1	Input Hostname	awasaf.com
2	Scan Start Time	March 11, 2026, 7:04 p.m.
3	Scan Duration	100.35s
4	Total Test Cases	50

1	Target URL	https://awasaf.com/
2	IP Address	195.35.20.171
3	Hosting Provider	Hostinger
4	Registrar	Not Available
5	Programming Language	Not Detected
6	Web Server	nginx/1.18.0 (ubuntu)
7	Operating System	Linux
8	HTTPS Enabled	Enabled
9	WAF Detected	Not Detected

Inline Connection	Yes
IP Address	195.35.20.171
Hosting Provider	Hostinger
Server	nginx/1.18.0 (ubuntu)
Server Disclosure CVE	Vulnerable Asset nginx-1.18.0 CVE-2009-3896 CWE-119 CVSS v3 5.0 MEDIUM src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. Published: 2009-11-24T17:30:00 CVE-2009-3898 CWE-22 CVSS v3 4.9 MEDIUM Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method. Published: 2009-11-24T17:30:00
Operating System	Linux
Open Ports	3306, 443
Database Technology	Not Detected
WAF Detection	Not Detected
SSL Certificate	Certificate is valid

CMS	Not Detected
CMS CVE	Not Applicable
Programming Language	Not Detected
Technology Disclosure CVE	None
Javascript Libraries	bootstrap {'version': '5.1.3', 'source': '/static/front/assets/js/bootstrap.min.js'}
Javascript Libraries CVE	Vulnerable Asset bootstrap-5.1.3 CVE-2018-14040 CWE-79 CVSS v3 6.1 MEDIUM In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. Published: 2018-07-13T14:29:00 CVE-2018-14041 CWE-79 CVSS v3 6.1 MEDIUM In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. Published: 2018-07-13T14:29:00 CVE-2018-14042 CWE-79 CVSS v3 6.1 MEDIUM In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. Published: 2018-07-13T14:29:00 CVE-2016-10735 CWE-79 CVSS v3 6.1 MEDIUM In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. Published: 2019-01-09T05:29:00
Openapi Disclosure	Not Found
XML RPC Endpoint Detection	Not Applicable

Mixed Content Analysis	Mixed content (HTTP on HTTPS)
Secure Connection	Enabled
Unencrypted Viewstate	Not Detected

Securitys	CONTENT-SECURITY-POLICY, X-PERMITTED-CROSS-DOMAIN
Content Security Policy	Missing Content-Security-Policy header
Strict Transport Security	Present
Referrer Policy	Present
X Content Type Options	Present
CSP Analysis	Properly Configured
X Frame Options	Properly Configured
X XSS Protection	Properly Configured

Missing HTTPonly Flag In Cookies	Missing HttpOnly flag in cookies
Missing Secure Flag In Cookies	Missing Secure flag in cookies
Loose Cookie Domain	Secure

Directory Listing	Disabled
Secret Files Detection	['https://awasaf.com/sitemap.xml']
Robots Txt File Found	None
Path Disclosure	Not Found
Htaccess Exposure	None

Passwords Submitted Unencrypted	Passwords submitted unencrypted
Password Leakage	Not Detected
Password Field With Autocomplete	url autocomplete evidence https://awasaf.com/user/login/ Not Set <input class="form-control" name="login[password]" placeholder="Enter your password" required="" type="password"/>

Error Messages Analysis	Secure
Cross Domain Inclusion	['cdn.tailwindcss.com', 'www.googletagmanager.com', 'cdn.jsdelivr.net']

HTTP Methods Allowed	GET, OPTIONS, HEAD
Enabled Debug Method	No
Enabled Options Method	Yes
File Upload	Not Detected
Client Access Policies	Not Found

Email Extraction	Emails exposed
SPF	v=spf1 include:_spf.mail.hostinger.com ~all
DMARC	v=DMARC1; p=none
DKIM	Not Configured

