Private keys are cryptographic credentials used for secure communications in protocols like SSL/TLS, SSH, and JWT signing. If exposed, an attacker can impersonate the server, decrypt sensitive communications, or forge authentication tokens to gain unauthorized access to systems and data.

Next.js is a popular React framework for building web applications. By default, Next.js applications may include a configuration file named next.config.js, which contains various settings and options for the application. If this configuration file is accessible via the web server, it can expose sensitive information about the application's structure, environment variables, and other configurations that could be exploited by attackers.

Behat is a Behavior Driven Development (BDD) framework for PHP. It allows the execution of feature documentation written in business-facing text. Behat uses a configuration file named behat.yml to set up various options and parameters for running tests.

The presence of the behat.yml configuration file on a web server may expose sensitive information, such as database credentials, API keys, or other configuration details that could be exploited by an attacker.

Kubernetes is an open-source container orchestration platform used to automate the deployment, scaling, and management of containerized applications. Kubernetes configuration files, such as YAML manifests, define resources like Deployments, Services, ConfigMaps, and Secrets.\n\nWhen exposed with the web application, these configuration files can be used by an attacker to gain access to sensitive information, including cluster architecture details, environment variables, and potentially secrets or credentials.

Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private or cloud services will require authentication like API and private keys, username and password based credentials and similar sensitive data.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain access to an external AI service used by the web application and the organization.

This is an informational notice that the scanner was able to detect forms with fields collecting Personal Identifying Information (PII) data. Examples of PII data include, but are not limited to, names, email addresses, phone numbers, social security numbers, and financial information.

This is an informational plugin to inform the user that the scanner has detected a UUID/GUID version 1.

UUID/GUID version 1 contains the MAC address of the computer that generated it, as well as a timestamp. This means that if an attacker can obtain a UUID/GUID version 1, they can infer host identity and generation time, and-because v1 embeds largely deterministic fields predict other identifiers generated around the same time (e.g., by enumerating timestamps/clock sequence). This enables correlation, enumeration, and token-guessing attacks when v1 is used for security-sensitive values.

The scanner has detected a potential user enumeration vulnerability in the web application. This vulnerability allows an attacker to determine valid usernames by observing the application's responses.

MCP (Model Context Protocol) configuration files allow specific softwares such as IDEs like Cursor to interact with MCP servers. These files may contain sensitive information which could assist an attack to conduct further attacks.

An NPM debug log file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

A Ruby on Rails configuration file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

Web Applications can sometimes expose web applications users in various places such as HTML comments, JavaScript code or API requests. By leveraging this information, an attacker can gather information and build further attacks against the target application.

Atlassian BitBucket source code repositories can be either private or public, thus allowing any anonymous (unauthentivcated) user to access the project and its content. When this feature is unexpectedly enabled on a private source code repository, a remote and unauthenticated attacker could access sensitive information.

GitHub Actions are a feature from the popular GitHub platform for automating software development workflows directly within a GitHub source code repository. By defining one or more workflows files in the `/.github/` directory of their repositories, developers can customize their applications build workflows.

When exposed with the web application and especially for private repositories workflows, this file can be used by an attacker to gain access to sensitive information.

A SonarQube Public Projects response have been detected on the target web application. These response may contain sensitive information which could assist an attack to conduct further attacks.

A SSH id_rsa file have been detected on the target web application. This key can be used to gain unauthorized access to the server.

A SSH Authorized Keys file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

A Robomongo file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

Sequelize is a promise-based Node.js ORM tool for databases engines. Sequelize CLI uses by default a configuration file in 'config' directory to store the environment and database information. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access to one or multiple components of the web application.

Most of the web applications rely on a database to provide features to their users. In secure designs, consuming these private or cloud databases will require authentication like username and password based credentials.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain privileged access to critical services used by the web application and the organization.

A web server configuration file has been detected on the target host. This may expose privileged information or configurations to a malicious actor.

Node-config is a Node.js module providing hierarchical configurations to help with web applications deployments. By defining one or more configuration files in their application project 'config' directory or in a custom location, developers can define various configuration variables to be used in the different application environments.

By accessing an exposed configuration file, an attacker could leverage the vulnerability to gain unauthorized access to sensitive information.

Microsoft Active Directory Federation Services (ADFS) is a very popular Single Sign On (SSO) feature offering identity federation to organizations. An ADFS server can be configured to show a login page to connect to corporate applications directly from this Identity Provider (IdP). When enabled, this web page will disclose all the SAML configured applications. By leveraging this information, a remote and unauthenticated attacker can gather additional information on the target organization assets to conduct further attacks.

Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private services will require authentication like API and private keys, username and password based credentials and similar sensitive data.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain privileged access to critical services used by the web application and the organization or to conduct password spraying attacks.

Windows New Technology LAN Manager (NTLM) is a suite of Microsoft security protocols designed to offer authentication, integrity and confidentiality to users. In Windows environments, NTLM authentication is often supported over HTTP in order to protect access to specific resources. During the protocol negotation phase, the clients and the server exchange multiple encoded challenge-response messages.

By sending a fake NTLM authentication request, a remote server supporting this protocol will response with a NTLMSSP message and disclose information including NetBIOS, DNS and OS build version. By leveraging these information, an attacker could try conducting further attacks on the target environment.

WPengine is a popular provider of managed WordPress hosting. Configurations may be located in a file named config.json inside the _wpeprivate hidden directory. This configuration file may expose sensitive information such as database credentials and WPEngine account information which may be used by an attacker to gain unauthorized access.

Prometheus is an open-source monitoring solution which is designed to record metrics in a dimensional data model to make it available through its own PromQL query language or built-in visualization capabilities. Prometheus offer multiple libraries (named 'Exporters') to help exporting these endpoints and make it available to third-party tools. When publicly exposed, a remote and unauthenticated attacker could leverage the data to understand the target application environment and try conducting further attack.

A Hong Kong Identity Number (HKID number) is a personally identifiable number that is allocated during the issuance of a Honk Kong Identity Card. A stolen or leaked HKID number can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an HKID number located within the response of the affected page

HTML comments are often used by developers to include information related to the application inline, which are ignored by a clients browser during rendering. These comments may include sensitive information such as SQL queries, credentials or internal IP for example.

Pprof is a tool for visualization and analysis of profiling data. Output files may be located inside a hidden directory named debug/pprof/ & When exposed with the web application configuration, the files contained in this directory may expose sensitive information such as internal memory addresses, configuration, filesystem information and resource consumption which may be of use to external attackers.

Visual Studio Code is a popular source-code editor provided by Microsoft, with extensions offering a variety of extra functionality including remote workspace access via ssh. Use of this remote workflow creates a hidden directory named .vscode-server on the remote server which may be exposed with the web application configuration and can contain files, technologies and versions, user activity, binaries, scripts and other potentially sensitive information. This may be used to further facilitate attacks against the server.

AppVeyor is a continuous integration and deployment service available as a Software as a Service (SaaS) based application or as a private instance and which is used to build and test software projects. By defining a configuration file named `appveyor.yml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Composer is a tool used for dependency management in PHP. It allows developers to declare the libraries their web application depends on and to manage it for them. PHP packages can be hosted on a private Composer repository, requiring authentication in order to interact with it.

When exposed, Composer private repository credentials could allow an attacker to gain read and write access to this repository, leading to to sensitive information disclosure (source code, potential hardcoded credentials...). An attacker could also leverage these credentials to conduct supply chain attacks by compromising private packages and delivering malicious code to web applications requiring it.

Web applications usually rely on backend database servers to store persistent information like users, sessions or for example products of an e-commerce website. In some cases, these web applications may fail to properly handle potential errors raised when querying the database, displaying raw errors or stack traces.

Exposed information may leak sensitive information (for example session tokens used in a statement) or help an attacker conducting further attacks like SQL injections.

A Microsoft Access Database file has been detected on the target host. This may expose privileged information or configurations to a malicious actor.

Phinx is an open-source PHP software designed to help developers to quickly create and maintain their SQL databases migrations through PHP code. Phinx uses a configuration file in the project root directory to store the environment and database information. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access to one or multiple components of the web application.

A European Personal Data Number (EPDN) is a personally identifiable number that is issued to a citizen of one of the members or ex-members of the European Union. A stolen or leaked EPDN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an EPDN located within the response of the affected page

The web server on the remote host allows read access to a Mercurial repository metadata directory. This access may be abused to access content from the web server that might otherwise be private.

ASP.NET Core applications can read configuration data based on key-value pairs from multiple providers and sources. By using the JSON configuration provider, data can be retrieved from predictable configuration files named `appsettings.json` and `appSettings.{Environment}.json`.

Developers sometimes store secrets or other sensitive information in these configuration files. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access to one or multiple components of the web application.

The web server on the remote host contains publicly accessible Wget listing files. These listing files are produced by Wget during ftp transfers and contain details of source/destination file names, permissions, date of upload and other potentially sensitive information. This may be used to access content from the web server that might otherwise be private.

