GET Web Application Security Evidence: Broken Authentication and Access Control

⇤ Web Application Security Findings

https://api.bitsighttech.com/ratings/v1/companies/company_guid/findings?risk_vector=web_appsec

Get broken authentication and access control scripting evidence, including:

• Authentication on Insecure Channel
• CMS Administration Portal Exposed
• Cross-Site Request Forgery (CSRF) Mitigations Present

For details specific to Web Application Security, use the ?risk_vector=web_appsec parameter. Other query parameters are listed in GET: Finding Details.

Authentication on Insecure Channel

[assessmentName = authentication_on_insecure_channel]

Example Response

{
  "name": "input",
  "message": "Password input field present in a form on a non-HTTPS page",
  "details": "size=\"5\" name=\"password\" style=\"width:100px\" type=\"password\"",
  "authCategory": "password_on_insecure_channel",

  ⊕ See additional evidences

}

Response Attributes

name

message

details

authCategory

resource

CMS Administration Portal Exposed

[assessmentName = exposed_csm_admin_page]

Example Response

{
  "cms": "Wordpress",
  "location": "url",

  ⊕ See additional evidences

}

Response Attributes

cms

location

Cross-Site Request Forgery (CSRF) Mitigations Present

[assessmentName = cross_site_request_forgery]

Example Response

{
  "documentUrl":"url",
  "name":"input types",
  "value":"string",
  "path":"/html/body#top/header/div/form#quicksearch",
  "message":"Page contains a form that does not include a hidden attribute with a value of 20 characters or more",

  ⊕ See additional evidences
  
}

Response Attributes

documentUrl

name

value

path

message