MCP (Model Context Protocol) configuration files allow specific softwares such as IDEs like Cursor to interact with MCP servers. These files may contain sensitive information which could assist an attack to conduct further attacks.

An NPM debug log file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

A Ruby on Rails configuration file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

Web Applications can sometimes expose web applications users in various places such as HTML comments, JavaScript code or API requests. By leveraging this information, an attacker can gather information and build further attacks against the target application.

Atlassian BitBucket source code repositories can be either private or public, thus allowing any anonymous (unauthentivcated) user to access the project and its content. When this feature is unexpectedly enabled on a private source code repository, a remote and unauthenticated attacker could access sensitive information.

GitHub Actions are a feature from the popular GitHub platform for automating software development workflows directly within a GitHub source code repository. By defining one or more workflows files in the `/.github/` directory of their repositories, developers can customize their applications build workflows.

When exposed with the web application and especially for private repositories workflows, this file can be used by an attacker to gain access to sensitive information.

A SonarQube Public Projects response have been detected on the target web application. These response may contain sensitive information which could assist an attack to conduct further attacks.

A SSH id_rsa file have been detected on the target web application. This key can be used to gain unauthorized access to the server.

A SSH Authorized Keys file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

A Robomongo file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

Sequelize is a promise-based Node.js ORM tool for databases engines. Sequelize CLI uses by default a configuration file in 'config' directory to store the environment and database information. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access to one or multiple components of the web application.

Most of the web applications rely on a database to provide features to their users. In secure designs, consuming these private or cloud databases will require authentication like username and password based credentials.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain privileged access to critical services used by the web application and the organization.

A web server configuration file has been detected on the target host. This may expose privileged information or configurations to a malicious actor.

Node-config is a Node.js module providing hierarchical configurations to help with web applications deployments. By defining one or more configuration files in their application project 'config' directory or in a custom location, developers can define various configuration variables to be used in the different application environments.

By accessing an exposed configuration file, an attacker could leverage the vulnerability to gain unauthorized access to sensitive information.

Microsoft Active Directory Federation Services (ADFS) is a very popular Single Sign On (SSO) feature offering identity federation to organizations. An ADFS server can be configured to show a login page to connect to corporate applications directly from this Identity Provider (IdP). When enabled, this web page will disclose all the SAML configured applications. By leveraging this information, a remote and unauthenticated attacker can gather additional information on the target organization assets to conduct further attacks.

Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private or cloud services will require authentication like API and private keys, username and password based credentials and similar sensitive data.

Developers sometimes hard code such data in various places of their applications, without realizing that it could become publicly available in client-side JavaScript or, for example, HTML comments. By leveraging these sensitive information, a remote and unauthenticated attacker could gain privileged access to critical services used by the web application and the organization.

Windows New Technology LAN Manager (NTLM) is a suite of Microsoft security protocols designed to offer authentication, integrity and confidentiality to users. In Windows environments, NTLM authentication is often supported over HTTP in order to protect access to specific resources. During the protocol negotation phase, the clients and the server exchange multiple encoded challenge-response messages.

By sending a fake NTLM authentication request, a remote server supporting this protocol will response with a NTLMSSP message and disclose information including NetBIOS, DNS and OS build version. By leveraging these information, an attacker could try conducting further attacks on the target environment.

WPengine is a popular provider of managed WordPress hosting. Configurations may be located in a file named config.json inside the _wpeprivate hidden directory. This configuration file may expose sensitive information such as database credentials and WPEngine account information which may be used by an attacker to gain unauthorized access.

Prometheus is an open-source monitoring solution which is designed to record metrics in a dimensional data model to make it available through its own PromQL query language or built-in visualization capabilities. Prometheus offer multiple libraries (named 'Exporters') to help exporting these endpoints and make it available to third-party tools. When publicly exposed, a remote and unauthenticated attacker could leverage the data to understand the target application environment and try conducting further attack.

A Hong Kong Identity Number (HKID number) is a personally identifiable number that is allocated during the issuance of a Honk Kong Identity Card. A stolen or leaked HKID number can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an HKID number located within the response of the affected page

HTML comments are often used by developers to include information related to the application inline, which are ignored by a clients browser during rendering. These comments may include sensitive information such as SQL queries, credentials or internal IP for example.

Pprof is a tool for visualization and analysis of profiling data. Output files may be located inside a hidden directory named debug/pprof/ & When exposed with the web application configuration, the files contained in this directory may expose sensitive information such as internal memory addresses, configuration, filesystem information and resource consumption which may be of use to external attackers.

Visual Studio Code is a popular source-code editor provided by Microsoft, with extensions offering a variety of extra functionality including remote workspace access via ssh. Use of this remote workflow creates a hidden directory named .vscode-server on the remote server which may be exposed with the web application configuration and can contain files, technologies and versions, user activity, binaries, scripts and other potentially sensitive information. This may be used to further facilitate attacks against the server.

AppVeyor is a continuous integration and deployment service available as a Software as a Service (SaaS) based application or as a private instance and which is used to build and test software projects. By defining a configuration file named `appveyor.yml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Composer is a tool used for dependency management in PHP. It allows developers to declare the libraries their web application depends on and to manage it for them. PHP packages can be hosted on a private Composer repository, requiring authentication in order to interact with it.

When exposed, Composer private repository credentials could allow an attacker to gain read and write access to this repository, leading to to sensitive information disclosure (source code, potential hardcoded credentials...). An attacker could also leverage these credentials to conduct supply chain attacks by compromising private packages and delivering malicious code to web applications requiring it.

Web applications usually rely on backend database servers to store persistent information like users, sessions or for example products of an e-commerce website. In some cases, these web applications may fail to properly handle potential errors raised when querying the database, displaying raw errors or stack traces.

Exposed information may leak sensitive information (for example session tokens used in a statement) or help an attacker conducting further attacks like SQL injections.

A Microsoft Access Database file has been detected on the target host. This may expose privileged information or configurations to a malicious actor.

Phinx is an open-source PHP software designed to help developers to quickly create and maintain their SQL databases migrations through PHP code. Phinx uses a configuration file in the project root directory to store the environment and database information. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access to one or multiple components of the web application.

A European Personal Data Number (EPDN) is a personally identifiable number that is issued to a citizen of one of the members or ex-members of the European Union. A stolen or leaked EPDN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an EPDN located within the response of the affected page

The web server on the remote host allows read access to a Mercurial repository metadata directory. This access may be abused to access content from the web server that might otherwise be private.

ASP.NET Core applications can read configuration data based on key-value pairs from multiple providers and sources. By using the JSON configuration provider, data can be retrieved from predictable configuration files named `appsettings.json` and `appSettings.{Environment}.json`.

Developers sometimes store secrets or other sensitive information in these configuration files. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access to one or multiple components of the web application.

The web server on the remote host contains publicly accessible Wget listing files. These listing files are produced by Wget during ftp transfers and contain details of source/destination file names, permissions, date of upload and other potentially sensitive information. This may be used to access content from the web server that might otherwise be private.

SQL files have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks.

Visual Studio Code is a popular source-code editor provided by Microsoft, with extensions offering a variety of extra functionality covering amongst others remote file access, credentials and launch configurations. Configurations may be located inside a hidden directory named .vscode. When exposed with the web application configuration, these configuration files may expose sensitive information which may be used by an attacker to gain unauthorized access.

Docker Compose is a tool designed to help developers defining and running multi-container Docker applications. By defining a configuration file named `docker-compose.yml` in their application project directory, developers can define the different services used by the application with their configurations.

By accessing an exposed `docker-compose.yml` file, an attacker could leverage the vulnerability to gain unauthorized access to sensitive information.

HashiCorp Vagrant is an open-source software designed to help developers building and maintaining portable virtual software development environments. By defining a file named `Vagrantfile`, developers can describe the configuration of these environments and how to provision them.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Cloud Build is Google Cloud continuous integration and deployment serverless platform used to build and test software projects. By defining a configuration file named `cloudbuild.yaml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Amazon Web Services (AWS) is a public cloud provider offering different hosting services for their customers. Amazon Web Services can be accessed through programmatic calls to their API by authenticating with access keys, which are a combination of both an access key ID and a secret access key. Temporary security credentials, which rely on an additional security token, can also be issued to grant users access to AWS resources for a short period of time.

By using leaked AWS credentials or abusing credentials with misconfigured permissions, an attacker could try to gain access to sensitive information on the AWS account or perform arbitrary modification on the AWS resources.

Programming languages are often used along with package management tools designed to help developers manages the code dependencies when building their web applications (for example : Composer for PHP, NPM for NodeJS, PIP for Python...). These tools usually work by requesting public code repositories in order to fetch the dependencies and help installing and using specific versions in the project.

When package configuration files are exposed, an attacker could use it to infer the software components used in the target application and to try conduct further attacks.

Travis CI is a Software as a Service (SaaS) based continuous integration service used to build and test software projects. By defining a configuration file named `.travis.yml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Google Cloud resources access control is managed through the Identify and Access Management (IAM) feature which helps defining the different roles and permissions available to authenticated principals. Principals include Google accounts for end users and service accounts which purpose is to be used by applications and compute workloads.

Service accounts rely on RSA key pairs for authentication against Google Cloud APIs and access the resources, which, when exposed, could be used by an attacker to gain access to sensitive information or to perform arbitrary modification on the related cloud resources.

CircleCI is a continuous integration service available as a Software as a Service (SaaS) based application or as a private instance and which is used to build and test software projects. By defining a configuration file named `.circleci/config.yml` in their source code repositories, developers can customize their applications build workflows.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

GitLab is a popular Git-based Source Code Management system (SCM) provided by GitLab Inc. as both a cloud and an on-premise service. GitLab has Continuous Integration and Continuous Development (CI/CD) capabilities offering automatic builds, tests and deployments through a configuration file named `.gitlab-ci.yml`.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Bitbucket is a popular Git-based Source Code Management system (SCM) provided by Atlassian as both a cloud and an on-premise service. Bitbucket Pipelines is an integrated Continuous Integration and Continuous Development (CI/CD) feature of Bitbucket, offering automatic builds, tests and deployments through a configuration file named `bitbucket-pipelines.yml`.

When exposed with the web application, this file can be used by an attacker to gain access to sensitive information.

Jenkins is a popular open source automation software used to help building, testing and deploying software. Jenkins Pipeline is a collection of plugins allowing developers to implement and integrate continuous delivery (CD) into Jenkins, by defining a `Jenkinsfile` file and adding it to their source control manager (SCM). When exposed, this file can be used by an attacker to gain access to sensitive information.

Azure Functions is a public cloud service from Microsoft providing a serverless computing platform which supports various programming languages (C#, Python, JavaScript...).

Before deploying their functions to the cloud, developers often write and test their code in their local development environment. Azure development tools use settings and sometimes secrets variables stored in a file named `local.settings.json`, which, when exposed, can be used by an attacker to gain access to sensitive information.

AWS Elastic Beanstalk is a Platform-as-a-Service (PaaS) feature provided by Amazon Web Services which allows developers to quickly deploy their web applications in various predefined environments (Java, .NET, PHP...) without managing the underlying infrastructure configuration. AWS Elastic Beanstalk also allows the deployment of Docker images based applications by using a specific JSON file named `Dockerrun.aws.json` which, when exposed, can be used by an attacker to gain access to sensitive information.

Google APIs support the OAuth 2.0 protocol for authentication and authorization in different deployment scenarios. In order to gain access to Google APIs and in some scenarios, the client application has to authenticate itself against the Google authorization servers by using credentials such as a client ID and a client secret and then retrieve a valid access token.

In the context of web server applications, the OAuth 2.0 secret used to retrieve the token is sensitive and, if leaked with the client ID, can lead to an attacker impersonating the vulnerable application and performing arbitrary requests against Google APIs.

Docker is one of the most popular platform using virtualization at the operating system level to deliver software in packages called containers. To take advantage of cloud based infrastructures, developers often build their applications on top of the microservices architecture pattern with one or multiple Docker containers, helping them to quickly build and deploy it to various environments.

Docker containers are based on a `Dockerfile` file describing the different steps to build the application and containing sometimes hardcoded secrets or other sensitive information. By accessing an exposed `Dockerfile`, an attacker could leverage the vulnerability to gain unauthorized access to one or multiple web application components.

The web server on the remote host contains publicly accessible FTP configuration files. These configuration files are produced by ftp software and contain details of ftp credentials and/or hosts and other potentially sensitive information. This may be used to access content from the FTP server that might otherwise be private.

ID	Name	Severity
114803	MCP Client Configuration File Detected	medium
114780	NPM Debug Log File Detected	medium
114779	Rails Config File Detected	high
114615	Username Disclosure	low
114569	Atlassian BitBucket Public Repository Detected	medium
114568	GitHub Workflow Detected	medium
114468	SonarQube Public Projects Detected	info
114465	SSH id_rsa File Detected	critical
114464	SSH Authorized Keys File Detected	medium
114463	Robomongo File Detected	high
114428	Sequelize Configuration File Detected	medium
114276	Database Connection String Disclosure	high
114195	Web Server Configuration File Detected	medium
114143	Node-config Configuration File Detected	medium
114142	ADFS Relying Party Trusts Disclosure	medium
114129	Secret Data Disclosure	high
114115	HTTP NTLM Information Disclosure	medium
114091	WordPress WPEngine Configuration Detected	medium
114012	Prometheus Sensitive Endpoint Detected	medium
113943	Disclosed Hong Kong Identity Number	medium
113897	HTML Comments Detected	info
113892	Pprof Debug Files Detected	medium
113850	Visual Studio Code Server Files Detected	medium
113578	AppVeyor Configuration Detected	medium
113556	Composer Repository Credentials Disclosure	high
113555	SQL Statement Disclosure	medium
113448	Microsoft Access Database Detected	medium
113433	Phinx Configuration File Detected	medium
113430	Disclosed European Personal Data Number	medium
113372	Mercurial Repository Detected	medium
113228	ASP.NET Core Configuration File Detected	medium
113227	Wget Listing File Detected	medium
113213	SQL File Detected	medium
113201	Visual Studio Code Configuration Detected	medium
113168	Docker Compose Configuration Detected	medium
113167	HashiCorp Vagrant Configuration Detected	medium
113166	Google Cloud Build Configuration Detected	medium
113164	AWS Credentials Disclosure	medium
113158	Package Dependencies Detected	medium
113156	Travis CI Configuration Detected	medium
113150	Google Cloud Service Account Private Key Disclosure	high
113157	CircleCI Configuration Detected	medium
113142	GitLab CI Configuration Detected	medium
113141	Atlassian Bitbucket Pipelines Configuration Detected	medium
113140	Jenkinsfile Detected	medium
113139	Azure Functions Local Settings Detected	medium
113125	AWS Elastic Beanstalk Dockerrun Detected	medium
113124	Google API OAuth Credentials Detected	high
113123	Dockerfile Detected	medium
113080	FTP Credentials Disclosure	medium

Detections

Analytics

Data Exposure Family for Web App Scanning

medium

medium

high

low

medium

medium

info

critical

medium

high

medium

high

medium

medium

medium

high

medium

medium

medium

medium

info

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

high

medium

medium