SQL files have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

Visual Studio Code is a popular source-code editor provided by Microsoft, with extensions offering a variety of extra functionality covering amongst others remote file access, credentials and launch configurations. Configurations may be located inside a hidden directory named .vscode. When exposed with the web application configuration, these configuration files may expose sensitive information which may be used by an attacker to gain unauthorized access.

Docker Compose is a tool designed to help developers defining and running multi-container Docker applications. By defining a configuration file named `docker-compose.yml` in their application project directory, developers can define the different services used by the application with their configurations.

By accessing an exposed `docker-compose.yml` file, an attacker could leverage the vulnerability to gain unauthorized access to sensitive information.

HashiCorp Vagrant is an open-source software designed to help developers building and maintaining portable virtual software development environments. By defining a file named `Vagrantfile`, developers can describe the configuration of these environments and how to provision them.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Cloud Build is Google Cloud continuous integration and deployment serverless platform used to build and test software projects. By defining a configuration file named `cloudbuild.yaml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Programming languages are often used along with package management tools designed to help developers manages the code dependencies when building their web applications (for example : Composer for PHP, NPM for NodeJS, PIP for Python...). These tools usually work by requesting public code repositories in order to fetch the dependencies and help installing and using specific versions in the project.

When package configuration files are exposed, an attacker could use it to infer the software components used in the target application and to try conduct further attacks.

Travis CI is a Software as a Service (SaaS) based continuous integration service used to build and test software projects. By defining a configuration file named `.travis.yml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

CircleCI is a continuous integration service available as a Software as a Service (SaaS) based application or as a private instance and which is used to build and test software projects. By defining a configuration file named `.circleci/config.yml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

GitLab is a popular Git-based Source Code Management system (SCM) provided by GitLab Inc. as both a cloud and an on-premise service. GitLab has Continuous Integration and Continuous Development (CI/CD) capabilities offering automatic builds, tests and deployments through a configuration file named `.gitlab-ci.yml`.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

ID	Name	Severity
115111	Private Key File Detected	high
115098	Next.js Configuration File Detected	medium
115092	Behat Configuration File Detected	medium
115079	Kubernetes Configuration Detected	medium
115063	AI Service Secret Disclosure	high
115062	Third-Party Service Secret Disclosure	high
114966	Personal Identifying Information (PII) Fields Detected	info
114948	UUID/GUID Version 1 Detected	info
114947	User Enumeration	medium
114803	MCP Client Configuration File Detected	medium
114780	NPM Debug Log File Detected	medium
114779	Rails Config File Detected	high
114615	Username Disclosure	low
114569	Atlassian BitBucket Public Repository Detected	medium
114568	GitHub Workflow Detected	medium
114468	SonarQube Public Projects Detected	info
114465	SSH id_rsa File Detected	critical
114464	SSH Authorized Keys File Detected	medium
114463	Robomongo File Detected	high
114428	Sequelize Configuration File Detected	medium
114276	Database Connection String Disclosure	high
114195	Web Server Configuration File Detected	medium
114143	Node-config Configuration File Detected	medium
114142	ADFS Relying Party Trusts Disclosure	medium
114129	Generic Secret Disclosure	high
114115	HTTP NTLM Information Disclosure	medium
114091	WordPress WPEngine Configuration Detected	medium
114012	Prometheus Sensitive Endpoint Detected	medium
113943	Disclosed Hong Kong Identity Number	medium
113897	HTML Comments Detected	info
113892	Pprof Debug Files Detected	medium
113850	Visual Studio Code Server Files Detected	medium
113578	AppVeyor Configuration Detected	medium
113556	Composer Repository Credentials Disclosure	high
113555	SQL Statement Disclosure	medium
113448	Microsoft Access Database Detected	medium
113433	Phinx Configuration File Detected	medium
113430	Disclosed European Personal Data Number	medium
113372	Mercurial Repository Detected	medium
113228	ASP.NET Core Configuration File Detected	medium
113227	Wget Listing File Detected	medium
113213	SQL File Detected	medium
113201	Visual Studio Code Configuration Detected	medium
113168	Docker Compose Configuration Detected	medium
113167	HashiCorp Vagrant Configuration Detected	medium
113166	Google Cloud Build Configuration Detected	medium
113158	Package Dependencies Detected	medium
113156	Travis CI Configuration Detected	medium
113157	CircleCI Configuration Detected	medium
113142	GitLab CI Configuration Detected	medium

Detections

Analytics

Data Exposure Family for Web App Scanning

high

medium

medium

medium

high

high

info

info

medium

medium

medium

high

low

medium

medium

info

critical

medium

high

medium

high

medium

medium

medium

high

medium

medium

medium

medium

info

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium