-site scripting attacks can steal to session cookies which could lead
to user impersonation or compromise of the application account.
Solution
If the associated risk of a compromised account is high, apply the "HTTPOnly" attribute to session cookies.
Cookie Name(s) XSRF-TOKEN

Payloads
#1 Request
Accept: */*
#1 Response
XSRF-TOKEN=
302 Found
Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
150124 Clickjacking - Framable Page (1)

150124 Clickjacking - Framable Page atitudefoods.attingedigital.com.br/login New
Unique # 287a431a-f937-44b3-9b92-7a056873d64f
OWASP A6 Security Misconfiguration Last Time Tested 30 Apr 2021 22:37 GMT+0630

Details
Threat
The web page can be framed. This means that clickjacking attacks against users are possible.
Impact
With clickjacking, an attacker can trick a victim user into clicking an invisible frame on the web page, thereby causing the victim to take an action they did not
intend to take.
Solution
Clickjacking prevention mechanisms include:
- X-Frame-Options: This HTTP response header can be used to prevent framing of web pages.
- Content-Security-Policy: The 'frame-ancestors' directive can be used to prevent framing of web pages.
- Framekiller JavaScript code designed to prevent a malicious user from framing the page. This method is not recommended due to its unreliability.
See the OWASP Clickjacking Defense Cheat Sheet for more information.

Payloads
#1 Request
Accept: */*
#1 Response
The URI was framed.
150161 Session Cookie Does Not Contain the "Secure" Attribute (1)
150161 Session Cookie Does Not Contain the atitudefoods.attingedigital.com.br/login New
"Secure" Attribute
URL: https://atitudefoods.attingedigital.com.br/login
Unique # 0728a0b8-bff1-4acc-aa9e-3c26a6ce9c01
OWASP A3 Sensitive Data Exposure Last Time Tested 30 Apr 2021 22:37 GMT+0630

Details
Threat
The session cookie does not contain the "secure" attribute
Impact
Session Cookies with "secure" attribute are only permitted to be sent via HTTPS. Session cookies sent via HTTP expose users to sniffing attacks that could lead
to user impersonation or account compromise
Solution
Apply the "secure" attribute to session cookies to ensure that they will be sent via HTTPS only.
Cookie Name(s) laravel_session

Payloads
#1 Request
GET https://atitudefoods.attingedigital.com.br/login
Accept: */*
#1 Response
laravel_session=
302 Found
Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
150162 Use of JavaScript Library with Known Vulnerability (1)

150162 Use of JavaScript Library with Known atitudefoods.attingedigital.com.br/login New
Vulnerability
Unique # e09fe365-255c-49f9-962c-f4ecad12a7c1

OWASP A9 Using Components with Known Vulnerabilities Last Time Tested 30 Apr 2021 22:37 GMT+0630
WASC - Times Detected 1
Details
Threat
The web application is using a JavaScript library that is known to contain at least one vulnerability.
Impact
Attackers could potentially exploit the vulnerability in the JavaScript library. The impact of a successful exploit depends on the nature of the vulnerability and how
the web application makes use of the library.
Solution
Please refer to the information provided in the response section. Also check the vendor's security advisories related to the vulnerable version of the library.

Payloads
#1 Request
Accept: */*
#1 Response
Vulnerable javascript library: jQuery
version: 3.3.1
script uri: https://atitudefoods.attingedigital.com.br/assets/js/jquery-3.3.1.min.js
Details:
CVE-2019-11358: jQuery versions below 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. An unsanitized
source object containing an enumerable __proto__ property could extend the native Object.prototype. Please refer following resources for more details: https://blog.jquery.com/2019/04/10/jquery-3-4-0-
released/, https://nvd.nist.gov/vuln/detail/CVE-2019-11358, https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b, https://nvd.nist.gov/vuln/detail/CVE-2019-11358.
----------------------------------------------
jQuery versions below 3.5.0 used a regex in its jQuery.htmlPrefilter method. This regex which is used to ensure that all tags are XHTML-compliant could introduce a vulnerability to Cross-site
Scripting(XSS) attack. Please refer to vendor documentation (https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ and https://jquery.com/upgrade-guide/3.5/) for the security fix details.
----------------------------------------------
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(),
and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Please refer https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 and https://nvd.nist.gov/vuln/
detail/CVE-2020-11022 for details.
Found on the following pages (only first 10 pages are reported):

https://atitudefoods.attingedigital.com.br/meus-dados
https://atitudefoods.attingedigital.com.br/desafio
https://atitudefoods.attingedigital.com.br/regulamento
https://atitudefoods.attingedigital.com.br/mecanica
150263 Insecure Transport (1)

150263 Insecure Transport atitudefoods.attingedigital.com.br/login New
URL: http://atitudefoods.attingedigital.com.br/
Unique # b6ec8980-0ff1-4c9f-9e3f-d9eda8da4f1c
Details
Threat
A link is functional over an insecure, HTTP connection. No redirection to HTTPS occurs. Note that this QID is reported for 200/OK responses as well as 4xx and
5xx responses.
Impact
Data sent over a non-HTTPS connection is unencrypted and vulnerable to network sniffing attacks that can expose sensitive or confidential information. This
includes non-secure cookies and other potentially sensitive data contained in HTTP headers. Even if no sensitive data is transmitted, man-in-the-middle (MITM)
attacks are possible over non-HTTPS connections. An attacker who exploits MITM can intercept and change the conversation between the client (e.g., web
browser, mobile device, etc.) and the server.
More information: Why HTTPS Matters
Solution
Ensure that all links are accessible over HTTPS only. The most secure design is for the application to listen and respond only to encrypted HTTPS requests.
Alternatively, if non-HTTPS requests are accepted, the server should redirect these requests to HTTPS using a 301 or 302 response.
It is also strongly recommended to use HTTP Strict Transport Security (HSTS) so that web browsers are instructed to use only HTTPS when making requests to
the server. QID 150135 will be reported when links without HSTS are found.
For more information, see the Application section of OWASP's Transport Layer Protection Cheat Sheet.

Payloads

#1 Request
GET http://atitudefoods.attingedigital.com.br/
Cookie:
laravel_session=eyJpdiI6IjJlL1I5akVUc0FuRW83MVM1K09zVGc9PSIsInZhbHVlIjoiSjR5V0JBKyt3OWdHS0Y4Z2pUNXNmU3A0aUN5dlF2UGV2V2s0M1JpS3pPN3FYUWV
XSRF-
TOKEN=eyJpdiI6Ijd1RjN3NzRUL3VvWElzU2hoWVpXb1E9PSIsInZhbHVlIjoiV2grMUxtN2ZpTE9LV21XT2Z6cWgxcnFCMGRIQmRrZW0xaUNJeUR0RFVDVklvdmN4T3lic
Accept: */*
#1 Response
Date: Fri, 30 Apr 2021 17:10:57 GMT

Server: Apache
Set-Cookie: XSRF-
TOKEN=eyJpdiI6IlNHWmVKblExek81Tm96eHFsOWFqNmc9PSIsInZhbHVlIjoiZUNNSS9tR1ZVV0lMdVVlejJmZ1o5YTlBQnBsNkRyU2NmbWdwMVRNTFNNNjdBVW1GM1MrbTJtU254YmdleU9D
Set-Cookie:
laravel_session=eyJpdiI6InFueXd6UXd0eC9SdUU3bTQ0cXNsWEE9PSIsInZhbHVlIjoiRjhCOEZBdzU3Y0VsTkRIY2N2WFFFUW1UM1U5YVBhZnliMVZVaG50MjhSUStJd0ZwVlFHQWNxSnpwZU0
http://atitudefoods.attingedigital.com.br/ response code: 200
<!DOCTYPE html>
<html class="no-js" lang="en" dir="ltr">
<head>
<meta charset="utf-8" />
<meta http-equiv="x-ua-compatible" content="ie=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
<title>Liga Atitude Foods</title>
<link rel="preconnect" href="https://fonts.gstatic.com">
<link href="https://fonts.googleapis.com/css2?family=Oswald:wght@200;300;400;700&display=swap" rel="preload" as="style">
<link href="https://fonts
150122 Cookie Does Not Contain The "secure" Attribute (1)

150122 Cookie Does Not Contain The "secure" atitudefoods.attingedigital.com.br/login New
Attribute
Unique # 429a51f2-043e-42e2-9e92-1134ab50fbb5
Details
Threat
The cookie does not contain the "secure" attribute.
Impact
Cookies with the "secure" attribute are only permitted to be sent via HTTPS. Cookies sent via HTTP expose an unsuspecting user to sniffing attacks that could
lead to user impersonation or compromise of the application account.

Solution
If the associated risk of a compromised account is high, apply the "secure" attribute to cookies and force all sensitive requests to be sent via HTTPS.
Cookie Name(s) laravel_session, XSRF-TOKEN

Payloads
#1 Request
Accept: */*
#1 Response
laravel_session=
302 Found
Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
XSRF-TOKEN=
302 Found
Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
150123 Cookie Does Not Contain The "HTTPOnly" Attribute (1)

150123 Cookie Does Not Contain The atitudefoods.attingedigital.com.br/login New
"HTTPOnly" Attribute
Unique # 8cb310f7-2baf-4357-961a-4d4ce5133628
Group First Time Detected 30 Apr 2021 22:37 GMT+0630

Information Disclosure
Details
Threat
The cookie does not contain the "HTTPOnly" attribute.
Impact
Cookies without the "HTTPOnly" attribute are permitted to be accessed via JavaScript. Cross-site scripting attacks can steal cookies which could lead to user
impersonation or compromise of the application account.
Solution
If the associated risk of a compromised account is high, apply the "HTTPOnly" attribute to cookies.
Cookie Name(s) XSRF-TOKEN

Payloads
#1 Request
Accept: */*
#1 Response
XSRF-TOKEN=
302 Found
Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
150081 X-Frame-Options header is not set (1)

150081 X-Frame-Options header is not set atitudefoods.attingedigital.com.br/login New

Finding # 13181222 Severity Potential Vulnerability - Level 1
Unique # bb161d26-63f4-4850-a7f4-bb55d3cf07c5
OWASP A6 Security Misconfiguration Last Time Tested 30 Apr 2021 22:37 GMT+0630
Details
Threat
*** NOTE: This QID has been deprecated and replaced with QID 150245 as of September 2020. This QID will be removed from WAS in the future. ***
The X-Frame-Options header is not set in the HTTP response, meaning the page can potentially be loaded into an attacker-controlled frame. This could lead to
clickjacking, where an attacker adds an invisible layer on top of the legitimate page to trick users into clicking on a malicious link or taking a harmful action.
Impact
Without an X-Frame-Options response header, clickjacking may be possible. However, if the application properly uses the Content-Security-Policy "frame-
ancestors" directive, then modern web browsers would stop the page from being framed and prevent clickjacking.
Solution
The X-Frame-Options allows three values: DENY, SAMEORIGIN and ALLOW-FROM. It is recommended to use DENY, which prevents all domains from framing
the page or SAMEORIGIN, which allows framing only by the same site. DENY and SAMEORGIN are supported by all browsers. Using ALLOW-FROM is not
recommended because not all browsers support it.
Note: To avoid a common X-Frame-Options implementation mistake, see https://blog.qualys.com/securitylabs/2015/10/20/clickjacking-a-common-implementation-

mistake-that-can-put-your-websites-in-danger.
It is also recommended to use the Content-Security-Policy "frame-ancestors directive". For more information, see the OWASP Clickjacking Defense Cheat Sheet

Access Path Here is the path followed by the scanner to reach the exploitable URL:
Payloads
#1 Request
Accept: */*
#1 Response
The response for this request either did not have an "X-FRAME-OPTIONS" header present or was not set to DENY or SAMEORIGIN

Information Gathered (40)

Scan Diagnostics (28)
45017 Operating System Detected (1)
45017 Operating System Detected atitudefoods.attingedigital.com.br/login
Finding # 4226763 Severity Information Gathered - Level 2
Unique # 3fb37005-5c30-4d61-86bc-a044a092f594
Group Scan Diagnostics
CWE - Detection Date 30 Apr 2021 22:37 GMT+0630
OWASP -
WASC -
Details
Threat
Several different techniques can be used to identify the operating system (OS) running on a host. A short description of these techniques is provided below. The
specific technique used to identify the OS on this host is included in the RESULTS section of your report.
1) TCP/IP Fingerprint: The operating system of a host can be identified from a remote system using TCP/IP fingerprinting. All underlying operating system TCP/
IP stacks have subtle differences that can be seen in their responses to specially-crafted TCP packets. According to the results of this "fingerprinting" technique,
the OS version is among those listed below.
Note that if one or more of these subtle differences are modified by a firewall or a packet filtering device between the scanner and the host, the fingerprinting
technique may fail. Consequently, the version of the OS may not be detected correctly. If the host is behind a proxy-type firewall, the version of the operating
system detected may be that of the firewall instead of the host being scanned.
2) NetBIOS: Short for Network Basic Input Output System, an application programming interface (API) that augments the DOS BIOS by adding special functions
for local-area networks (LANs). Almost all LANs for PCs are based on the NetBIOS. Some LAN manufacturers have even extended it, adding additional network
capabilities. NetBIOS relies on a message format called Server Message Block (SMB).
3) PHP Info: PHP is a hypertext pre-processor, an open-source, server-side, HTML-embedded scripting language used to create dynamic Web pages. Under
some configurations it is possible to call PHP functions like phpinfo() and obtain operating system information.
4) SNMP: The Simple Network Monitoring Protocol is used to monitor hosts, routers, and the networks to which they attach. The SNMP service maintains
Management Information Base (MIB), a set of variables (database) that can be fetched by Managers. These include "MIB_II.system.sysDescr" for the operating
system.
Impact
Not applicable.
Solution
Not applicable.
SSL Data
Flags -
Protocol tcp
Virtual Host -
IP 162.241.49.8
Port -
Result EulerOS_/_Ubuntu_/_Fedora_/_Tiny_Core_Linux_/_Linux_3.x_/_IBM TCP/IP_Fingerprint U5933:443

Info List
Info #1
150009 Links Crawled (1)

150009 Links Crawled atitudefoods.attingedigital.com.br/login
Unique # b9b51855-fb8e-45ed-8867-84f5e23f5b35
OWASP -
WASC -
Details
Threat
The list of unique links crawled and HTML forms submitted by the scanner appear in the Results section. This list may contain fewer links than the maximum
threshold defined.
NOTE: This list also includes:

- All the unique links that are reported in QID 150140 (Redundant links/URL paths crawled and not crawled)
- All the forms reported in QID 150152 (Forms Crawled)
- All the forms in QID 150115 (Authentication Form Found)
- Certain requests from QID 150172 (Requests Crawled)
Impact
N/A
Solution
N/A
Results
Duration of crawl phase (seconds): 17341.00

Number of links: 30
(This number excludes form requests, ajax links (included in QID 150148) and links re-requested during authentication.)
https://atitudefoods.attingedigital.com.br/%5Cn
https://atitudefoods.attingedigital.com.br/_ignition/
https://atitudefoods.attingedigital.com.br/_ignition/%5Cn
https://atitudefoods.attingedigital.com.br/_ignition/share-report
https://atitudefoods.attingedigital.com.br/_ignition/span%5B
https://atitudefoods.attingedigital.com.br/api/auth/
https://atitudefoods.attingedigital.com.br/api/auth/%5Cn
https://atitudefoods.attingedigital.com.br/api/auth/login
https://atitudefoods.attingedigital.com.br/api/auth/span%5B
https://atitudefoods.attingedigital.com.br/assets/images/bg.png
https://atitudefoods.attingedigital.com.br/assets/images/icon-target.png
https://atitudefoods.attingedigital.com.br/assets/images/icon-trophy.png
https://atitudefoods.attingedigital.com.br/assets/images/logo-unilever.png
https://atitudefoods.attingedigital.com.br/assets/images/logo.svg
https://atitudefoods.attingedigital.com.br/commit/
https://atitudefoods.attingedigital.com.br/desafio
https://atitudefoods.attingedigital.com.br/login
https://atitudefoods.attingedigital.com.br/mecanica
https://atitudefoods.attingedigital.com.br/public/_ignition
https://atitudefoods.attingedigital.com.br/public/api

https://atitudefoods.attingedigital.com.br/public/api/auth
https://atitudefoods.attingedigital.com.br/public/commit
https://atitudefoods.attingedigital.com.br/public/releases
https://atitudefoods.attingedigital.com.br/public/releases/tag
https://atitudefoods.attingedigital.com.br/regulamento
https://atitudefoods.attingedigital.com.br/releases/tag/
https://atitudefoods.attingedigital.com.br/span%5B
150010 External Links Discovered (1)

150010 External Links Discovered atitudefoods.attingedigital.com.br/login
Unique # 21436134-f0a8-4bf4-8ca3-008d618eb06d
OWASP -
WASC -
Details
Threat
External links discovered during the scan are listed in the Results section. These links were out of scope for the scan and were not crawled.
Impact
N/A
Solution
N/A
Results
Number of links: 1001

https://www.unilever.com.br/politica-de-cookies.html
https://fonts.gstatic.com/
https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs13FvsUZiYySUhiCXAA.woff
https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs169vsUZiYySUhiCXAA.woff
https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiYySUhiCXAA.woff
https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1xZosUZiYySUhiCXAA.woff
https://fonts.googleapis.com/css2?family=Nunito&display=swap
https://fonts.googleapis.com/css2?family=Oswald%3Awght@200%3B300%3B400%3B700&display=swap
https://onetrust.com/poweredbyonetrust
https://cdn.cookielaw.org/consent/faac4b61-d1cf-4c8c-a3be-e281f34f7439/faac4b61-d1cf-4c8c-a3be-e281f34f7439.json
https://cdn.cookielaw.org/logos/6ce3ca18-a8e8-4e52-80bc-d334afc636e7/8e993487-0a24-48a9-9e84-10ea58a7c2bc/unilever-logo.png
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcCenter.json
https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
https://flareapp.io/docs/ignition-for-laravel/security
https://flareapp.io/docs/ignition-for-laravel/sharing-errors
https://flareapp.io/share/17DGxG6P
https://flareapp.io/share/17DGxG6P?error=17DGxG6P&owner_token=DiyEunotCTn6SGdsaJBrz897dD2Ef7PS
https://flareapp.io/share/17DGxKyP
https://flareapp.io/share/17DGxKyP#F27L127
https://flareapp.io/share/17DGxKyP?error=17DGxKyP&owner_token=c9qNa5MCV5vLkuvcFKumz0FtBFYk4P2s
https://flareapp.io/share/17DGxKyP?error=17DGxKyP&owner_token=c9qNa5MCV5vLkuvcFKumz0FtBFYk4P2s#F27L127
https://flareapp.io/share/17DGxO6P
https://flareapp.io/share/17DGxO6P#F27L123
https://flareapp.io/share/17DGxO6P?error=17DGxO6P&owner_token=KtdK8Sbzh1WVKjvrlI0zVSmklrtE9EyH
https://flareapp.io/share/17DGxO6P?error=17DGxO6P&owner_token=KtdK8Sbzh1WVKjvrlI0zVSmklrtE9EyH#F27L123
https://flareapp.io/share/17DGxy6P
https://flareapp.io/share/17DGxy6P#F27L119
https://flareapp.io/share/17DGxy6P?error=17DGxy6P&owner_token=8rxuGSyqpy34qLQzQklK5AtKJyHvjDpk
https://flareapp.io/share/17DGxy6P?error=17DGxy6P&owner_token=8rxuGSyqpy34qLQzQklK5AtKJyHvjDpk#F27L119
https://flareapp.io/share/17Wga687
https://flareapp.io/share/17Wga687#F27L132
https://flareapp.io/share/17Wga687?error=17Wga687&owner_token=PjPZfqd1miO2Cc2H6QtDUVAYvePxJ5GE
https://flareapp.io/share/17Wga687?error=17Wga687&owner_token=PjPZfqd1miO2Cc2H6QtDUVAYvePxJ5GE#F27L132
https://flareapp.io/share/17WgaV87
https://flareapp.io/share/17WgaV87#F27L107

https://flareapp.io/share/17WgaV87?error=17WgaV87&owner_token=r6TDGbmjbbBlJnjyp5AcqgLsReJAKwnN
https://flareapp.io/share/17WgaV87?error=17WgaV87&owner_token=r6TDGbmjbbBlJnjyp5AcqgLsReJAKwnN#F27L107
https://flareapp.io/share/17Wganj7
https://flareapp.io/share/17Wganj7#F27L105
https://flareapp.io/share/17Wganj7?error=17Wganj7&owner_token=Y5L7kgioJ3MZPEmEuNFDswTJYogwzyth
https://flareapp.io/share/17Wganj7?error=17Wganj7&owner_token=Y5L7kgioJ3MZPEmEuNFDswTJYogwzyth#F27L105
https://flareapp.io/share/17xZoWGm
https://flareapp.io/share/17xZoWGm#F27L117
https://flareapp.io/share/17xZoWGm?error=17xZoWGm&owner_token=j6o3ulFMZg1QOJIXLdqwYfYiQbX9Uwdp
https://flareapp.io/share/17xZoWGm?error=17xZoWGm&owner_token=j6o3ulFMZg1QOJIXLdqwYfYiQbX9Uwdp#F27L117
https://flareapp.io/share/17xZoj8m
https://flareapp.io/share/17xZoj8m#F27L110
https://flareapp.io/share/17xZoj8m?error=17xZoj8m&owner_token=13HNgH3mJeJcHXdPOAbPb69nh2jCND0a
https://flareapp.io/share/17xZoj8m?error=17xZoj8m&owner_token=13HNgH3mJeJcHXdPOAbPb69nh2jCND0a#F27L110
https://flareapp.io/share/353aK1JP
https://flareapp.io/share/353aK1JP#F27L119
https://flareapp.io/share/353aK1JP?error=353aK1JP&owner_token=h8pxXRqewf1Vs78453lpUp1LxSZ73mVv
https://flareapp.io/share/353aK1JP?error=353aK1JP&owner_token=h8pxXRqewf1Vs78453lpUp1LxSZ73mVv#F27L119
https://flareapp.io/share/353aKNJP
https://flareapp.io/share/353aKNJP#F27L112
https://flareapp.io/share/353aKNJP?error=353aKNJP&owner_token=J2vqAHea1UxOaShxc37oHBjBBR5bQTkZ
https://flareapp.io/share/353aKNJP?error=353aKNJP&owner_token=J2vqAHea1UxOaShxc37oHBjBBR5bQTkZ#F27L112
https://flareapp.io/share/353aKdAP
https://flareapp.io/share/353aKdAP#F27L111
https://flareapp.io/share/353aKdAP?error=353aKdAP&owner_token=C0zPIRDTubRYisTDq75qJ8EohdMqM5OI
https://flareapp.io/share/353aKdAP?error=353aKdAP&owner_token=C0zPIRDTubRYisTDq75qJ8EohdMqM5OI#F27L111
https://flareapp.io/share/47qg81Am
https://flareapp.io/share/47qg81Am#F27L109
https://flareapp.io/share/47qg81Am?error=47qg81Am&owner_token=aIcmE61tFILy5F2WtkFk9QwdeaZAaCpB
https://flareapp.io/share/47qg81Am?error=47qg81Am&owner_token=aIcmE61tFILy5F2WtkFk9QwdeaZAaCpB#F27L109
https://flareapp.io/share/47qg8Gjm
https://flareapp.io/share/47qg8Gjm#F27L114
https://flareapp.io/share/47qg8Gjm?error=47qg8Gjm&owner_token=zbqxAq2HDp9rlfF370g8iCO8n3lLD4RD
https://flareapp.io/share/47qg8Gjm?error=47qg8Gjm&owner_token=zbqxAq2HDp9rlfF370g8iCO8n3lLD4RD#F27L114
https://flareapp.io/share/47qg8qjm
https://flareapp.io/share/47qg8qjm#F27L110
https://flareapp.io/share/47qg8qjm?error=47qg8qjm&owner_token=If1ICfYOZA9cao7pZVQgkSVoyVtKOaJJ
https://flareapp.io/share/47qg8qjm?error=47qg8qjm&owner_token=If1ICfYOZA9cao7pZVQgkSVoyVtKOaJJ#F27L110
https://flareapp.io/share/4m40ZDBm
https://flareapp.io/share/4m40ZDBm#F27L102
https://flareapp.io/share/4m40ZDBm?error=4m40ZDBm&owner_token=IhAiY1fOT1IWIJLuTRie0cVR8Ok4wz0a
https://flareapp.io/share/4m40ZDBm?error=4m40ZDBm&owner_token=IhAiY1fOT1IWIJLuTRie0cVR8Ok4wz0a#F27L102
https://flareapp.io/share/67O6WAZP
https://flareapp.io/share/67O6WAZP#F27L103
https://flareapp.io/share/67O6WAZP?error=67O6WAZP&owner_token=sh0gDmAsmSUSbA2jMSpvmBiBEKiuVGOR
https://flareapp.io/share/67O6WAZP?error=67O6WAZP&owner_token=sh0gDmAsmSUSbA2jMSpvmBiBEKiuVGOR#F27L103
https://flareapp.io/share/67O6WQAP
https://flareapp.io/share/67O6WQAP#F27L129
https://flareapp.io/share/67O6WQAP?error=67O6WQAP&owner_token=n5aMnOxNsRhpgj8QuSwqevRJ2yK0yYbS
https://flareapp.io/share/67O6WQAP?error=67O6WQAP&owner_token=n5aMnOxNsRhpgj8QuSwqevRJ2yK0yYbS#F27L129
https://flareapp.io/share/87nBdBD7
https://flareapp.io/share/87nBdBD7#F27L103
https://flareapp.io/share/87nBdBD7?error=87nBdBD7&owner_token=5Ikk6s1gLscOEqXMaiXC2pZZrHaxY4Z0
https://flareapp.io/share/87nBdBD7?error=87nBdBD7&owner_token=5Ikk6s1gLscOEqXMaiXC2pZZrHaxY4Z0#F27L103
https://flareapp.io/share/87nBdBG7
https://flareapp.io/share/87nBdBG7?error=87nBdBG7&owner_token=3rszjmyGPWTBg6vn244HVvosVDCEclQp
https://flareapp.io/share/87nBdMo7
https://flareapp.io/share/87nBdMo7#F27L116
https://flareapp.io/share/87nBdMo7?error=87nBdMo7&owner_token=MvYO3tOAYczgYrRNd73EviDwbkHbGy95
https://flareapp.io/share/87nBdMo7?error=87nBdMo7&owner_token=MvYO3tOAYczgYrRNd73EviDwbkHbGy95#F27L116
https://flareapp.io/share/87nBdao7
https://flareapp.io/share/87nBdao7#F27L132
https://flareapp.io/share/87nBdao7?error=87nBdao7&owner_token=drUdinf2yEsllthNfhOHuO297m39JYJk
https://flareapp.io/share/87nBdao7?error=87nBdao7&owner_token=drUdinf2yEsllthNfhOHuO297m39JYJk#F27L132
https://flareapp.io/share/87nBdgD7
https://flareapp.io/share/87nBdgD7#F27L126
https://flareapp.io/share/87nBdgD7?error=87nBdgD7&owner_token=EoAukWHLawURxlV4gWefmn65ODyW6CSe
https://flareapp.io/share/87nBdgD7?error=87nBdgD7&owner_token=EoAukWHLawURxlV4gWefmn65ODyW6CSe#F27L126
https://flareapp.io/share/87nBdzD7
https://flareapp.io/share/87nBdzD7#F27L122
https://flareapp.io/share/87nBdzD7?error=87nBdzD7&owner_token=UadY0O49cCm6CWpYYoJ1wFGJE95uI84i
https://flareapp.io/share/87nBdzD7?error=87nBdzD7&owner_token=UadY0O49cCm6CWpYYoJ1wFGJE95uI84i#F27L122
https://flareapp.io/share/95Jz6KB5
https://flareapp.io/share/95Jz6KB5#F27L107
https://flareapp.io/share/95Jz6KB5?error=95Jz6KB5&owner_token=YmlLLC3JCsEkriU3nAzIQ7WBm5uF4lrl
https://flareapp.io/share/95Jz6KB5?error=95Jz6KB5&owner_token=YmlLLC3JCsEkriU3nAzIQ7WBm5uF4lrl#F27L107
https://flareapp.io/share/95Jz6yB5
https://flareapp.io/share/95Jz6yB5#F27L112
https://flareapp.io/share/95Jz6yB5?error=95Jz6yB5&owner_token=UI0fnZ3AdqEY41wgTEpNi9LmoZ1BQWUs
https://flareapp.io/share/95Jz6yB5?error=95Jz6yB5&owner_token=UI0fnZ3AdqEY41wgTEpNi9LmoZ1BQWUs#F27L112
https://flareapp.io/share/A7EAWGq7
https://flareapp.io/share/A7EAWGq7#F27L125
https://flareapp.io/share/A7EAWGq7?error=A7EAWGq7&owner_token=9F9wK452G4X5jdu6Fkk0pLOM76TdmJ0d
https://flareapp.io/share/A7EAWGq7?error=A7EAWGq7&owner_token=9F9wK452G4X5jdu6Fkk0pLOM76TdmJ0d#F27L125
https://flareapp.io/share/A7EAWpg7
https://flareapp.io/share/A7EAWpg7#F27L115

https://flareapp.io/share/A7EAWpg7?error=A7EAWpg7&owner_token=xQf89znbXTwPxTcjmmXvleYeGOBqka7R
https://flareapp.io/share/A7EAWpg7?error=A7EAWpg7&owner_token=xQf89znbXTwPxTcjmmXvleYeGOBqka7R#F27L115
https://flareapp.io/share/B5ZeaYK7
https://flareapp.io/share/B5ZeaYK7#F27L105
https://flareapp.io/share/B5ZeaYK7?error=B5ZeaYK7&owner_token=zasBK8qbi8aYhwOJBU3aW5bk83dTqLyl
https://flareapp.io/share/B5ZeaYK7?error=B5ZeaYK7&owner_token=zasBK8qbi8aYhwOJBU3aW5bk83dTqLyl#F27L105
https://flareapp.io/share/B5ZeanK7
https://flareapp.io/share/B5ZeanK7#F27L109
https://flareapp.io/share/B5ZeanK7?error=B5ZeanK7&owner_token=R591NhzDpqWTwR2Y5NPqEJr4Zg0eOYVH
https://flareapp.io/share/B5ZeanK7?error=B5ZeanK7&owner_token=R591NhzDpqWTwR2Y5NPqEJr4Zg0eOYVH#F27L109
https://flareapp.io/share/DPyZ41J7
https://flareapp.io/share/DPyZ41J7#F27L105
https://flareapp.io/share/DPyZ41J7?error=DPyZ41J7&owner_token=AlN0BObiou9cJEzDcOLObBPDHNQijL8R
https://flareapp.io/share/DPyZ41J7?error=DPyZ41J7&owner_token=AlN0BObiou9cJEzDcOLObBPDHNQijL8R#F27L105
https://flareapp.io/share/DPyZ4kD7
https://flareapp.io/share/DPyZ4kD7#F27L102
https://flareapp.io/share/DPyZ4kD7?error=DPyZ4kD7&owner_token=aZR8Yy2xHNsUXSeQ4nGrWcLlozLDffOB
https://flareapp.io/share/DPyZ4kD7?error=DPyZ4kD7&owner_token=aZR8Yy2xHNsUXSeQ4nGrWcLlozLDffOB#F27L102
https://flareapp.io/share/J7ojDpZP?error=J7ojDpZP&owner_token=3LY5Bvi25JOI9gLnEofKLq3tVzGPR0uJ
https://flareapp.io/share/KPgnaXem
https://flareapp.io/share/KPgnaXem#F27L106
https://flareapp.io/share/KPgnaXem?error=KPgnaXem&owner_token=LwvFOoh4Dak7c0UJ2CKbO1VfolwAegdU
https://flareapp.io/share/KPgnaXem?error=KPgnaXem&owner_token=LwvFOoh4Dak7c0UJ2CKbO1VfolwAegdU#F27L106
https://flareapp.io/share/KPgnawem
https://flareapp.io/share/KPgnawem#F27L113
https://flareapp.io/share/KPgnawem?error=KPgnawem&owner_token=3Y0nxFtP02XlM69AsLqnUDGYAaS3gOYA
https://flareapp.io/share/KPgnawem?error=KPgnawem&owner_token=3Y0nxFtP02XlM69AsLqnUDGYAaS3gOYA#F27L113
https://flareapp.io/share/LPdBKBQ5
https://flareapp.io/share/LPdBKBQ5?error=LPdBKBQ5&owner_token=i2KKU5PTNLxAJULSuL7Qi0z3UqHZQQCj
https://flareapp.io/share/LPdBKEQ5
https://flareapp.io/share/LPdBKEQ5#F27L117
https://flareapp.io/share/LPdBKEQ5?error=LPdBKEQ5&owner_token=Gkbaxfhw2ejaGQFiZkgmrcIxb1CEd3ez
https://flareapp.io/share/LPdBKEQ5?error=LPdBKEQ5&owner_token=Gkbaxfhw2ejaGQFiZkgmrcIxb1CEd3ez#F27L117
https://flareapp.io/share/LPdBKGX5
https://flareapp.io/share/LPdBKGX5#F27L126
https://flareapp.io/share/LPdBKGX5?error=LPdBKGX5&owner_token=CmMK9BrQ6MR8j14h5FKm7m4ofNENLD57
https://flareapp.io/share/LPdBKGX5?error=LPdBKGX5&owner_token=CmMK9BrQ6MR8j14h5FKm7m4ofNENLD57#F27L126
https://flareapp.io/share/LPdBKoX5
https://flareapp.io/share/LPdBKoX5#F27L113
https://flareapp.io/share/LPdBKoX5?error=LPdBKoX5&owner_token=8Cu7vycE0R7lDZDwUa75qsM9mRR0N8tU
https://flareapp.io/share/LPdBKoX5?error=LPdBKoX5&owner_token=8Cu7vycE0R7lDZDwUa75qsM9mRR0N8tU#F27L113
https://flareapp.io/share/LPlepg27
https://flareapp.io/share/LPlepg27#F27L108
https://flareapp.io/share/LPlepg27?error=LPlepg27&owner_token=bbCuO2VHl9FPQbPxa3fEproInghyxLxd
https://flareapp.io/share/LPlepg27?error=LPlepg27&owner_token=bbCuO2VHl9FPQbPxa3fEproInghyxLxd#F27L108
https://flareapp.io/share/Lm8p1AAm
https://flareapp.io/share/Lm8p1AAm#F27L114
https://flareapp.io/share/Lm8p1AAm?error=Lm8p1AAm&owner_token=c4Ye0pc92zhwYkQBJ3Jd7IeCAQkYZlwL
https://flareapp.io/share/Lm8p1AAm?error=Lm8p1AAm&owner_token=c4Ye0pc92zhwYkQBJ3Jd7IeCAQkYZlwL#F27L114
https://flareapp.io/share/Lm8p1LAm
https://flareapp.io/share/Lm8p1LAm#F27L128
https://flareapp.io/share/Lm8p1LAm?error=Lm8p1LAm&owner_token=bBwmXQbL0ey6U2QAil8yMSrHYMg2ByZU
https://flareapp.io/share/Lm8p1LAm?error=Lm8p1LAm&owner_token=bBwmXQbL0ey6U2QAil8yMSrHYMg2ByZU#F27L128
https://flareapp.io/share/Lm8p1pkm
https://flareapp.io/share/Lm8p1pkm#F27L102
https://flareapp.io/share/Lm8p1pkm?error=Lm8p1pkm&owner_token=j0TNjDZXzx2DeYNGCK8TuXhVosohMLXy
https://flareapp.io/share/Lm8p1pkm?error=Lm8p1pkm&owner_token=j0TNjDZXzx2DeYNGCK8TuXhVosohMLXy#F27L102
https://flareapp.io/share/NPGAZ0L5
https://flareapp.io/share/NPGAZ0L5#F27L104
https://flareapp.io/share/NPGAZ0L5?error=NPGAZ0L5&owner_token=a6iiE1OqGILEftNCdcpPb7dGLtxQYSLo
https://flareapp.io/share/NPGAZ0L5?error=NPGAZ0L5&owner_token=a6iiE1OqGILEftNCdcpPb7dGLtxQYSLo#F27L104
https://flareapp.io/share/NPGAZKv5
https://flareapp.io/share/NPGAZKv5#F27L131
https://flareapp.io/share/NPGAZKv5?error=NPGAZKv5&owner_token=Z20o70bq0RJfL9mRUjoWreHDItn6sa0y
https://flareapp.io/share/NPGAZKv5?error=NPGAZKv5&owner_token=Z20o70bq0RJfL9mRUjoWreHDItn6sa0y#F27L131
https://flareapp.io/share/NPLZW3K5
https://flareapp.io/share/NPLZW3K5#F27L106
https://flareapp.io/share/NPLZW3K5?error=NPLZW3K5&owner_token=GoF4L1qiajWPoi7Yntae5Vx6W9vfj2Ra
https://flareapp.io/share/NPLZW3K5?error=NPLZW3K5&owner_token=GoF4L1qiajWPoi7Yntae5Vx6W9vfj2Ra#F27L106
https://flareapp.io/share/NPLZW9o5
https://flareapp.io/share/NPLZW9o5#F27L104
https://flareapp.io/share/NPLZW9o5?error=NPLZW9o5&owner_token=rtRUV3214QaCoCTsfrqBNv5XrOixBr1M
https://flareapp.io/share/NPLZW9o5?error=NPLZW9o5&owner_token=rtRUV3214QaCoCTsfrqBNv5XrOixBr1M#F27L104
https://flareapp.io/share/OmVyJBp5
https://flareapp.io/share/OmVyJBp5?error=OmVyJBp5&owner_token=6UdRURjVoWxrHHHGEBtg1llyIO5UwkOx
https://flareapp.io/share/OmVyJDp5
https://flareapp.io/share/OmVyJDp5#F27L117
https://flareapp.io/share/OmVyJDp5?error=OmVyJDp5&owner_token=cUFpzepWTSSJfpoPEroHvBswG1548JOh
https://flareapp.io/share/OmVyJDp5?error=OmVyJDp5&owner_token=cUFpzepWTSSJfpoPEroHvBswG1548JOh#F27L117
https://flareapp.io/share/OmVyJX85
https://flareapp.io/share/OmVyJX85#F27L104
https://flareapp.io/share/OmVyJX85?error=OmVyJX85&owner_token=7Ltgkk38Vtemv6zWbrvoC9PCgy8oMIKU
https://flareapp.io/share/OmVyJX85?error=OmVyJX85&owner_token=7Ltgkk38Vtemv6zWbrvoC9PCgy8oMIKU#F27L104
https://flareapp.io/share/RmrGEl0P
https://flareapp.io/share/RmrGEl0P#F27L104
https://flareapp.io/share/RmrGEl0P?error=RmrGEl0P&owner_token=gHlIURGsHnKf1gpzsKzgUjsr0AvxEHmX

https://flareapp.io/share/RmrGEl0P?error=RmrGEl0P&owner_token=gHlIURGsHnKf1gpzsKzgUjsr0AvxEHmX#F27L104
https://flareapp.io/share/RmrGEndP
https://flareapp.io/share/RmrGEndP#F27L106
https://flareapp.io/share/RmrGEndP?error=RmrGEndP&owner_token=YJxPgVIyakIYw6BemLB9hJ4vVMkAZE36
https://flareapp.io/share/RmrGEndP?error=RmrGEndP&owner_token=YJxPgVIyakIYw6BemLB9hJ4vVMkAZE36#F27L106
https://flareapp.io/share/V7jOkNL5
https://flareapp.io/share/V7jOkNL5#F27L130
https://flareapp.io/share/V7jOkNL5?error=V7jOkNL5&owner_token=1vffzxakneEobWmjrIF3MvVjHIPO0s27
https://flareapp.io/share/V7jOkNL5?error=V7jOkNL5&owner_token=1vffzxakneEobWmjrIF3MvVjHIPO0s27#F27L130
https://flareapp.io/share/VP6kZ8e7
https://flareapp.io/share/VP6kZ8e7#F27L108
https://flareapp.io/share/VP6kZ8e7?error=VP6kZ8e7&owner_token=EYfMIRBATx0k5jC1ypeb0COWjWR1ubxM
https://flareapp.io/share/VP6kZ8e7?error=VP6kZ8e7&owner_token=EYfMIRBATx0k5jC1ypeb0COWjWR1ubxM#F27L108
https://flareapp.io/share/Vme61XqP
https://flareapp.io/share/Vme61XqP#F27L120
https://flareapp.io/share/Vme61XqP?error=Vme61XqP&owner_token=NIlqc1MjifuRAKX3X3DnyWC4cb52SexE
https://flareapp.io/share/Vme61XqP?error=Vme61XqP&owner_token=NIlqc1MjifuRAKX3X3DnyWC4cb52SexE#F27L120
https://flareapp.io/share/Vme61Y4P
https://flareapp.io/share/Vme61Y4P#F27L116
https://flareapp.io/share/Vme61Y4P?error=Vme61Y4P&owner_token=wUuaFCuaMWsb6uuFxoD9VLb7hLlqNljM
https://flareapp.io/share/Vme61Y4P?error=Vme61Y4P&owner_token=wUuaFCuaMWsb6uuFxoD9VLb7hLlqNljM#F27L116
https://flareapp.io/share/Vme61r4P
https://flareapp.io/share/Vme61r4P#F27L131
https://flareapp.io/share/Vme61r4P?error=Vme61r4P&owner_token=KDEwZtzIHHgnrxexSi07yBmxmypUfjrM
https://flareapp.io/share/Vme61r4P?error=Vme61r4P&owner_token=KDEwZtzIHHgnrxexSi07yBmxmypUfjrM#F27L131
https://flareapp.io/share/bP9k3NL5
https://flareapp.io/share/bP9k3NL5#F27L109
https://flareapp.io/share/bP9k3NL5?error=bP9k3NL5&owner_token=YxhX8atLSiciePHjGyYTaIx6yFj1eXCk
https://flareapp.io/share/bP9k3NL5?error=bP9k3NL5&owner_token=YxhX8atLSiciePHjGyYTaIx6yFj1eXCk#F27L109
https://flareapp.io/share/dPbBa2JP
https://flareapp.io/share/dPbBa2JP#F27L124
https://flareapp.io/share/dPbBa2JP?error=dPbBa2JP&owner_token=jLyw9ZM0Jjm9Byh3y6R2NXoeB85yx8ib
https://flareapp.io/share/dPbBa2JP?error=dPbBa2JP&owner_token=jLyw9ZM0Jjm9Byh3y6R2NXoeB85yx8ib#F27L124
https://flareapp.io/share/dPbBaKoP
https://flareapp.io/share/dPbBaKoP#F27L114
https://flareapp.io/share/dPbBaKoP?error=dPbBaKoP&owner_token=LvTMMxbXTvVYyWu8LRCgsEcEBSeHumw9
https://flareapp.io/share/dPbBaKoP?error=dPbBaKoP&owner_token=LvTMMxbXTvVYyWu8LRCgsEcEBSeHumw9#F27L114
https://flareapp.io/share/dPbBaooP
https://flareapp.io/share/dPbBaooP#F27L129
https://flareapp.io/share/dPbBaooP?error=dPbBaooP&owner_token=VP074Q1fLBfWWxxuznyrBtDUf3S8C8gT
https://flareapp.io/share/dPbBaooP?error=dPbBaooP&owner_token=VP074Q1fLBfWWxxuznyrBtDUf3S8C8gT#F27L129
https://flareapp.io/share/dmknMvl5
https://flareapp.io/share/dmknMvl5#F27L121
https://flareapp.io/share/dmknMvl5?error=dmknMvl5&owner_token=c565qAOlh99P3bIUjfEk9kN3JK2ZY78n
https://flareapp.io/share/dmknMvl5?error=dmknMvl5&owner_token=c565qAOlh99P3bIUjfEk9kN3JK2ZY78n#F27L121
https://flareapp.io/share/dmknMxl5
https://flareapp.io/share/dmknMxl5#F27L111
https://flareapp.io/share/dmknMxl5?error=dmknMxl5&owner_token=Ys1TGTslhXN85VVo0IFjAfvbxFBPR3KB
https://flareapp.io/share/dmknMxl5?error=dmknMxl5&owner_token=Ys1TGTslhXN85VVo0IFjAfvbxFBPR3KB#F27L111
https://flareapp.io/share/dmknMyA5
https://flareapp.io/share/dmknMyA5#F27L120
https://flareapp.io/share/dmknMyA5?error=dmknMyA5&owner_token=iDEbbuSosaA6Ma1MnFTqWAHnnUpnqaT7
https://flareapp.io/share/dmknMyA5?error=dmknMyA5&owner_token=iDEbbuSosaA6Ma1MnFTqWAHnnUpnqaT7#F27L120
https://flareapp.io/share/lm2NvGnm
https://flareapp.io/share/lm2NvGnm#F27L110
https://flareapp.io/share/lm2NvGnm?error=lm2NvGnm&owner_token=wnFXy0Qb1WSaAzG1xhRpO0aE0l7g8czU
https://flareapp.io/share/lm2NvGnm?error=lm2NvGnm&owner_token=wnFXy0Qb1WSaAzG1xhRpO0aE0l7g8czU#F27L110
https://flareapp.io/share/lm2NvQYm
https://flareapp.io/share/lm2NvQYm#F27L107
https://flareapp.io/share/lm2NvQYm?error=lm2NvQYm&owner_token=bWc3A6DmGiicbCrJRt8Xw23SfoZ8tebh
https://flareapp.io/share/lm2NvQYm?error=lm2NvQYm&owner_token=bWc3A6DmGiicbCrJRt8Xw23SfoZ8tebh#F27L107
https://flareapp.io/share/o7AgZKBm
https://flareapp.io/share/o7AgZKBm#F27L102
https://flareapp.io/share/o7AgZKBm?error=o7AgZKBm&owner_token=zO3cyjM5lZHtD9ccR63CP645rWYMlkZ0
https://flareapp.io/share/o7AgZKBm?error=o7AgZKBm&owner_token=zO3cyjM5lZHtD9ccR63CP645rWYMlkZ0#F27L102
https://flareapp.io/share/o7AgZnEm
https://flareapp.io/share/o7AgZnEm#F27L127
https://flareapp.io/share/o7AgZnEm?error=o7AgZnEm&owner_token=SKdPnaePdzaBMmoudOecqywMDRfAVvwF
https://flareapp.io/share/o7AgZnEm?error=o7AgZnEm&owner_token=SKdPnaePdzaBMmoudOecqywMDRfAVvwF#F27L127
https://flareapp.io/share/oPRbr4zP
https://flareapp.io/share/oPRbr4zP#F27L103
https://flareapp.io/share/oPRbr4zP?error=oPRbr4zP&owner_token=bdAINcvmgy0nCiutzujjTPg7AkKYdZHE
https://flareapp.io/share/oPRbr4zP?error=oPRbr4zP&owner_token=bdAINcvmgy0nCiutzujjTPg7AkKYdZHE#F27L103
https://flareapp.io/share/oPRbrKJP
https://flareapp.io/share/oPRbrKJP#F27L106
https://flareapp.io/share/oPRbrKJP?error=oPRbrKJP&owner_token=NeWI5zUMduzIFgcwwYQRSKnRDKVpzKBD
https://flareapp.io/share/oPRbrKJP?error=oPRbrKJP&owner_token=NeWI5zUMduzIFgcwwYQRSKnRDKVpzKBD#F27L106
https://flareapp.io/share/omwAV2o7
https://flareapp.io/share/omwAV2o7#F27L113
https://flareapp.io/share/omwAV2o7?error=omwAV2o7&owner_token=5TEUUiKrmG26Y1utuBeeq0JWkfdoqw9n
https://flareapp.io/share/omwAV2o7?error=omwAV2o7&owner_token=5TEUUiKrmG26Y1utuBeeq0JWkfdoqw9n#F27L113
https://flareapp.io/share/pPvLBY65
https://flareapp.io/share/pPvLBY65#F27L107
https://flareapp.io/share/pPvLBY65?error=pPvLBY65&owner_token=zEOikOxyjTAu7G9PL8Aou36p7JtUwd2W
https://flareapp.io/share/pPvLBY65?error=pPvLBY65&owner_token=zEOikOxyjTAu7G9PL8Aou36p7JtUwd2W#F27L107
https://flareapp.io/share/pPvLBgw5

https://flareapp.io/share/pPvLBgw5#F27L111
https://flareapp.io/share/pPvLBgw5?error=pPvLBgw5&owner_token=9sCV65TxDgRZRAzdYEJOALRkwjr5fJfu
https://flareapp.io/share/pPvLBgw5?error=pPvLBgw5&owner_token=9sCV65TxDgRZRAzdYEJOALRkwjr5fJfu#F27L111
https://flareapp.io/share/q5Y9a1Q5
https://flareapp.io/share/q5Y9a1Q5#F27L130
https://flareapp.io/share/q5Y9a1Q5?error=q5Y9a1Q5&owner_token=MUSv4qAa4v2vVnNO2DXGYzBjyBtJ1cP7
https://flareapp.io/share/q5Y9a1Q5?error=q5Y9a1Q5&owner_token=MUSv4qAa4v2vVnNO2DXGYzBjyBtJ1cP7#F27L130
https://flareapp.io/share/q5Y9a9j5
https://flareapp.io/share/q5Y9a9j5?error=q5Y9a9j5&owner_token=w0UfMm0tfp1NyTdTkeAPAEMO8JBxy81f
https://flareapp.io/share/q5Y9aEQ5
https://flareapp.io/share/q5Y9aEQ5#F27L115
https://flareapp.io/share/q5Y9aEQ5?error=q5Y9aEQ5&owner_token=peXtJZkoXOqDAuYFIWmqqpjeXOg0bZU4
https://flareapp.io/share/q5Y9aEQ5?error=q5Y9aEQ5&owner_token=peXtJZkoXOqDAuYFIWmqqpjeXOg0bZU4#F27L115
https://flareapp.io/share/q5Y9aeX5
https://flareapp.io/share/q5Y9aeX5#F27L118
https://flareapp.io/share/q5Y9aeX5?error=q5Y9aeX5&owner_token=XbbAF75bpY38MUXNE1i8qRrSfSUhsGV6
https://flareapp.io/share/q5Y9aeX5?error=q5Y9aeX5&owner_token=XbbAF75bpY38MUXNE1i8qRrSfSUhsGV6#F27L118
https://flareapp.io/share/qm1VZLwP
https://flareapp.io/share/qm1VZLwP#F27L111
https://flareapp.io/share/qm1VZLwP?error=qm1VZLwP&owner_token=EMiC4h61N6UiVRYaJXL7obcCAEVHW8zt
https://flareapp.io/share/qm1VZLwP?error=qm1VZLwP&owner_token=EMiC4h61N6UiVRYaJXL7obcCAEVHW8zt#F27L111
https://flareapp.io/share/qm1VZnwP
https://flareapp.io/share/qm1VZnwP#F27L116
https://flareapp.io/share/qm1VZnwP?error=qm1VZnwP&owner_token=zoQnVyTuAMB3ozHYr3xqxIIPK1q1nZVW
https://flareapp.io/share/qm1VZnwP?error=qm1VZnwP&owner_token=zoQnVyTuAMB3ozHYr3xqxIIPK1q1nZVW#F27L116
https://flareapp.io/share/v5pzb3kP
https://flareapp.io/share/v5pzb3kP#F27L121
https://flareapp.io/share/v5pzb3kP?error=v5pzb3kP&owner_token=9BIitBYMN2gFNbvl5Cgx6Wiycz5UrsX7
https://flareapp.io/share/v5pzb3kP?error=v5pzb3kP&owner_token=9BIitBYMN2gFNbvl5Cgx6Wiycz5UrsX7#F27L121
https://flareapp.io/share/v5pzbQAP
https://flareapp.io/share/v5pzbQAP#F27L112
https://flareapp.io/share/v5pzbQAP?error=v5pzbQAP&owner_token=QKs9CS3MRix02otgqTXOixbHtlONd5Di
https://flareapp.io/share/v5pzbQAP?error=v5pzbQAP&owner_token=QKs9CS3MRix02otgqTXOixbHtlONd5Di#F27L112
https://flareapp.io/share/v5pzblAP
https://flareapp.io/share/v5pzblAP#F27L124
https://flareapp.io/share/v5pzblAP?error=v5pzblAP&owner_token=VRqYE6SFiZCiBtCRvqR4c9nY1fv5YV8m
https://flareapp.io/share/v5pzblAP?error=v5pzblAP&owner_token=VRqYE6SFiZCiBtCRvqR4c9nY1fv5YV8m#F27L124
https://flareapp.io/share/v5pzbqkP
https://flareapp.io/share/v5pzbqkP?error=v5pzbqkP&owner_token=YatYapZIzsiYr5ZsxszUzKCF3Oqhm7Hw
https://flareapp.io/share/v5pzbzkP
https://flareapp.io/share/v5pzbzkP?error=v5pzbzkP&owner_token=XCqi3OFy5yeFOYeyuPqkU0w0HwYtegYl
https://flareapp.io/share/w5BGZKvm
https://flareapp.io/share/w5BGZKvm?error=w5BGZKvm&owner_token=elERgB5hrO8txKh7K6nSypCmdxzDDcjP
https://flareapp.io/share/x5MKW0eP
https://flareapp.io/share/x5MKW0eP#F27L123
https://flareapp.io/share/x5MKW0eP?error=x5MKW0eP&owner_token=yuVl9akgvTfRkALzpqPyv2b9tLjdxtJe
https://flareapp.io/share/x5MKW0eP?error=x5MKW0eP&owner_token=yuVl9akgvTfRkALzpqPyv2b9tLjdxtJe#F27L123
https://flareapp.io/share/x5MKWKpP
https://flareapp.io/share/x5MKWKpP?error=x5MKWKpP&owner_token=33y8Zv5rIynLIr0P2J0lP143QdcZvr9z
https://flareapp.io/share/x5MKWMpP
https://flareapp.io/share/x5MKWMpP#F27L114
https://flareapp.io/share/x5MKWMpP?error=x5MKWMpP&owner_token=MWs3JRvHqJbGchWo3pPJ2AvxrrtEM8iN
https://flareapp.io/share/x5MKWMpP?error=x5MKWMpP&owner_token=MWs3JRvHqJbGchWo3pPJ2AvxrrtEM8iN#F27L114
https://flareapp.io/share/x5MKWQeP
https://flareapp.io/share/x5MKWQeP#F27L112
https://flareapp.io/share/x5MKWQeP?error=x5MKWQeP&owner_token=hQbeWGgybDzCPaJMBt53eCcQ22kq9Evs
https://flareapp.io/share/x5MKWQeP?error=x5MKWQeP&owner_token=hQbeWGgybDzCPaJMBt53eCcQ22kq9Evs#F27L112
https://flareapp.io/share/x7KqWEam
https://flareapp.io/share/x7KqWEam#F27L118
https://flareapp.io/share/x7KqWEam?error=x7KqWEam&owner_token=CmIA55YeYLkqtbCWGTQJt2d7HQ2G9QCe
https://flareapp.io/share/x7KqWEam?error=x7KqWEam&owner_token=CmIA55YeYLkqtbCWGTQJt2d7HQ2G9QCe#F27L118
https://flareapp.io/share/x7KqWLem
https://flareapp.io/share/x7KqWLem#F27L110
https://flareapp.io/share/x7KqWLem?error=x7KqWLem&owner_token=UbOgLAavdFLTU0zeq0m0dDbeBgydzYXV
https://flareapp.io/share/x7KqWLem?error=x7KqWLem&owner_token=UbOgLAavdFLTU0zeq0m0dDbeBgydzYXV#F27L110
https://flareapp.io/share/x7XBa8Ym
https://flareapp.io/share/x7XBa8Ym#F27L105
https://flareapp.io/share/x7XBa8Ym?error=x7XBa8Ym&owner_token=54SVNlp0JfG0pwMpwbfp8u36zt7IgD4L
https://flareapp.io/share/x7XBa8Ym?error=x7XBa8Ym&owner_token=54SVNlp0JfG0pwMpwbfp8u36zt7IgD4L#F27L105
https://flareapp.io/share/x7XBaYYm
https://flareapp.io/share/x7XBaYYm#F27L128
https://flareapp.io/share/x7XBaYYm?error=x7XBaYYm&owner_token=2pg16FHAAdsSpxmCvHlH5vS5qHuNHF2c
https://flareapp.io/share/x7XBaYYm?error=x7XBaYYm&owner_token=2pg16FHAAdsSpxmCvHlH5vS5qHuNHF2c#F27L128
https://flareapp.io/share/x7XBaowm
https://flareapp.io/share/x7XBaowm#F27L103
https://flareapp.io/share/x7XBaowm?error=x7XBaowm&owner_token=U5I07cmnDUrHGRbewO1EvGGpScedE4yx
https://flareapp.io/share/x7XBaowm?error=x7XBaowm&owner_token=U5I07cmnDUrHGRbewO1EvGGpScedE4yx#F27L103
https://flareapp.io/share/xPQDR0Dm
https://flareapp.io/share/xPQDR0Dm#F27L125
https://flareapp.io/share/xPQDR0Dm?error=xPQDR0Dm&owner_token=pkLEGPOhw7NpPKASzrJBC0hNDtQ7tfWj
https://flareapp.io/share/xPQDR0Dm?error=xPQDR0Dm&owner_token=pkLEGPOhw7NpPKASzrJBC0hNDtQ7tfWj#F27L125
https://flareapp.io/share/xPQDR82m
https://flareapp.io/share/xPQDR82m#F27L115
https://flareapp.io/share/xPQDR82m?error=xPQDR82m&owner_token=0MSyzfmPcXxN11ZeeUohy8k43YLS2gvb
https://flareapp.io/share/xPQDR82m?error=xPQDR82m&owner_token=0MSyzfmPcXxN11ZeeUohy8k43YLS2gvb#F27L115
https://flareapp.io/share/xPQDRD2m

https://flareapp.io/share/xPQDRD2m?error=xPQDRD2m&owner_token=mxeB4Ajs07gzNiBQky1vampGvH3dF2Zj
https://flareapp.io/share/xPQDRkDm
https://flareapp.io/share/xPQDRkDm#F27L113
https://flareapp.io/share/xPQDRkDm?error=xPQDRkDm&owner_token=7lRTYOZCMjmLDGlcvm2a9QcpQ1AH4ev6
https://flareapp.io/share/xPQDRkDm?error=xPQDRkDm&owner_token=7lRTYOZCMjmLDGlcvm2a9QcpQ1AH4ev6#F27L113
https://flareapp.io/share/xPQDRz2m
https://flareapp.io/share/xPQDRz2m#F27L122
https://flareapp.io/share/xPQDRz2m?error=xPQDRz2m&owner_token=MtEvptFLHtFRWDEge27lDHSrWyNz3lN4
https://flareapp.io/share/xPQDRz2m?error=xPQDRz2m&owner_token=MtEvptFLHtFRWDEge27lDHSrWyNz3lN4#F27L122
https://flareapp.io/share/xmN6908m
https://flareapp.io/share/xmN6908m#F27L109
https://flareapp.io/share/xmN6908m?error=xmN6908m&owner_token=9X6qci4SNfzinIeQahsW7sDqw1JyEeyS
https://flareapp.io/share/xmN6908m?error=xmN6908m&owner_token=9X6qci4SNfzinIeQahsW7sDqw1JyEeyS#F27L109
https://flareapp.io/share/xmN69qOm
https://flareapp.io/share/xmN69qOm#F27L115
https://flareapp.io/share/xmN69qOm?error=xmN69qOm&owner_token=a9X0eFPeMesD5rABUfXsuEvtxMLlEvXh
https://flareapp.io/share/xmN69qOm?error=xmN69qOm&owner_token=a9X0eFPeMesD5rABUfXsuEvtxMLlEvXh#F27L115
https://flareapp.io/share/yPaGaZe5
https://flareapp.io/share/yPaGaZe5#F27L108
https://flareapp.io/share/yPaGaZe5?error=yPaGaZe5&owner_token=tx2kV7eHFOYNlVKiw6y6sHaiNeLDEr2B
https://flareapp.io/share/yPaGaZe5?error=yPaGaZe5&owner_token=tx2kV7eHFOYNlVKiw6y6sHaiNeLDEr2B#F27L108
https://flareapp.io/share/yPaGay15
https://flareapp.io/share/yPaGay15#F27L108
https://flareapp.io/share/yPaGay15?error=yPaGay15&owner_token=vY0Jpqdms5MJFp0MoURgk7WKZgmwHNmz
https://flareapp.io/share/yPaGay15?error=yPaGay15&owner_token=vY0Jpqdms5MJFp0MoURgk7WKZgmwHNmz#F27L108
https://cookiepedia.co.uk/giving-consent-to-cookies
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
http://www.w3.org/2000/svg
http://flareapp.io/docs/ignition-for-laravel/introduction
phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fpublic%2Findex.php&line=26
phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fvendor%2Ffideloper%2Fproxy%2Fsrc%2FTrustProxies.php&line=42

phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fvendor%2Ffruitcake%2Flaravel-cors%2Fsrc%2FHandleCors.php&line=22
phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fvendor%2Flaravel%2Fframework%2Fsrc%2FIlluminate%2FFoundation%2FHttp%2FKernel.php&line=100

phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fvendor%2Flaravel%2Fframework%2Fsrc%2FIlluminate%2FFoundation%2FHttp%2FMiddleware
%2FConvertEmptyStringsToNull.php&line=16

%2FPreventRequestsDuringMaintenance.php&line=100

%2FTransformsRequest.php&line=10
%2FTrimStrings.php&line=25

%2FValidatePostSize.php&line=12

phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fvendor%2Flaravel%2Fframework%2Fsrc%2FIlluminate%2FPipeline%2FPipeline.php&line=100

phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fvendor%2Flaravel%2Fframework%2Fsrc%2FIlluminate%2FRouting%2FAbstractRouteCollection.php&line=100

phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fvendor%2Flaravel%2Fframework%2Fsrc%2FIlluminate%2FRouting%2FRouteCollection.php&line=147
phpstorm://open?file=%2Fhome%2Fatitudefoodsatti%2Fpublic_html%2Fvendor%2Flaravel%2Fframework%2Fsrc%2FIlluminate%2FRouting%2FRouter.php&line=610

150020 Links Rejected By Crawl Scope or Exclusion List (1)

150020 Links Rejected By Crawl Scope or atitudefoods.attingedigital.com.br/login
Exclusion List
Unique # 927a4879-1a1b-4cd4-b19c-225dedf415bf
OWASP -
WASC -
Details
Threat
One or more links were not crawled because of an explicit rule to exclude them. This also occurs if a link is malformed.
Exclude list and Include list entries can cause links to be rejected. If a scan is limited to a specific starting directory, then links outside that directory will neither be
crawled or tested.
Links that contain a host name or IP address different from the target application are considered external links and not crawled by default; those types of links are
not listed here. This often happens when the scope of a scan is limited to the directory of the starting URL. The scope can be changed in the Web Application
Record.
During the test phase, some path-based tests may be rejected if the scan is limited to the directory of the starting URL and the test would fall outside that
directory. In these cases, the number of rejected links may be too high to list in the Results section.
Impact
Links listed here were neither crawled or tested by the Web application scanning engine.
Solution
A link might have been intentionally matched by a exclude or include list entry. Verify that no links in this list were unintentionally rejected.e
Results
https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiYySUhiCXAA.woff
https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1xZosUZiYySUhiCXAA.woff
https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs13FvsUZiYySUhiCXAA.woff
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcCenter.json
https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs169vsUZiYySUhiCXAA.woff
https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otFlat.json
https://cdn.cookielaw.org/logos/6ce3ca18-a8e8-4e52-80bc-d334afc636e7/8e993487-0a24-48a9-9e84-10ea58a7c2bc/unilever-logo.png
150021 Scan Diagnostics (1)

150021 Scan Diagnostics atitudefoods.attingedigital.com.br/login
Unique # 00beda15-1b20-44c2-ac1a-1e19cb59b489
OWASP -
WASC -

Details
Threat
This check provides various details of the scan's performance and behavior. In some cases, this check can be used to identify problems that the scanner
encountered when crawling the target Web application.
Impact
The scan diagnostics data provides technical details about the crawler's performance and behavior. This information does not necessarily imply problems with the
Web application.
Solution
No action is required.
Results
Loaded 0 exclude list entries.

Loaded 0 allow list entries.
HTML form authentication unavailable, no WEBAPP entry found
Target web application page https://atitudefoods.attingedigital.com.br/login fetched. Status code:302, Content-Type:text/html, load time:1 milliseconds.
Batch #0 VirtualHostDiscovery: estimated time < 10 minutes (70 tests, 0 inputs)
VirtualHostDiscovery: 70 vulnsigs tests, completed 70 requests, 11 seconds. Completed 70 requests of 70 estimated requests (100%). All tests completed.
Batch #0 CMSDetection: estimated time < 10 minutes (1 tests, 1 inputs)
[CMSDetection phase] : No potential CMS found. Aborting the CMS Detection phaseCMSDetection: 1 vulnsigs tests, completed 48 requests, 8 seconds. Completed 48 requests of 48 estimated requests
(100%). All tests completed.
Maximum request count reached: 8000
Collected 8309 links overall in 4 hours 49 minutes duration.
Path manipulation: Estimated requests (payloads x links): files with extension:(0 x 5) + files:(0 x 25) + directories:(9 x 12) + paths:(0 x 37) = total (108)
Batch #0 WS Directory Path manipulation: estimated time < 1 minute (9 tests, 37 inputs)
WS Directory Path manipulation: 9 vulnsigs tests, completed 108 requests, 3 seconds. Completed 108 requests of 108 estimated requests (100%). All tests completed.
Batch #0 WS enumeration: estimated time < 10 minutes (11 tests, 37 inputs)
WS enumeration: 11 vulnsigs tests, completed 155 requests, 8 seconds. Completed 155 requests of 407 estimated requests (38.0835%). All tests completed.
Batch #4 WebCgiOob: estimated time < 30 minutes (6 tests, 1 inputs)
Batch #4 WebCgiOob: 6 vulnsigs tests, completed 38 requests, 7 seconds. Completed 38 requests of 333 estimated requests (11.4114%). All tests completed.
No XML requests found. Skipping XXE tests.
Batch #4 DOM XSS exploitation: estimated time < 1 minute (4 tests, 98 inputs)
Batch #4 DOM XSS exploitation: 4 vulnsigs tests, completed 784 requests, 1774 seconds. No tests to execute.
Batch #4 HTTP call manipulation: estimated time < 1 minute (38 tests, 0 inputs)
Batch #4 HTTP call manipulation: 38 vulnsigs tests, completed 0 requests, 0 seconds. No tests to execute.
Batch #4 Open Redirect analysis: estimated time < 1 minute (2 tests, 5 inputs)
Batch #4 Open Redirect analysis: 2 vulnsigs tests, completed 10 requests, 4 seconds. Completed 10 requests of 10 estimated requests (100%). All tests completed.
Batch #4 CSRF: estimated time < 1 minute (2 tests, 1 inputs)
Log for Selenium script (phase: ePhaseCsrfTests): atitudefoods
Executing: |open | https://atitudefoods.attingedigital.com.br/login | |
Executing: |click | css=input.form-control | |
currentTest.recordFailure: Element css=input.form-control not found
Batch #4 CSRF: 2 vulnsigs tests, completed 0 requests, 554 seconds. Completed 0 requests of 9 estimated requests (0%). All tests completed.
Batch #4 File Inclusion analysis: estimated time < 10 minutes (1 tests, 38 inputs)
Batch #4 File Inclusion analysis: 1 vulnsigs tests, completed 0 requests, 0 seconds. Completed 0 requests of 38 estimated requests (0%). All tests completed.
Batch #4 Cookie manipulation: estimated time < 1 minute (46 tests, 4 inputs)
Batch #4 Cookie manipulation: 46 vulnsigs tests, completed 0 requests, 0 seconds. No tests to execute.
Batch #4 Header manipulation: estimated time < 30 minutes (46 tests, 25 inputs)
Batch #4 Header manipulation: 46 vulnsigs tests, completed 2004 requests, 101 seconds. Completed 2004 requests of 3150 estimated requests (63.619%). XSS optimization removed 725 links. All tests
completed.
Batch #4 shell shock detector: estimated time < 1 minute (1 tests, 25 inputs)
Batch #4 shell shock detector: 1 vulnsigs tests, completed 34 requests, 2 seconds. Completed 34 requests of 25 estimated requests (136%). All tests completed.
Batch #4 shell shock detector(form): estimated time < 1 minute (1 tests, 0 inputs)
Batch #4 shell shock detector(form): 1 vulnsigs tests, completed 0 requests, 0 seconds. No tests to execute.
Batch #4 httpoxy detector: estimated time < 1 minute (1 tests, 25 inputs)
Batch #4 httpoxy detector: 1 vulnsigs tests, completed 25 requests, 2 seconds. Completed 25 requests of 25 estimated requests (100%). All tests completed.
Batch #4 httpoxy detector(form): estimated time < 1 minute (1 tests, 0 inputs)
Batch #4 httpoxy detector(form): 1 vulnsigs tests, completed 0 requests, 0 seconds. No tests to execute.
Batch #4 Struts timebased detector: estimated time < 1 minute (1 tests, 25 inputs)
Batch #4 Struts timebased detector: 1 vulnsigs tests, completed 25 requests, 2 seconds. Completed 25 requests of 25 estimated requests (100%). All tests completed.
Login Brute Force no tests enabled.
Login Brute Force manipulation estimated time: no tests enabled
Batch #5 HTTP Time Bandit: estimated time < 1 minute (1 tests, 10 inputs)
Batch #5 HTTP Time Bandit: 1 vulnsigs tests, completed 200 requests, 35 seconds. No tests to execute.
Batch #5 Path XSS manipulation: estimated time < 10 minutes (15 tests, 37 inputs)
Batch #5 Path XSS manipulation: 15 vulnsigs tests, completed 432 requests, 18 seconds. Completed 432 requests of 455 estimated requests (94.9451%). All tests completed.
Batch #5 Tomcat Vuln manipulation: estimated time < 1 minute (1 tests, 37 inputs)
Batch #5 Tomcat Vuln manipulation: 1 vulnsigs tests, completed 9 requests, 0 seconds. Completed 9 requests of 12 estimated requests (75%). All tests completed.

Batch #5 Time based path manipulation: estimated time < 1 minute (16 tests, 39 inputs)
Batch #5 Time based path manipulation: 16 vulnsigs tests, completed 64 requests, 101 seconds. Completed 64 requests of 192 estimated requests (33.3333%). All tests completed.
Batch #5 Path manipulation: estimated time < 10 minutes (165 tests, 37 inputs)
Batch #5 Path manipulation: 165 vulnsigs tests, completed 1960 requests, 132 seconds. Completed 1960 requests of 2636 estimated requests (74.3551%). All tests completed.
WebCgiHrsTests: no test enabled
Batch #5 WebCgiGeneric: estimated time < 1 hours (65 tests, 1 inputs)
Batch #5 WebCgiGeneric: 65 vulnsigs tests, completed 158 requests, 32 seconds. Completed 158 requests of 3774 estimated requests (4.18654%). All tests completed.
Total requests made: 14447
Average server response time: 1.22 seconds
150026 Maximum Number of Links Reached During Crawl (1)

150026 Maximum Number of Links Reached atitudefoods.attingedigital.com.br/login
During Crawl
Unique # 30690c1b-c2e4-4ed2-b70a-2bfaafa5aaf1
OWASP -
WASC -
Details
Threat
The maximum number of links specified for this scan has been reached. The links crawled to reach this threshold can include requests made via HTML form
submissions and links requested in anonymous and authenticated states. Consequently, the list of links crawled (QID 150009) may reflect a lower number than
the combination of links and forms requested during the crawl.
Impact
Some links that lead to different areas of the site's functionality may have been missed.
Solution
Increase the maximum number of links in order to ensure broader coverage of the Web application. It is important to note that increasing the number of links
crawled can dramatically increase the time required to test the Web application.
Results
Maximum request count reached: 8000
150028 Cookies Collected (1)

150028 Cookies Collected atitudefoods.attingedigital.com.br/login
Unique # 497c5590-a0cb-413b-ba95-11fbee0fffe4
OWASP -
WASC -
Details
Threat
The cookies listed in the Results section were set by the web application during the crawl phase.

Impact
Cookies may potentially contain sensitive information about the user.
Note: Long scan duration can occur if a web application sets a large number of cookies (e.g., 25 cookies or more) and QIDs 150002, 150046, 150047, and
150048 are enabled.
Solution
Review cookie values to ensure they do not include sensitive information. If scan duration is excessive due to a large number of cookies, consider excluding QIDs
150002, 150046, 150047, and 150048.
Results
Total cookies: 4
XSRF-
TOKEN=eyJpdiI6IlViVEVFcm14a09sSmkzSGVLWXNOS2c9PSIsInZhbHVlIjoiRVpzV3Z4R0xUL20vUkNjN1RXdDI2czNuQUZ3REp4ZTdyeDAvMVA0K1paL0tCL0Frb04ydnBoYzdVNlVMTW5zazBt
expires=Fri, 30-Apr-2021 19:10:07 GMT; SameSite=lax; path=/ First set at URL: https://atitudefoods.attingedigital.com.br/login
HttpOnly; expires=Fri, 30-Apr-2021 19:10:07 GMT; SameSite=lax; path=/ First set at URL: https://atitudefoods.attingedigital.com.br/login
__cfduid=d074d500d9261c620bd19c7345383b6ac1619802607; secure; HttpOnly; expires=Sun, 30-May-2021 17:10:07 GMT; domain=.cookielaw.org; SameSite=Lax; path=/ First set at URL: https://
cdn.cookielaw.org/scripttemplates/otSDKStub.js
__cfduid=d4084198286413f24aa2b8912d806f7c11619802608; secure; HttpOnly; expires=Sun, 30-May-2021 17:10:08 GMT; domain=.onetrust.com; SameSite=Lax; path=/ First set at URL: https://
geolocation.onetrust.com/cookieconsentpub/v1/geo/location
150029 Session Cookies (1)

150029 Session Cookies atitudefoods.attingedigital.com.br/login
Unique # 0c3e2763-182a-428a-bb22-d3c7ab54f90e
OWASP -
WASC -
Details
Threat
The cookies listed in the Results section were identified as affecting the user's authenticated session to the Web application.
Impact
Session cookies are used to uniquely identify a user to a Web application. A compromised session cookie can lead to user impersonation.
Solution
Review the session cookies and verify that they do not contain sensitive values. Randomly generated session cookies should not exhibit a predictable pattern.
Results
Total cookies: 4
XSRF-
TOKEN=eyJpdiI6IlViVEVFcm14a09sSmkzSGVLWXNOS2c9PSIsInZhbHVlIjoiRVpzV3Z4R0xUL20vUkNjN1RXdDI2czNuQUZ3REp4ZTdyeDAvMVA0K1paL0tCL0Frb04ydnBoYzdVNlVMTW5zazBt
expires=Fri, 30-Apr-2021 19:10:07 GMT; SameSite=lax; path=/ First set at URL: https://atitudefoods.attingedigital.com.br/login
HttpOnly; expires=Fri, 30-Apr-2021 19:10:07 GMT; SameSite=lax; path=/ First set at URL: https://atitudefoods.attingedigital.com.br/login

150094 Selenium Web Application Authentication Was Successful (1)

150094 Selenium Web Application Authentication atitudefoods.attingedigital.com.br/login
Was Successful
Unique # b9f2bb29-ae24-4a69-ae0d-58f539c7ade6
OWASP -
WASC -
Details
Threat
Web application authentication using a Selenium script was successfully performed for the scan.
Impact
N/A
Solution
N/A
Results
Selenium authentication was successful for the script: atitudefoods
150100 Selenium Diagnostics (1)

150100 Selenium Diagnostics atitudefoods.attingedigital.com.br/login
Unique # 0c40762a-0209-467f-bc43-19265fa5dcd3
OWASP -
WASC -
Details
Threat
Messages from Selenium log are provided
Impact
This information does not necessarily imply problems with the Web application.
Solution
This information may useful in changing/tuning the Selenium script.
Results
Log for Selenium script: atitudefoods

Executing: |open | https://atitudefoods.attingedigital.com.br/login | |
Executing: |sendKeys | css=input.form-control
Executing: |fireEvent | css=input.form-control | change |

Executing: |click | css=button.btn | |

Executing: |sendKeys | css=input.form-control
Executing: |fireEvent | css=input.form-control | change |
Executing: |click | css=button.btn | |
150104 Form Contains Email Address Field (1)

150104 Form Contains Email Address Field atitudefoods.attingedigital.com.br/login
Unique # 43597aef-3ed1-4c61-8322-9720805a18af
OWASP -
WASC -
Details
Threat
The HTML form contains a field that collects an email address.
Impact
In some web apps, forms that collect email addresses also generate messages to back-end systems whenever the form is submitted. If no rate limiting or
CAPTCHA is applied to form submissions, then vulnerability tests against this form may produce a significant amount of messages. If too many messages are
generated, then it may produce a Denial of Service situation.
Solution
Review the form to determine if it produces an email message each time it is submitted. If so, consider excluding this form from being tested or disable the
messaging during the web application scan. Forms that generate messages can be abused by malicious users to create Denial of Service attacks. Apply rate
limiting to the form in order to throttle the number of times it may be submitted by a user or by an IP address; or apply a CAPTCHA to it to reduce the chance of
automated tools being used against the form.
Results
150148 AJAX Links Crawled (1)

150148 AJAX Links Crawled atitudefoods.attingedigital.com.br/login
Unique # 0e96fb1f-da56-4f15-83d8-965f5b6cb2da
OWASP -
WASC -
Details
Threat
The list of unique AJAX links crawled by the scanner appears in the Results section. The link may be either a URL with fragment (#) or a Selenium script. To open
a URL with fragment, open it in browser. To open a Selenium script, use Qualys Browser Recorder Chrome extension. The number of AJAX links reported is
limited to 1000.
Impact

N/A
Solution
N/A
Results
Number of ajax links: 7970

<?xml version="1.0" encoding="UTF-8"?><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head profile="http://selenium-ide.openqa.org/profiles/test-case"><title>replay</
title></head><body><table><thead><tr><td colspan="3">AJAX Link</td></tr></thead><tbody><tr><td>open</td><td>https://atitudefoods.attingedigital.com.br/</td><td></td></tr><tr><td>pause</
td><td>1000</td><td></td></tr><tr><td>click</td><td>id=accept-recommended-btn-handler</td><td></td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>click</td><td>id=close-pc-btn-handler</td><td></td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>click</td><td>id=onetrust-accept-btn-handler</td><td></td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>click</td><td>id=onetrust-pc-sdk</td><td></td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/NAV[1]/DIV[1]/UL[1]/LI[1]/A[1]</td><td></td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/MAIN[1]/DIV[1]/FORM[1]/BUTTON[1]</td><td></td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[2]/DIV[2]/DIV[3]/DIV[1]/BUTTON[1]</td><td></td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>fireEvent</td><td>xpath=//BODY[1]/DIV[1]/MAIN[1]/DIV[1]/FORM[1]/INPUT[2]</td><td>blur</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>fireEvent</td><td>xpath=//BODY[1]/DIV[1]/MAIN[1]/DIV[1]/FORM[1]/INPUT[4]</td><td>blur</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>type</td><td>xpath=//BODY[1]/DIV[1]/MAIN[1]/DIV[1]/FORM[1]/INPUT[1]</td><td>d</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>typeKeys</td><td>id=onetrust-accept-btn-handler</td><td>a</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>typeKeys</td><td>xpath=//BODY[1]/DIV[1]/MAIN[1]/DIV[1]/FORM[1]/INPUT[2]</td><td>a</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>typeKeys</td><td>xpath=//BODY[1]/DIV[1]/MAIN[1]/DIV[1]/FORM[1]/INPUT[4]</td><td>a</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>typeKeys</td><td>xpath=//BODY[1]/DIV[2]/DIV[3]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/P[1]/A[1]</td><td>a</td></tr></tbody></table></body></html>
title></head><body><table><thead><tr><td colspan="3">AJAX Link</td></tr></thead><tbody><tr><td>open</td><td>https://atitudefoods.attingedigital.com.br/_ignition/share-report</td><td></
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=appTab</td><td>d</td></tr></tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=contextTab</td><td>d</td></tr></tbody></table></body></html>


td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=debugTab</td><td>d</td></tr></tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=requestTab</td><td>d</td></tr></tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/UL[1]/LI[6]/BUTTON[1]</td><td></td></tr><tr><td>pause</
td><td>1000</td><td></td></tr><tr><td>check</td><td>id=show_dumps</td><td>d</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>check</td><td>id=show_glows</td><td>d</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>check</td><td>id=show_logs</td><td>d</td></tr></tbody></table></body></html>
td><td>1000</td><td></td></tr><tr><td>check</td><td>id=show_queries</td><td>d</td></tr></tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=stackTraceTab</td><td>d</td></tr></tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=userTab</td><td>d</td></tr></tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/BUTTON[1]</td><td></td></tr></
tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/BUTTON[1]</td><td></td></
tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/OL[1]/LI[10]/UL[1]/LI[1]</td><td></td></tr></


td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/OL[1]/LI[1]/UL[1]/LI[1]</td><td></td></
tr></tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/OL[1]/LI[2]</td><td></td></tr></tbody></
table></body></html>

td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/P[10]</td><td></
td></tr></tbody></table></body></html>

td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/BUTTON[1]</td><td></td></tr></tbody></table></
body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]/DIV[2]/DIV[2]/BUTTON[1]</td><td></td></
tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/BUTTON[1]</td><td></td></
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]/DIV[2]/DIV[2]/BUTTON[1]</td><td></td></
tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]/DIV[2]/DIV[1]/DIV[2]/BUTTON[1]</td><td></td></
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]/DIV[2]/DIV[2]/BUTTON[1]</td><td></td></tr></
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]</td><td></td></tr></tbody></table></body></
html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]</td><td></td></tr></tbody></table></body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/UL[1]/LI[1]/BUTTON[1]</td><td></td></tr></tbody></table></
body></html>
body></html>
body></html>
body></html>
body></html>


body></html>
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>mouseDown</td><td>xpath=//BODY[1]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[3]/DIV[1]/DIV[1]/DIV[1]</td><td></td></tr></
https://atitudefoods.attingedigital.com.br/_ignition/share-report#F27L102
title></head><body><table><thead><tr><td colspan="3">AJAX Link</td></tr></thead><tbody><tr><td>open</td><td>https://atitudefoods.attingedigital.com.br/_ignition/share-report#F27L102</
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=appTab</td><td>d</td></tr></tbody></table></body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=contextTab</td><td>d</td></tr></tbody></table></body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=debugTab</td><td>d</td></tr></tbody></table></body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=requestTab</td><td>d</td></tr></tbody></table></body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/UL[1]/LI[6]/BUTTON[1]</td><td></td></
tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=show_dumps</td><td>d</td></tr></tbody></table></body></html>
tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=show_glows</td><td>d</td></tr></tbody></table></body></html>
tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=show_logs</td><td>d</td></tr></tbody></table></body></html>
tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=show_queries</td><td>d</td></tr></tbody></table></body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=stackTraceTab</td><td>d</td></tr></tbody></table></body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>check</td><td>id=userTab</td><td>d</td></tr></tbody></table></body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/BUTTON[1]</td><td></


td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/OL[1]/LI[1]/UL[1]/LI[1]</
td><td></td></tr></tbody></table></body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/OL[1]/LI[2]</td><td></td></

td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/DIV[2]/DIV[2]/DIV[1]/DIV[1]/DIV[1]/P[10]</


td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/BUTTON[1]</td><td></td></tr></tbody></
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]/DIV[2]/DIV[2]/BUTTON[1]</td><td></
td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]/DIV[2]/DIV[1]/DIV[1]/BUTTON[1]</td><td></
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]/DIV[1]</td><td></td></tr></tbody></table></
body></html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/DIV[2]</td><td></td></tr></tbody></table></body></
html>
td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>click</td><td>xpath=//BODY[1]/DIV[1]/DIV[2]/DIV[1]/NAV[1]/UL[1]/LI[1]/BUTTON[1]</td><td></td></tr></


td><td></td></tr><tr><td>pause</td><td>1000</td><td></td></tr><tr><td>mouseDown</td><td>xpath=//BODY[1]/DIV[1]/DIV[1]/DIV[1]/DIV[1]/DIV[3]/DIV[1]/DIV[1]/DIV[1]</td><td></td></








body></html>
html>





body></html>
html>






body></html>
html>






body></html>
html>




body></html>
html>






body></html>
html>







body></html>
html>






body></html>
html>






body></html>
html>



Number of ajax links discarded due to crawl optimization: 0
150152 Forms Crawled (1)

150152 Forms Crawled atitudefoods.attingedigital.com.br/login
Unique # 3e419e34-5650-47dc-bb07-4c6abbd23986
OWASP -
WASC -
Details
Threat
The Results section lists the unique forms that were identified and submitted by the scanner. The forms listed in this QID do not include authentication forms (i.e.
login forms), which are reported separately under QID 150115.
The scanner does a redundancy check on forms by inspecting the form fields. Forms determined to be the redundant based on identical form fields will not be
tested. If desired, you can enable 'Include form action URI in form uniqueness calculation' in the WAS option profile to have the scanner also consider the form's
action attribute in the redundancy check.
NOTE: Any regular expression specified under 'Redundant Links' are not applied to forms. Forms (unique or redundant) are not reported under QID 150140.
Impact
N/A
Solution

N/A
Results
Total internal forms seen (this count includes duplicate forms): 1
Crawled forms (Total: 1)

NOTE: This does not include authentication forms. Authentication forms are reported separately in QID 150115
Form #:1 Action URI:https://atitudefoods.attingedigital.com.br/meus-dados (found at: https://atitudefoods.attingedigital.com.br/meus-dados)
Form Fields: 4 field(s) without name.
150170 Logout Links Discovered (1)

150170 Logout Links Discovered atitudefoods.attingedigital.com.br/login
Unique # 8d97211f-38f8-4f14-b2a4-9fc6f32eb2cb
OWASP -
WASC -
Details
Threat
The logout links discovered by the scanner are provided in the Results section. These links were present on the web application, but were not crawled since
crawling these links would terminate the active authenticated session and negatively impact the crawling.
Logout links are identified automatically based on common logout regex patterns used by web applications. If the automatic identification technique does not
work for your web application, you can configure a custom Logout Regular Expression for the web app under 'Exclusions' in the WAS UI.
Impact
N/A
Solution
N/A
Results
Number of logout links detected: 1

https://atitudefoods.attingedigital.com.br/api/auth/logout
150172 Requests Crawled (1)

150172 Requests Crawled atitudefoods.attingedigital.com.br/login
Unique # 2db98785-5a39-40de-851c-359f6c5cccd4
OWASP -
WASC -

Details
Threat
The QID reports list of requests crawled by the Web application scanner appear in the Results section.
Impact
N/A
Solution
N/A
Results
Number of crawled XHRs: 26

Method POST URI https://atitudefoods.attingedigital.com.br/api/auth/logout (Count: 1)
Number of External XHRs: 25
150176 JavaScript Libraries Detected (1)

150176 JavaScript Libraries Detected atitudefoods.attingedigital.com.br/login
Unique # dfdcb424-e8aa-4aab-a02c-00c96de6551e
CWE CWE-200 Detection Date 30 Apr 2021 22:37 GMT+0630
OWASP -
WASC -
Details
Threat
The JavaScript libraries discovered by the scanner are provided in the Results section. The discovered libraries are reported only once based on the page on
which they were first detected.
Each library is reported along with other information such as the URL of page on which it was first found, the version, and the URL of the .js file.
Impact
N/A
Solution
N/A
Results
Number of unique JS libraries: 3

Javascript library : Bootstrap
Version : 4.3.1
Script uri : https://atitudefoods.attingedigital.com.br/assets/js/bootstrap.min.js
Found on the following page(only first page is reported):
===============================================================
Javascript library : Underscore

Version : 4.17.19


===============================================================
Javascript library : jQuery

Version : 3.3.1
Script uri : https://atitudefoods.attingedigital.com.br/assets/js/jquery-3.3.1.min.js
===============================================================
38116 SSL Server Information Retrieval (1)

38116 SSL Server Information Retrieval atitudefoods.attingedigital.com.br/login
Unique # 29c81ecf-8026-41e4-b69e-160dd39483d0
OWASP -
WASC -
Details
Threat
The following is a list of supported SSL ciphers.
Note: If a cipher is included in this list it means that it was possible to establish a SSL connection using that cipher. There are some web servers setups that allow
connections to be established using a LOW grade cipher, only to provide a web page stating that the URL is accessible only through a non-LOW grade cipher. In
this case even though LOW grade cipher will be listed here QID 38140 will not be reported.
Impact
N/A
Solution
N/A
SSL Data
Flags -
Protocol tcp
Virtual Host atitudefoods.attingedigital.com.br
IP 162.241.49.8
Port 443
Result #table cols="6" CIPHER KEY-EXCHANGE AUTHENTICATION MAC ENCRYPTION(KEY-STRENGTH) GRADE SSLv2_PROTOCOL_IS_DISABLED _ _ _ _ _
SSLv3_PROTOCOL_IS_DISABLED _ _ _ _ _ TLSv1_PROTOCOL_IS_DISABLED _ _ _ _ _ TLSv1.1_PROTOCOL_IS_DISABLED _ _ _ _ _
TLSv1.2_PROTOCOL_IS_ENABLED _ _ _ _ _ TLSv1.2 COMPRESSION_METHOD None _ _ _ ECDHE-RSA-AES128-SHA256 ECDH RSA SHA256 AES(128)
MEDIUM ECDHE-RSA-AES256-SHA384 ECDH RSA SHA384 AES(256) HIGH ECDHE-RSA-AES128-GCM-SHA256 ECDH RSA AEAD AESGCM(128) MEDIUM
ECDHE-RSA-AES256-GCM-SHA384 ECDH RSA AEAD AESGCM(256) HIGH ECDHE-RSA-CHACHA20-POLY1305 ECDH RSA AEAD CHACHA20/
POLY1305(256) HIGH TLSv1.3_PROTOCOL_IS_ENABLED _ _ _ _ _ TLS13-AES-128-GCM-SHA256 N/A N/A AEAD AESGCM(128) MEDIUM TLS13-AES-256-
GCM-SHA384 N/A N/A AEAD AESGCM(256) HIGH TLS13-CHACHA20-POLY1305-SHA256 N/A N/A AEAD CHACHA20/POLY1305(256) HIGH
Info List

Info #1
Ciphers
Name Auth Encryption Grade Key Exchange Mac Protocol
ECDHE-RSA- RSA AES(128) MEDIUM ECDH SHA256 TLSv1.2
AES128-SHA256
ECDHE-RSA- RSA AES(256) HIGH ECDH SHA384 TLSv1.2
AES128-SHA256
ECDHE-RSA- RSA AESGCM(128) MEDIUM ECDH AEAD TLSv1.2
AES128-SHA256
ECDHE-RSA- RSA AESGCM(256) HIGH ECDH AEAD TLSv1.2
AES128-SHA256
ECDHE-RSA- RSA CHACHA20/ HIGH ECDH AEAD TLSv1.2
AES128-SHA256 POLY1305(256)
Info #2
Ciphers
Name Auth Encryption Grade Key Exchange Mac Protocol
TLS13-AES-128- N/A AESGCM(128) MEDIUM N/A AEAD TLSv1.3
GCM-SHA256
TLS13-AES-128- N/A AESGCM(256) HIGH N/A AEAD TLSv1.3
GCM-SHA256
TLS13-AES-128- N/A CHACHA20/ HIGH N/A AEAD TLSv1.3
GCM-SHA256 POLY1305(256)
38291 SSL Session Caching Information (1)

38291 SSL Session Caching Information atitudefoods.attingedigital.com.br/login
Unique # 8ce41578-c577-40c7-bb9c-8c9e0f4b6c09
OWASP -
WASC -
Details
Threat
SSL session is a collection of security parameters that are negotiated by the SSL client and server for each SSL connection. SSL session caching is targeted to
reduce the overhead of negotiations in recurring SSL connections. SSL sessions can be reused to resume an earlier connection or to establish multiple
simultaneous connections. The client suggests an SSL session to be reused by identifying the session with a Session-ID during SSL handshake. If the server
finds it appropriate to reuse the session, then they both proceed to secure communication with already known security parameters.
This test determines if SSL session caching is enabled on the host.
Impact

SSL session caching is part of the SSL and TLS protocols and is not a security threat. The result of this test is for informational purposes only.
Solution
N/A
SSL Data
Flags -
Protocol tcp
IP 162.241.49.8
Port 443
Result TLSv1.2 session caching is enabled on the target. TLSv1.3 session caching is enabled on the target.
38597 SSL/TLS invalid protocol version tolerance (1)

38597 SSL/TLS invalid protocol version tolerance atitudefoods.attingedigital.com.br/login
Unique # 6e03c05b-84a0-4cfe-aedc-365be80c8592
OWASP -
WASC -
Details
Threat
SSL/TLS protocols have different version that can be supported by both the client and the server. This test attempts to send invalid protocol versions to the target
in order to find out what is the target's behavior. The results section contains a table that indicates what was the target's response to each of our tests.
Impact
N/A
Solution
N/A
SSL Data
Flags -
Protocol tcp
IP 162.241.49.8
Port 443
Result #table cols=2 my_version target_version 0304 0303 0399 0303 0400 0303 0499 0303
38600 SSL Certificate will expire within next six months (1)
38600 SSL Certificate will expire within next six atitudefoods.attingedigital.com.br/login
months
Unique # 95055ebc-486c-416a-96b9-be480b36c31a


OWASP -
WASC -
Details
Threat
Certificates are used for authentication purposes in different protocols such as SSL/TLS. Each certificate has a validity period outside of which it is supposed to
be considered invalid. This QID is reported to inform that a certificate will expire within next six months. The advance notice can be helpful since obtaining a
certificate can take some time.
Impact
Expired certificates can cause connection disruptions or compromise the integrity and privacy of the connections being protected by the certificates.
Solution
Contact the certificate authority that signed your certificate to arrange for a renewal.
SSL Data
Flags -
Protocol tcp
IP 162.241.49.8
Port 443
Result Certificate #0 CN=atitudefoods.attingedigital.com.br The certificate will expire within six months: Jul 22 15:55:04 2021 GMT Certificate #1
CN=R3,O=Let's_Encrypt,C=US The certificate will expire within six months: Sep 29 19:21:40 2021 GMT
Info List
Info #1
Certificate Fingerprint:4CCE75DEFA0DDF7784FC69D845C2F3812413DA6BB919C9A76508932CAEB9E3D7
Info #2
38704 SSL/TLS Key Exchange Methods (1)

38704 SSL/TLS Key Exchange Methods atitudefoods.attingedigital.com.br/login
Unique # cf63b96a-4904-4dd1-98d9-8d6d80e2b8a9
OWASP -
WASC -
Details
Threat
The following is a list of SSL/TLS key exchange methods supported by the server, along with their respective key sizes and strengths.
Impact

N/A
Solution
N/A
SSL Data
Flags -
Protocol tcp
IP 162.241.49.8
Port 443
Result #table cols="6" NAME GROUP KEY-SIZE FORWARD-SECRET CLASSICAL-STRENGTH QUANTUM-STRENGTH TLSv1.2 _ _ _ _ _ ECDHE x448 448 yes 224 low
ECDHE x25519 256 yes 128 low ECDHE secp384r1 384 yes 192 low ECDHE secp256r1 256 yes 128 low ECDHE secp521r1 521 yes 260 low TLSv1.3 _ _ _ _ _
ECDHE x25519 256 yes 128 low ECDHE secp256r1 256 yes 128 low ECDHE x448 448 yes 224 low ECDHE secp521r1 521 yes 260 low ECDHE secp384r1 384
yes 192 low
Info List
Info #1
Kexs
Kex Group Protocol Key Size Classical Quantum
ECDHE TLSv1.2 448 yes 224 low
38706 SSL/TLS Protocol Properties (1)

38706 SSL/TLS Protocol Properties atitudefoods.attingedigital.com.br/login
Unique # 94fec93c-54ac-4e5d-b130-63d854119e97
OWASP -
WASC -

Details
Threat
The following is a list of detected SSL/TLS protocol properties.
Impact
Items include:
• Extended Master Secret: indicates whether the extended_master_secret extension is supported or required by the server. This extension enhances security
and is recommended. Applicable to TLSv1, TLSv1.1, TLSv1.2, DTLSv1, DTLSv1.2
• Encrypt Then MAC: indicates whether the encrypt_then_mac extension is supported or required by the server. This extension enhances the security of non-
AEAD ciphers and is recommended. Applicable to TLSv1, TLSv1.1, TLSv1.2, DTLSv1, DTLSv1.2
• Heartbeat: indicates whether the heartbeat extension is supported. It is not recommended to enable this, except for DTLS. Applicable to TLSv1, TLSv1.1,
TLSv1.2, TLSv1.3, DTLSv1, DTLSv1.2
• Truncated HMAC: indicates whether the truncated_hmac extension is supported. This can degrade security and is not recommended. Applicable to TLSv1,
TLSv1.1, TLSv1.2, DTLSv1, DTLSv1.2
• Cipher priority: indicates whether client, server or both determine the priority of ciphers. Having the server determine the priority is recommended. Applicable
to SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3, DTLSv1, DTLSv1.2
Solution
N/A
SSL Data
Flags -
Protocol tcp
IP 162.241.49.8
Port 443
Result #table cols="2" NAME STATUS TLSv1.2 _ Extended_Master_Secret yes Encrypt_Then_MAC yes Heartbeat no Truncated_HMAC no Cipher_priority_controlled_by
client OCSP_stapling yes SCT_extension no TLSv1.3 _ Heartbeat no Cipher_priority_controlled_by client OCSP_stapling yes SCT_extension no
Info List

Info #1
Props
Name Value Protocol
Extended Master yes TLSv1.2
Secret
Encrypt Then MAC yes TLSv1.2
Heartbeat no TLSv1.2
Truncated HMAC no TLSv1.2
Cipher priority client TLSv1.2
controlled by
OCSP stapling yes TLSv1.2
SCT extension no TLSv1.2
Heartbeat no TLSv1.3
Cipher priority client TLSv1.3
controlled by
OCSP stapling yes TLSv1.3
SCT extension no TLSv1.3
38717 SSL Certificate OCSP Information (1)

38717 SSL Certificate OCSP Information atitudefoods.attingedigital.com.br/login
Unique # 20c495b5-48e7-4265-8d9e-20d0e2c3a051
OWASP -
WASC -
Details
Threat
OCSP (Online Certificate Status Protocol) is a protocol to determine the status of an SSL certificate, specifically whether a certificate has been revoked by the
issuing certificate authority. SSL servers can provide the OCSP status of their certificate as part of the SSL/TLS handshake. This information is referred to as
"Status Request" or "OCSP Stapling".
Impact
N/A
Solution
N/A
SSL Data

Flags
Protocol tcp
IP 162.241.49.8
Port 443
Result Certificate #0 CN=atitudefoods.attingedigital.com.br OCSP status: good
Info List
Info #1
38718 SSL Certificate Transparency Information (1)

38718 SSL Certificate Transparency Information atitudefoods.attingedigital.com.br/login
Unique # dde0c815-6ad4-4ed6-b68a-eeb506c6da4b
OWASP -
WASC -
Details
Threat
SSL Certificate Transparency is an industry effort to improve visibility into the process of how certificate authorities issue certificates. It is designed to allow the
owners of domain names to find all certificates that have been issued for their domains, and which certificate authorities have issued them. This is done by
requiring certificate authorities to publish all issued certificates in public logs. TLS servers can then provide cryptographic evidence to TLS clients that the server
certificate has been registered in public logs, thus providing some degree of confidence that the certificate is legitimate. Such cryptographic evidence is referred
to as an "SCT Log Proof".
The information below lists all validated SCT Log Proofs for server certificates along with information about the public log, where available.
Impact
N/A
Solution
N/A
SSL Data
Flags -
Protocol tcp
IP 162.241.49.8
Port 443
Result #table cols="6" Source Validated Name URL ID Time Certificate_#0 _ CN=atitudefoods.attingedigital.com.br _ _ _ Certificate yes DigiCert_Yeti2021_Log
yeti2021.ct.digicert.com/log/ 5cdc4392fee6ab4544b15e9ad456e61037fbd5fa47dca17394b25ee6f6c70eca Fri_23_Apr_2021_04:55:05_PM_GMT Certificate yes
Google_'Xenon2021'_log ct.googleapis.com/logs/xenon2021/ 7d3ef2f88fff88556824c2c0ca9e5289792bc50e78097f2e6a9768997e22f0d7

Fri_23_Apr_2021_04:55:05_PM_GMT
Info List
Info #1
42350 TLS Secure Renegotiation Extension Support Information (1)

42350 TLS Secure Renegotiation Extension atitudefoods.attingedigital.com.br/login
Support Information
Unique # b7ef80f0-5787-4e10-b652-da0cb04dae26
OWASP -
WASC -
Details
Threat
Secure Socket Layer (SSL) and Transport Layer Security (TLS) renegotiation are vulnerable to an attack in which the attacker forms a TLS connection with the
target server, injects content of his choice, and then splices in a new TLS connection from a client. The server treats the client's initial TLS handshake as a
renegotiation and thus believes that the initial data transmitted by the attacker is from the same entity as the subsequent client data. TLS protocol was extended
to cryptographically tierenegotiations to the TLS connections they are being performed over. This is referred to as TLS secure renegotiation extension. This
detection determines whether the TLS secure renegotiation extension is supported by the server or not.
Impact
N/A
Solution
N/A
SSL Data
Flags -
Protocol tcp
IP 162.241.49.8
Port 443
Result TLS Secure Renegotiation Extension Status: supported.
45038 Host Scan Time (1)

45038 Host Scan Time atitudefoods.attingedigital.com.br/login
Unique # dede016a-0a79-49b1-8749-314d65d09da9
OWASP -
WASC -

Details
Threat
The Host Scan Time is the period of time it takes the scanning engine to perform the vulnerability assessment of a single target host. The Host Scan Time for this
host is reported in the Result section below.
The Host Scan Time does not have a direct correlation to the Duration time as displayed in the Report Summary section of a scan results report. The Duration is
the period of time it takes the service to perform a scan task. The Duration includes the time it takes the service to scan all hosts, which may involve parallel
scanning. It also includes the time it takes for a scanner appliance to pick up the scan task and transfer the results back to the service's Secure Operating Center.
Further, when a scan task is distributed across multiple scanners, the Duration includes the time it takes to perform parallel host scanning on all scanners.
For host running the Qualys Windows agent this QID reports the time taken by the agent to collect the host metadata used for the most recent assessment scan.
Impact
N/A
Solution
N/A
Results
Scan duration: 20258 seconds
Start time: Fri, Apr 30 2021, 17:07:51 GMT
End time: Fri, Apr 30 2021, 22:45:29 GMT
6 DNS Host Name (1)

6 DNS Host Name atitudefoods.attingedigital.com.br/login
Unique # b8c66151-4396-41e9-b4c8-057421361a61
OWASP -
WASC -
Details
Threat
The fully qualified domain name of this host, if it was obtained from a DNS server, is displayed in the RESULT section.
Impact
N/A
Solution
N/A
SSL Data
Flags -
Protocol tcp

Virtual Host -
IP 162.241.49.8
Port -
Result #table IP_address Host_name 162.241.49.8 vps.attingedigital.com.br
86002 SSL Certificate - Information (1)

86002 SSL Certificate - Information atitudefoods.attingedigital.com.br/login
Unique # dc68285c-e834-4ed1-bef7-e08eef4aa275
OWASP -
WASC -
Details
Threat
SSL certificate information is provided in the Results section.
Impact
N/A
Solution
N/A
SSL Data
Flags -
Protocol tcp
IP 162.241.49.8
Port 443
Result #table cols="2" NAME VALUE (0)CERTIFICATE_0 _ (0)Version 3_(0x2) (0)Serial_Number _04:69:10:73:50:6e:ad:9f:59:ce:ee:5a:66:17:77:2e:a5:53_
(0)Signature_Algorithm sha256WithRSAEncryption (0)ISSUER_NAME _ countryName US _organizationName Let's_Encrypt _commonName R3
(0)SUBJECT_NAME _ commonName atitudefoods.attingedigital.com.br (0)Valid_From Apr_23_15:55:04_2021_GMT (0)Valid_Till Jul_22_15:55:04_2021_GMT
(0)Public_Key_Algorithm rsaEncryption (0)RSA_Public_Key (2048_bit) (0) _RSA_Public-Key:_(2048_bit) (0) _Modulus: (0) _00:d4:66:34:1d:d6:81:8a:08:f1:be:
49:1c:e8:2e: (0) _26:28:85:4a:a3:b8:96:dc:08:71:31:a6:bf:d8:5c: (0) _8d:42:40:5d:02:25:01:80:26:51:7e:13:04:9c:68: (0) _43:ac:
03:d1:79:d7:f0:0d:a9:33:9e:d4:83:49:9d: (0) _f4:96:1b:4a:e0:b5:80:0e:7e:94:77:59:73:75:89: (0) _f6:fa:be:22:ae:6b:ba:ef:20:a3:bd:ea:ca:8b:9e: (0) _0e:0e:c7:5f:3e:
84:95:34:e7:cd:bb:12:2f:26:d7: (0) _f6:5d:4e:db:a0:38:59:90:9d:d2:84:e5:14:67:74: (0) _15:50:cb:38:b6:43:1b:16:81:6d:41:18:13:a7:64: (0) _32:0b:02:a4:d2:83:cf:
44:c0:8f:1c:7c:83:fd:b3: (0) _4a:18:e0:e2:9f:79:15:6c:67:0c:35:c7:24:24:2d: (0) _84:72:3a:17:03:83:d6:26:0f:3c:47:10:4e:e4:e5: (0) _c7:2f:95:eb:63:02:ad:71:20:1f:5c:
61:cd:31:d1: (0) _f4:d3:7e:a9:7d:36:38:b7:28:7e:19:ed:a6:7e:ee: (0) _80:07:01:55:82:f7:5d:9f:5c:ac:6a:d9:f7:bf:91: (0) _c1:ed:18:c6:2c:90:77:8c:13:ff:91:e3:e0:1c:5b:
(0) _ad:62:c8:32:1e:bd:82:de:6a:21:51:36:87:fd:7e: (0) _20:af (0) _Exponent:_65537_(0x10001) (0)X509v3_EXTENSIONS _ (0)X509v3_Key_Usage critical (0)
_Digital_Signature,_Key_Encipherment (0)X509v3_Extended_Key_Usage _TLS_Web_Server_Authentication,_TLS_Web_Client_Authentication
(0)X509v3_Basic_Constraints critical (0) _CA:FALSE (0)X509v3_Subject_Key_Identifier _E2:F6:BA:0D:8E:13:F7:FB:CB:A9:46:D9:CB:51:58:C0:5E:12:73:9D
(0)X509v3_Authority_Key_Identifier _keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6 (0)Authority_Information_Access _OCSP_-_URI:http://
r3.o.lencr.org (0) _CA_Issuers_-_URI:http://r3.i.lencr.org/ (0)X509v3_Subject_Alternative_Name _DNS:atitudefoods.attingedigital.com.br
(0)X509v3_Certificate_Policies _Policy:_2.23.140.1.2.1 (0) _Policy:_1.3.6.1.4.1.44947.1.1.1 (0) _CPS:_http://cps.letsencrypt.org (0)CT_Precertificate_SCTs
_Signed_Certificate_Timestamp: (0) _Version_:_v1_(0x0) (0) _Log_ID_:_5C:DC:43:92:FE:E6:AB:45:44:B1:5E:9A:D4:56:E6:10: (0) _37:FB:D5:FA:
47:DC:A1:73:94:B2:5E:E6:F6:C7:0E:CA (0) _Timestamp_:_Apr_23_16:55:05.282_2021_GMT (0) _Extensions:_none (0) _Signature_:_ecdsa-with-SHA256 (0)
_30:44:02:20:43:A1:E4:43:A2:96:7A:E5:FE:DB:D9:A0: (0) _D2:A5:5C:FA:78:52:6C:7D:31:12:D3:78:E3:85:06:93: (0) _03:D0:1E:8B:02:20:5F:3B:A7:34:C9:DF:D8:2B:
77:C9: (0) _EF:30:E1:41:CC:D4:CB:25:6B:28:B4:23:0E:8B:2E:B3: (0) _B4:FB:CF:0B:DA:4E (0) _Signed_Certificate_Timestamp: (0) _Version_:_v1_(0x0) (0)
_Log_ID_:_7D:3E:F2:F8:8F:FF:88:55:68:24:C2:C0:CA:9E:52:89: (0) _79:2B:C5:0E:78:09:7F:2E:6A:97:68:99:7E:22:F0:D7 (0)
_Timestamp_:_Apr_23_16:55:05.314_2021_GMT (0) _Extensions:_none (0) _Signature_:_ecdsa-with-SHA256 (0) _30:45:02:20:0C:62:43:46:BC:D5:E8:7A:50:33:3A:
96: (0) _F8:FD:B4:AE:DB:88:00:41:0E:07:80:52:DD:1A:6B:D6: (0) _69:9D:55:B3:02:21:00:A0:11:83:96:49:55:8E:EB:73: (0) _7A:6A:5F:93:9F:20:A6:95:BD:
22:0C:A4:F2:5C:2B:88: (0) _2B:C2:9D:84:46:4B:D6 (0)Signature (256_octets) (0) 16:b2:bf:16:69:fe:20:ab:64:e0:fb:a0:40:6c:15:14 (0) 7b:24:07:b4:c7:87:f9:5b:ef:9d:
49:55:53:ac:1f:79 (0) 0a:2b:58:05:0d:d0:2d:d7:2b:d8:0b:35:34:d2:77:8a (0) 39:57:09:54:b3:b9:d7:fc:cb:21:de:e6:b0:9b:09:3b (0) 1a:7a:ed:d6:6d:5f:27:55:1a:af:
73:14:fa:8f:c0:85 (0) bc:4e:07:9e:7e:52:fc:82:86:07:5e:bf:d2:0f:9c:93 (0) 41:c3:e4:2e:6a:51:cc:d0:22:8d:d9:e5:19:56:9e:29 (0) 86:79:5b:48:cf:51:52:4f:05:fa:5d:
93:71:4f:fd:8f (0) 4d:59:e6:4a:45:58:93:c3:4d:c1:20:44:56:63:94:36 (0) e8:e7:c6:16:f9:e3:5a:9b:81:42:4e:a3:7f:ff:f2:8a (0) e5:e8:af:a6:6d:cc:18:7e:01:58:43:52:b7:2e:
74:b4 (0) b7:41:f8:f0:08:7f:ed:af:e1:21:6e:3f:a1:db:2b:1b (0) 8b:58:86:64:be:f5:b8:47:0f:24:6e:dc:0e:8e:35:12 (0) 20:a9:8f:56:43:14:d9:12:48:13:ea:32:21:08:bf:cd (0)
e8:9f:4a:e1:e5:ab:35:17:67:67:d7:5f:0e:20:ee:8b (0) 95:e6:12:16:10:0c:95:0d:f5:ca:a9:9b:52:ec:2e:ab (1)CERTIFICATE_1 _ (1)Version 3_(0x2) (1)Serial_Number

_40:01:75:04:83:14:a4:c8:21:8c:84:a9:0c:16:cd:df_ (1)Signature_Algorithm sha256WithRSAEncryption (1)ISSUER_NAME _ organizationName

Digital_Signature_Trust_Co. _commonName DST_Root_CA_X3 (1)SUBJECT_NAME _ countryName US _organizationName Let's_Encrypt _commonName R3
(1)Valid_From Oct_7_19:21:40_2020_GMT (1)Valid_Till Sep_29_19:21:40_2021_GMT (1)Public_Key_Algorithm rsaEncryption (1)RSA_Public_Key (2048_bit) (1)
_RSA_Public-Key:_(2048_bit) (1) _Modulus: (1) _00:bb:02:15:28:cc:f6:a0:94:d3:0f:12:ec:8d:55: (1) _92:c3:f8:82:f1:99:a6:7a:42:88:a7:5d:26:aa:b5: (1)
_2b:b9:c5:4c:b1:af:8e:6b:f9:75:c8:a3:d7:0f:47: (1) _94:14:55:35:57:8c:9e:a8:a2:39:19:f5:82:3c:42: (1) _a9:4e:6e:f5:3b:c3:2e:db:8d:c0:b0:5c:f3:59:38: (1) _e7:ed:cf:
69:f0:5a:0b:1b:be:c0:94:24:25:87:fa: (1) _37:71:b3:13:e7:1c:ac:e1:9b:ef:db:e4:3b:45:52: (1) _45:96:a9:c1:53:ce:34:c8:52:ee:b5:ae:ed:8f:de: (1)
_60:70:e2:a5:54:ab:b6:6d:0e:97:a5:40:34:6b:2b: (1) _d3:bc:66:eb:66:34:7c:fa:6b:8b:8f:57:29:99:f8: (1) _30:17:5d:ba:72:6f:fb:81:c5:ad:d2:86:58:3d:17: (1)
_c7:e7:09:bb:f1:2b:f7:86:dc:c1:da:71:5d:d4:46: (1) _e3:cc:ad:25:c1:88:bc:60:67:75:66:b3:f1:18:f7: (1) _a2:5c:e6:53:ff:3a:88:b6:47:a5:ff:13:18:ea:98: (1) _09:77:3f:9d:
53:f9:cf:01:e5:f5:a6:70:17:14:af: (1) _63:a4:ff:99:b3:93:9d:dc:53:a7:06:fe:48:85:1d: (1) _a1:69:ae:25:75:bb:13:cc:52:03:f5:ed:51:a1:8b: (1) _db:15 (1)
_Exponent:_65537_(0x10001) (1)X509v3_EXTENSIONS _ (1)X509v3_Basic_Constraints critical (1) _CA:TRUE,_pathlen:0 (1)X509v3_Key_Usage critical (1)
_Digital_Signature,_Certificate_Sign,_CRL_Sign (1)Authority_Information_Access _CA_Issuers_-_URI:http://apps.identrust.com/roots/dstrootcax3.p7c
(1)X509v3_Authority_Key_Identifier _keyid:C4:A7:B1:A4:7B:2C:71:FA:DB:E1:4B:90:75:FF:C4:15:60:85:89:10 (1)X509v3_Certificate_Policies _Policy:_2.23.140.1.2.1
(1) _Policy:_1.3.6.1.4.1.44947.1.1.1 (1) _CPS:_http://cps.root-x1.letsencrypt.org (1)X509v3_CRL_Distribution_Points (1) _Full_Name: (1) _URI:http://
crl.identrust.com/DSTROOTCAX3CRL.crl (1)X509v3_Subject_Key_Identifier _14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
(1)X509v3_Extended_Key_Usage _TLS_Web_Server_Authentication,_TLS_Web_Client_Authentication (1)Signature (256_octets) (1)
d9:4c:e0:c9:f5:84:88:37:31:db:bb:13:e2:b3:fc:8b (1) 6b:62:12:6c:58:b7:49:7e:3c:02:b7:a8:1f:28:61:eb (1) ce:e0:2e:73:ef:49:07:7a:35:84:1f:1d:ad:68:f0:d8 (1) fe:
56:81:2f:6d:7f:58:a6:6e:35:36:10:1c:73:c3:e5 (1) bd:6d:5e:01:d7:6e:72:fb:2a:a0:b8:d3:57:64:e5:5b (1) c2:69:d4:d0:b2:f7:7c:4b:c3:17:8e:88:72:73:dc:fd (1) fc:
6d:bd:e3:c9:0b:8e:61:3a:16:58:7d:74:36:2b:55 (1) 80:3d:c7:63:be:84:43:c6:39:a1:0e:6b:57:9e:3f:29 (1) c1:80:f6:b2:bd:47:cb:aa:30:6c:b7:32:e1:59:54:0b (1)
18:09:17:5e:63:6c:fb:96:67:3c:1c:73:0c:93:8b:c6 (1) 11:76:24:86:de:40:07:07:e4:7d:2d:66:b5:25:a3:96 (1) 58:c8:ea:80:ee:cf:69:3b:96:fc:e6:8d:c0:33:f3:89 (1)
f8:29:2d:14:14:2d:7e:f0:61:70:95:5d:f7:0b:e5:c0 (1) fb:24:fa:ec:8e:cb:61:c8:ee:63:71:28:a8:2c:05:3b (1) 77:ef:9b:5e:03:64:f0:51:d1:e4:85:53:5c:b0:02:97 (1)
d4:7e:c6:34:d2:ce:10:00:e4:b1:df:3a:c2:ea:17:be
Info List
Info #1
Info #2
Security Weaknesses (12)

150261 Subresource Integrity (SRI) Not Implemented (1)
150261 Subresource Integrity (SRI) Not atitudefoods.attingedigital.com.br/login
Implemented
Unique # 9f8dc8bc-a005-43dd-90dc-eaf22fd9f13f
Group Security Weaknesses
OWASP -
WASC -
Details
Threat
The integrity attribute is missing in script and/or link elements. Subresource Integrity (SRI) is a standard browser security feature that verifies the value of the
integrity attribute in
Impact
Absence of SRI checks means it is impossible to verify that the third-party resources are delivered without any unexpected manipulation.
Solution
All script and link elements that load external content should include the integrity attribute to ensure that the content is trustworthy.
More information:
Subresource Integrity article by Mozilla
OWASP Third-Party JavaScript Management Cheat Sheet

Results
Externally loaded Javascript and CSS resources without integrity checks:
Parent link : https://atitudefoods.attingedigital.com.br/

Found following resource links without integrity checks (only first 10 links are reported)
https://fonts.googleapis.com/css2?family=Oswald:wght@200;300;400;700&display=swap




















Please check there may be more pages with subresource links without integrity checks.
150202 Missing header: X-Content-Type-Options (1)

150202 Missing header: X-Content-Type-Options atitudefoods.attingedigital.com.br/login
Unique # bfb56b08-ac85-48c1-b5f7-c7e025d48ba9
CWE CWE-16, CWE-1032 Detection Date 30 Apr 2021 22:37 GMT+0630
OWASP A6 Security Misconfiguration
WASC WASC-15 APPLICATION MISCONFIGURATION
Details

Threat
The X-Content-Type-Options response header is not present. WAS reports missing X-Content-Type-Options header on each crawled link for both static and
dynamic responses. The scanner performs the check not only on 200 responses but 4xx and 5xx responses as well. It's also possible the QID will be reported on
directory-level links.
Impact
All web browsers employ a content-sniffing algorithm that inspects the contents of HTTP responses and also occasionally overrides the MIME type provided by
the server. If X-Content-Type-Options header is not present, browsers can potentially be tricked into treating non-HTML response as HTML. An attacker can then
potentially leverage the functionality to perform a cross-site scripting (XSS) attack. This specific case is known as a Content-Sniffing XSS (CS-XSS) attack.
Solution
It is recommended to disable browser content sniffing by adding the X-Content-Type-Options header to the HTTP response with a value of 'nosniff'. Also, ensure
that the 'Content-Type' header is set correctly on responses.
Results
X-Content-Type-Options: Header missing

Response headers on link: GET https://atitudefoods.attingedigital.com.br/ response code: 200
Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
TOKEN=eyJpdiI6Ijd1RjN3NzRUL3VvWElzU2hoWVpXb1E9PSIsInZhbHVlIjoiV2grMUxtN2ZpTE9LV21XT2Z6cWgxcnFCMGRIQmRrZW0xaUNJeUR0RFVDVklvdmN4T3licDdVUk8yVnVHQk92dHM
Set-Cookie: XSRF-
expires=Fri, 30-Apr-2021 19:10:07 GMT; domain=atitudefoods.attingedigital.com.br; SameSite=lax; path=/
Set-Cookie:
laravel_session=eyJpdiI6IjJlL1I5akVUc0FuRW83MVM1K09zVGc9PSIsInZhbHVlIjoiSjR5V0JBKyt3OWdHS0Y4Z2pUNXNmU3A0aUN5dlF2UGV2V2s0M1JpS3pPN3FYUWVVbndLMldSdUtiZ2R6eEF
HttpOnly; expires=Fri, 30-Apr-2021 19:10:07 GMT; domain=atitudefoods.attingedigital.com.br; SameSite=lax; path=/
Set-Cookie: __cfduid=d074d500d9261c620bd19c7345383b6ac1619802607; secure; HttpOnly; expires=Sun, 30-May-2021 17:10:07 GMT; domain=.cookielaw.org; SameSite=Lax; path=/
Set-Cookie: __cfduid=d4084198286413f24aa2b8912d806f7c11619802608; secure; HttpOnly; expires=Sun, 30-May-2021 17:10:08 GMT; domain=.onetrust.com; SameSite=Lax; path=/
expires=Fri, 30-Apr-2021 19: 10:09 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Header missing on the following link(s):

(Only first 50 such pages are listed)
GET https://atitudefoods.attingedigital.com.br/ response code: 200

GET https://atitudefoods.attingedigital.com.br/assets/images/icon-target.png response code: 200
GET https://atitudefoods.attingedigital.com.br/api/auth/check-re response code: 405
GET https://atitudefoods.attingedigital.com.br/assets/images/logo-unilever.png response code: 200
GET https://atitudefoods.attingedigital.com.br/assets/images/icon-trophy.png response code: 200
GET https://atitudefoods.attingedigital.com.br/assets/images/bg.png response code: 200
GET https://atitudefoods.attingedigital.com.br/assets/images/logo.svg response code: 200
GET https://atitudefoods.attingedigital.com.br/api/auth/login response code: 405
GET https://atitudefoods.attingedigital.com.br/assets/js/jquery.mask.min.js response code: 200
GET https://atitudefoods.attingedigital.com.br/js/app.js response code: 200
GET https://atitudefoods.attingedigital.com.br/css/app.css response code: 200
GET https://atitudefoods.attingedigital.com.br/assets/js/jquery-3.3.1.min.js response code: 200
GET https://atitudefoods.attingedigital.com.br/assets/js/popper.min.js response code: 200
GET https://atitudefoods.attingedigital.com.br/assets/js/bootstrap.min.js response code: 200
GET https://atitudefoods.attingedigital.com.br/assets/css/bootstrap.min.css response code: 200
GET https://atitudefoods.attingedigital.com.br/assets/css/app.css response code: 200
POST https://atitudefoods.attingedigital.com.br/meus-dados response code: 405
GET https://atitudefoods.attingedigital.com.br/public/api/auth response code: 404
GET https://atitudefoods.attingedigital.com.br/api/auth/%5Cn response code: 404
GET https://atitudefoods.attingedigital.com.br/api/auth/span%5B response code: 404
GET https://atitudefoods.attingedigital.com.br/%5Cn response code: 404
GET https://atitudefoods.attingedigital.com.br/span%5B response code: 404
GET https://atitudefoods.attingedigital.com.br/public/api response code: 404
GET https://atitudefoods.attingedigital.com.br/public/commit response code: 404
GET https://atitudefoods.attingedigital.com.br/public/releases/tag response code: 404
GET https://atitudefoods.attingedigital.com.br/_ignition/share-report response code: 405
GET https://atitudefoods.attingedigital.com.br/public/releases response code: 404
GET https://atitudefoods.attingedigital.com.br/public/_ignition response code: 404
GET https://atitudefoods.attingedigital.com.br/_ignition/span%5B response code: 404
GET https://atitudefoods.attingedigital.com.br/_ignition/%5Cn response code: 404

POST https://atitudefoods.attingedigital.com.br/api/auth/logout response code: 200
150206 Content-Security-Policy Not Implemented (1)

150206 Content-Security-Policy Not Implemented atitudefoods.attingedigital.com.br/login
Unique # 65957c83-dc20-4012-8a03-b99b046653fd
Details
Threat
No Content-Security-Policy (CSP) is specified for the page. WAS checks for the missing CSP on all static and dynamic pages. It checks for CSP in the response
headers (Content-Security-Policy, X-Content-Security-Policy or X-Webkit-CSP) and in response body (http-equiv="Content-Security-Policy" meta tag).
HTTP 4xx and 5xx responses can also be susceptible to attacks such as XSS. For better security it's important to set appropriate CSP policies on 4xx and 5xx
responses as well.
Impact
Content-Security Policy is a defense mechanism that can significantly reduce the risk and impact of XSS attacks in modern browsers. The CSP specification
provides a set of content restrictions for web resources and a mechanism for transmitting the policy from a server to a client where the policy is enforced. When a
Content Security Policy is specified, a number of default behaviors in user agents are changed; specifically inline content and JavaScript eval constructs are not
interpreted without additional directives. In short, CSP allows you to create a whitelist of sources of the trusted content. The CSP policy instructs the browser to
only render resources from those whitelisted sources. Even though an attacker can find a security vulnerability in the application through which to inject script, the
script won't match the whitelisted sources defined in the CSP policy, and therefore will not be executed.
The absence of Content Security Policy in the response will allow the attacker to exploit vulnerabilities as the protection provided by the browser is not at all
leveraged by the Web application. If secure CSP configuration is not implemented, browsers will not be able to block content-injection attacks such as Cross-Site
Scripting and Clickjacking.
Solution
Appropriate CSP policies help prevent content-injection attacks such as cross-site scripting (XSS) and clickjacking. It's recommended to add secure CSP policies
as a part of a defense-in-depth approach for securing web applications.
References:
- https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
- https://developers.google.com/web/fundamentals/security/csp/
Results
Content-Security-Policy: Header missing

Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
Set-Cookie: XSRF-
Set-Cookie:



150208 Missing header: Referrer-Policy (1)

150208 Missing header: Referrer-Policy atitudefoods.attingedigital.com.br/login
Unique # 8cf1a878-a7ef-4671-8ca5-d7095ce92c30
Details
Threat
No Referrer Policy is specified for the link. WAS checks for the missing Referrer Policy on all static and dynamic pages. It checks for one of the following Referrer
Policy in the response headers:
1) no-referrer
2) no-referrer-when-downgrade
3) same-origin
4) origin
5) origin-when-cross-origin
6) strict-origin
7) strict-origin-when-cross-origin

If the Referrer Policy header is not found , WAS checks in response body for meta tag containing tag name as "referrer" and one of the above Referrer Policy.
Impact
The Referrer-Policy header controls how much referrer information is sent to a site when navigating to it. Absence of Referrer-Policy header can lead to leakage
of sensitive information via the referrer header.
Solution
Referrer Policy header improves security by ensuring websites don't leak sensitive information via the referrer header. It's recommended to add secure Referrer
Policies as a part of a defense-in-depth approach.
References:
- https://www.w3.org/TR/referrer-policy/
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
Results
Referrer-Policy: Header missing

Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
Set-Cookie: XSRF-
Set-Cookie:




150262 Missing header: Feature-Policy (1)

150262 Missing header: Feature-Policy atitudefoods.attingedigital.com.br/login
Unique # f53c56f2-c7cf-44e1-9429-8c3bcd522993
Details
Threat
The Feature-Policy response header is not present.
Impact
Feature Policy allows web developers to selectively enable, disable, and modify the behavior of certain APIs and web features such as "geolocation","camera",
"usb", "fullscreen", "animations" etc in the browser.
These policies restrict what APIs the site can access or modify the browser's default behavior for certain features.
Solution
It is recommended to set the Feature-Policy header to selectively enable, disable, and modify the behavior of certain APIs and web features.
References:
- https://www.w3.org/TR/feature-policy/
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
Results
Feature-Policy: Header missing

Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
Set-Cookie: XSRF-
Set-Cookie:



150099 Cookies Issued Without User Consent (1)

150099 Cookies Issued Without User Consent atitudefoods.attingedigital.com.br/login
Unique # 1396ea75-54e1-4f80-9378-71c01f237233
OWASP -
WASC -
Details
Threat
The cookies listed in the Results section were issued from the web application during the crawl without accepting any opt-in dialogs.
Impact
Cookies may be set without user explicitly agreeing to accept them.
Solution
Review the application to ensure that all cookies listed are supposed to be issued without user opt-in. If the EU Cookie law is applicable for this web application,
ensure these cookies require user opt-in or have been classified as exempt by your organization.
Results
Total cookies: 3
XSRF-
TOKEN=eyJpdiI6IlJsaTVybzBZU25jNzBPSlNtYnlYOUE9PSIsInZhbHVlIjoib2JIQTBLWXVPaUx5cWRSQkkwUjRnVExabUVoMVZFNCsrdjdqOHIxYWdOQTRLSUIrYzNKN1c3Q25jRithQ2lWQTlrVk
expires=Sat, 01-May-2021 00:40:01 GMT; SameSite=lax; path=/ First set at URL: https://atitudefoods.attingedigital.com.br/login
laravel_session=eyJpdiI6Imd4Vy8zV0F0S1kzenNPYUZjZ3A1eFE9PSIsInZhbHVlIjoiZE9HNE12dlFOT3RHY1Z2RDBzc0lEV1Rwd3FxY0dtWDhqNzJqQlQxSlkvV3BJVUZGQ2hvR1RleHp2YTJlNmo5N
HttpOnly; expires=Sat, 01-May-2021 00:40:01 GMT; SameSite=lax; path=/ First set at URL: https://atitudefoods.attingedigital.com.br/login
__cfduid=d02e91d4f044c1291ea3f424432ccf04d1619822401; secure; HttpOnly; expires=Sun, 30-May-2021 22:40:01 GMT; domain=.onetrust.com; SameSite=Lax; path=/ First set at URL: https://

150101 Third-party Cookies Collected (1)

150101 Third-party Cookies Collected atitudefoods.attingedigital.com.br/login
Unique # 2e0bfe02-07f0-4619-a404-2bfeadb5b919
OWASP -
WASC -
Details
Threat
The cookies listed in the Results section were received from third-party web application(s) during the crawl phase.
Impact
Cookies may contain sensitive information about the user. Cookies sent via HTTP may be sniffed.
Solution
Review cookie values to ensure that sensitive information such as passwords are not present within them.
Results
Total cookies: 2
150126 Links With High Resource Consumption (1)

150126 Links With High Resource Consumption atitudefoods.attingedigital.com.br/login
Unique # ac4f3f6d-052b-4523-a6e6-8a52cf61c4f8
OWASP -
WASC -
Details
Threat
The list of links with lowest bytes/sec which are assumed to be resources with highest resource consumption. The links in the list have slower transfer times
speeds to an average resource on the server. This may indicate that the links are more CPU or DB intensive than majority of links.
The latency of the network and file size have no effect on calculations.
Impact
The links with high resource consumption could be used to perform DOS on the server by just performing GET Flooding. Attackers could more easily take the
server down if there are huge resource hogs on it, performing less request.
Solution

Find the root cause of resources slow download speed.
If the cause is a real CPU strain or complex DB queries performed, there may be a need for re-engineering of the web application or defense measures should be
in place. Examples of defense against DOS that is targeted towards high resource consumption links are Load Balancers and Rate Limiters.
Results
29.300000 bytes/sec https://atitudefoods.attingedigital.com.br/css/app.css

2223.300000 bytes/sec https://atitudefoods.attingedigital.com.br/regulamento
2267.800000 bytes/sec https://atitudefoods.attingedigital.com.br/meus-dados
2332.100000 bytes/sec https://atitudefoods.attingedigital.com.br/mecanica
2376.600000 bytes/sec https://atitudefoods.attingedigital.com.br/desafio
34545.200000 bytes/sec https://atitudefoods.attingedigital.com.br/public/api/auth
36761.300000 bytes/sec https://atitudefoods.attingedigital.com.br/span%5B
37159.700000 bytes/sec https://atitudefoods.attingedigital.com.br/public/_ignition
92278.000000 bytes/sec https://atitudefoods.attingedigital.com.br/assets/css/app.css
2277094.700000 bytes/sec https://atitudefoods.attingedigital.com.br/assets/images/bg.png
150135 HTTP Strict Transport Security (HSTS) header missing or misconfigured (1)
150135 HTTP Strict Transport Security (HSTS) atitudefoods.attingedigital.com.br/login
header missing or misconfigured
Unique # e66a6c1f-5f1c-448a-ba48-bfbf64684baa
OWASP -
WASC -
Details
Threat
HTTP Strict Transport Security (HSTS) header was found to be missing or misconfigured. The HSTS header instructs browsers that all subsequent connections
to the website, for a configurable amount of time, should be performed over a secure (HTTPS) connection only. Additionally, it instructs browsers that users
should not be permitted to bypass SSL/TLS certificate errors, in the event of an expired or otherwise untrusted certificate for example.
Impact
If HSTS header is not set, users are potentially vulnerable to man-in-the-middle (MITM) attacks, SSL stripping, and passive eavesdropper attacks.
Solution
For information about how to implement the HSTS header properly, refer to the OWASP HTTP Strict Transport Security Cheat Sheet.
Results
Strict Transport Security header missing for

150142 Virtual Host Discovered (1)

150142 Virtual Host Discovered atitudefoods.attingedigital.com.br/login
Unique # c184557f-814a-4253-bba5-70a1974cbc37
WASC

Details
Threat
Web server is responding differently when the HOST header is manipulated and various common virtual hosts are tested. This could indicate the presence of
Virtual Host. Virtual hosting is a method for hosting multiple domain names (with separate handling of each name) on a single server (or pool of servers). This
allows one server to share its resources, such as memory and processor cycles, without requiring all services provided to use the same host name. The extra
virtual hosts discovered by the Web application scanner during HOST header manipulation are provided in the Results section.
Impact
The Web application should apply consistent security measures. If the Web application fails to apply security controls to other domains hosted on the same
server, then it may be exposed to vulnerabilities like cross-site scripting, SQL injection, or authorization-based attacks.
Solution
Consult the virtual host configuration and check if this virtual host should be publicly accessible.
Results
Virtual host discovered:
Detected based on: HTTP Response code

Virtual Host: www.atitudefoods.attingedigital.com.br
URI: https://atitudefoods.attingedigital.com.br/

Virtual Host: mail.atitudefoods.attingedigital.com.br

Virtual Host: webmail.atitudefoods.attingedigital.com.br
150204 Missing header: X-XSS-Protection (1)

150204 Missing header: X-XSS-Protection atitudefoods.attingedigital.com.br/login
Unique # a99ea766-9f37-4bf7-9e50-08dffd62c21c
Details
Threat
The X-XSS-Protection response header is not present.
Impact
The X-XSS-Protection response header provides a layer of protection against reflected cross-site scripting (XSS) attacks by instructing browsers to abort
rendering a page in which a reflected XSS attack has been detected. This is a best-effort second line of defense measure which helps prevent an attacker from
using evasion techniques to avoid the neutralization mechanisms that the filters use by default. When configured appropriately, browser-level XSS filters can
provide additional layers of defense against web application attacks.
Note that HTTP 4xx and 5xx responses can also be susceptible to attacks such as XSS. For better security the X-XSS-Protection header should be set on 4xx
and 5xx responses as well.
Solution
It is recommend to set X-XSS-Protection header with value set to '1; mode=block' on all the relevant responses to activate browser's XSS filter.

NOTE: The X-XSS-Protection header is not supported by all browsers. Google Chrome and Safari are some of the browsers which support it, Firefox on the other
hand does not support the header. X-XSS-Protection header does not guarantee a complete protection against XSS. For better protection against XSS attacks,
the web application should use secure coding principles. Also, consider leveraging the Content-Security-Policy (CSP) header, which is supported by all browsers.
Using X-XSS-Protection could have unintended side effects, please understand the implications carefully before using it.
References:
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
- https://blog.innerht.ml/the-misunderstood-x-xss-protection/
- https://www.mbsd.jp/blog/20160407.html
- https://www.chromium.org/developers/design-documents/xss-auditor
Results
X-Xss-Protection: Header missing

Date: Fri, 30 Apr 2021 17:10:09 GMT
Server: Apache
Set-Cookie: XSRF-
Set-Cookie: XSRF-
Set-Cookie:


150245 Missing header: X-Frame-Options (1)

150245 Missing header: X-Frame-Options atitudefoods.attingedigital.com.br/login
Unique # 040a591b-43a8-4677-b19d-ca908bb18d57


Details
Threat
The X-Frame-Options header is not set in the HTTP response, meaning the page can potentially be loaded into an attacker-controlled frame. This could lead to
clickjacking, where an attacker adds an invisible layer on top of the legitimate page to trick users into clicking on a malicious link or taking a harmful action.
Impact
Without an X-Frame-Options response header, clickjacking may be possible. However, if the application properly uses the Content-Security-Policy "frame-
ancestors" directive, then modern web browsers would stop the page from being framed and prevent clickjacking.
Solution
The X-Frame-Options allows three values: DENY, SAMEORIGIN and ALLOW-FROM. It is recommended to use DENY, which prevents all domains from framing
the page or SAMEORIGIN, which allows framing only by the same site. DENY and SAMEORGIN are supported by all browsers. Using ALLOW-FROM is not
recommended because not all browsers support it.
Note: To avoid a common X-Frame-Options implementation mistake, see https://blog.qualys.com/securitylabs/2015/10/20/clickjacking-a-common-implementation-

mistake-that-can-put-your-websites-in-danger.
Results
X-Frame-Options header is missing or not set to DENY or SAMEORIGIN for the following pages:
(Only first 10 such pages are reported)
Response code: 200
Response headers:
Date: Fri, 30 Apr 2021 17:12:00 GMT
Server: Apache
Set-Cookie: XSRF-
TOKEN=eyJpdiI6IlV1MU9jQUlLVFgwRTJicnZpQmJpclE9PSIsInZhbHVlIjoibURzVWpTZGVVQW1VZHJWd0Jra1JndTNxM0pZZURreUJpUFJDamt4R3lvbzArZlZZYkRxcUtPS0h4bXcyUWpueE9jMz
Set-Cookie: XSRF-
TOKEN=eyJpdiI6IlV1MU9jQUlLVFgwRTJicnZpQmJpclE9PSIsInZhbHVlIjoibURzVWpTZGVVQW1VZHJWd0Jra1JndTNxM0pZZURreUJpUFJDamt4R3lvbzArZlZZYkRxcUtPS0h4bXcyUWpueE9jMz
Set-Cookie:
laravel_session=eyJpdiI6InZnYzZEdm5zUHI3YklUMzdjNTRXUmc9PSIsInZhbHVlIjoiYkhIcC81ckgyV2lrZUdUUlhGVzFVdzErZmhEVkdNNGVGeU91dHhubjBvV092K2Rkc3ZoNUQycnhjT1ZpTzROU
laravel_session=eyJpdiI6InZnYzZEdm5zUHI3YklUMzdjNTRXUmc9PSIsInZhbHVlIjoiYkhIcC81ckgyV2lrZUdUUlhGVzFVdzErZmhEVkdNNGVGeU91dHhubjBvV092K2Rkc3ZoNUQycnhjT1ZpTzROU

Appendix
Web Application Details

atitudefoods.attingedigital.com.br/login
Name atitudefoods.attingedigital.com.br/login
ID 341248465
URL https://atitudefoods.attingedigital.com.br/login
Owner Mahesh Channappa (uneve2mc4)
Scope Limit to URL hostname
Tags Pre-Go, Stage

Custom Attributes -


Web Application Report: Target and Filters

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Web Application Report: Target and Filters

Uploaded by

Copyright:

Available Formats

WAS Web Application Report

Web Application Report 01 May 2021

Mahesh Channappa unilever

Target and Filters

Security Risk Web Applications Vulnerabilities Sensitive Contents Information

CONFIDENTIAL AND PROPRIETARY INFORMATION.

CONFIDENTIAL AND PROPRIETARY INFORMATION.

OWASP Top 10 2017 Vulnerabilities

CONFIDENTIAL AND PROPRIETARY INFORMATION.

CVSS V3 Base 5.3 CVSS V3 Temporal5 CVSS V3 Attack Vector Network

Parameter No param has been required for detecting the information.

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Microsoft URL Rewrite Module for IIS

150004 Path-Based Vulnerability atitudefoods.attingedigital.com.br/login New

CVSS V3 Base 5.3 CVSS V3 Temporal5 CVSS V3 Attack Vector Network

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Parameter No param has been required for detecting the information.

Information Disclosure (9)

CVSS V3 Base 6.5 CVSS V3 Temporal6.2 CVSS V3 Attack Vector Network

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Cookie Name(s) laravel_session, XSRF-TOKEN

CVSS V3 Base 6.5 CVSS V3 Temporal6.2 CVSS V3 Attack Vector Network

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Cookie Name(s) XSRF-TOKEN

150124 Clickjacking - Framable Page (1)

CONFIDENTIAL AND PROPRIETARY INFORMATION.

WASC WASC-15 APPLICATION MISCONFIGURATION Times Detected 1

CVSS V3 Base 5.4 CVSS V3 Temporal5.1 CVSS V3 Attack Vector Network

Parameter No param has been required for detecting the information.

CVSS V3 Base 3.1 CVSS V3 Temporal3 CVSS V3 Attack Vector Network

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Cookie Name(s) laravel_session

150162 Use of JavaScript Library with Known Vulnerability (1)

CONFIDENTIAL AND PROPRIETARY INFORMATION.

CVSS V3 Base 6.5 CVSS V3 Temporal5.6 CVSS V3 Attack Vector Network

Parameter No param has been required for detecting the information.

Found on the following pages (only first 10 pages are reported):

150263 Insecure Transport (1)

CONFIDENTIAL AND PROPRIETARY INFORMATION.

150263 Insecure Transport atitudefoods.attingedigital.com.br/login New

CVSS V3 Base 7.6 CVSS V3 Temporal6.6 CVSS V3 Attack Vector Network

More information: Why HTTPS Matters

Parameter No param has been required for detecting the information.

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Date: Fri, 30 Apr 2021 17:10:57 GMT

http://atitudefoods.attingedigital.com.br/ response code: 200

150122 Cookie Does Not Contain The "secure" Attribute (1)

CVSS V3 Base 4.3 CVSS V3 Temporal4.1 CVSS V3 Attack Vector Network

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Cookie Name(s) laravel_session, XSRF-TOKEN

150123 Cookie Does Not Contain The "HTTPOnly" Attribute (1)

CONFIDENTIAL AND PROPRIETARY INFORMATION.

CVSS V3 Base 4.3 CVSS V3 Temporal4.1 CVSS V3 Attack Vector Network

Cookie Name(s) XSRF-TOKEN

150081 X-Frame-Options header is not set (1)

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Finding # 13181222 Severity Potential Vulnerability - Level 1

CVSS V3 Base 5.3 CVSS V3 Temporal4.6 CVSS V3 Attack Vector Network

Note: To avoid a common X-Frame-Options implementation mistake, see https://blog.qualys.com/securitylabs/2015/10/20/clickjacking-a-common-implementation-

Parameter No param has been required for detecting the information.

CONFIDENTIAL AND PROPRIETARY INFORMATION.

Information Gathered (40)

Finding # 4226763 Severity Information Gathered - Level 2