Rate Limit Headers

Missing Rate Limit header

Host Header Injection

Possible

Captcha Detection

Not Detected

Registrar

None

CSRF	Issue Endpoint Severity csrf https://awasaf.com/job/cyber-security-trainer/ High csrf https://awasaf.com/tools/security-headers-test/ High csrf https://awasaf.com/tools/malicious-url-test/ High csrf https://awasaf.com/blog/category/hacking/ High csrf https://awasaf.com/tools/malicious-ip-test/ High csrf https://awasaf.com/ High csrf https://awasaf.com/service/details/web-development-training/ High csrf https://awasaf.com/about-us/ High csrf https://awasaf.com/contact-us/ High csrf https://awasaf.com/privacy-policy/ High csrf https://awasaf.com/blog/category/cloud-security/ High csrf https://awasaf.com/service/details/cyber-security-training/ High csrf https://awasaf.com/tools/ High csrf https://awasaf.com/pricing/ High csrf https://awasaf.com/tools/reconnaissance/ High csrf https://awasaf.com/terms-&-conditions/ High csrf https://awasaf.com/blog/category/url-filtering/ High csrf https://awasaf.com/shipping-policy/ High csrf https://awasaf.com/career/ High csrf https://awasaf.com/blogs/ High csrf https://awasaf.com/blog/url-based-filtering-of-domains-and-its-impact-on-cloud-security/ High csrf https://awasaf.com/tools/ssl-security-test/ High csrf https://awasaf.com/tools/website-security-test/?url=satindersartaaj.com High csrf https://awasaf.com/refund-policy/ High csrf https://awasaf.com/blog/category/shadow-IT/ High csrf https://awasaf.com/blog/category/cyber-security/ High csrf https://awasaf.com/blog/understanding-security-headers-their-impact-and-mitigations/ High csrf https://awasaf.com/blog/understanding-shadow-it-and-saas-applications/ High csrf https://awasaf.com/blog/category/application-security/ High csrf https://awasaf.com/services/ High csrf https://awasaf.com/user/signup/ High csrf https://awasaf.com/user/login/ High csrf https://awasaf.com/tools/website-security-test/ High csrf https://awasaf.com/user/logout/ High csrf https://awasaf.com/tools/wordpress-test/ High csrf https://awasaf.com/service/details/digital-marketing-training/ High
SQLi Boolean Based	Issue Endpoint Severity Parameter sqli - boolean_based https://awasaf.com/user/signup/ Critical password2 sqli - boolean_based https://awasaf.com/user/signup/ Critical password1 sqli - boolean_based https://awasaf.com/user/login/ Critical username sqli - boolean_based https://awasaf.com/career/ Critical category sqli - boolean_based https://awasaf.com/career/ Critical employment_type sqli - boolean_based https://awasaf.com/user/signup/ Critical username sqli - boolean_based https://awasaf.com/career/ Critical experience_level sqli - boolean_based https://awasaf.com/career/ Critical search sqli - boolean_based https://awasaf.com/job/cyber-security-trainer/apply/ Critical phone sqli - boolean_based https://awasaf.com/tools/website-security-test/?url=satindersartaaj.com Critical username sqli - boolean_based https://awasaf.com/user/login/ Critical login[password]
SQLi Time Based	Issue Endpoint Severity Parameter sqli - time_based https://awasaf.com/tools/malicious-ip-test/ Info ip sqli - time_based https://awasaf.com/tools/malicious-url-test/ Info url sqli - time_based https://awasaf.com/tools/security-headers-test/ Info value sqli - time_based https://awasaf.com/tools/security-headers-test/ Info url

Sr. No	Vulnerability Source	CVE ID	Severity	Score	Description	Remediation
6	nginx-1.18.0 - CVE-2009-3896	CVE-2009-3896	Medium	5.0	src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.	Apply latest security patches.
7	nginx-1.18.0 - CVE-2009-3898	CVE-2009-3898	Medium	4.9	Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.	Apply latest security patches.
8	bootstrap-5.1.3 - CVE-2018-14040	CVE-2018-14040	Medium	6.1	In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.	Apply latest security patches.
9	bootstrap-5.1.3 - CVE-2018-14041	CVE-2018-14041	Medium	6.1	In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.	Apply latest security patches.
10	bootstrap-5.1.3 - CVE-2018-14042	CVE-2018-14042	Medium	6.1	In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.	Apply latest security patches.
11	bootstrap-5.1.3 - CVE-2016-10735	CVE-2016-10735	Medium	6.1	In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.	Apply latest security patches.

Sr. No	Vulnerability Source	CWE ID	Severity	Description	Remediation
1	Mixed content (HTTP on HTTPS)	CWE-319	High	Sensitive information may be sent over unencrypted channels when HTTP assets load on an HTTPS page.	Ensure all assets (JS, CSS, images) load using HTTPS only.
2	Passwords submitted unencrypted	CWE-319	High	Credentials transmitted without encryption can be intercepted.	Use HTTPS-only forms and ensure encrypted transport of all authentication data.
3	Missing Content-Security-Policy header	CWE-693	High	Failure to enforce mechanisms that protect against unauthorized modifications such as XSS or content injection.	Implement a strong Content-Security-Policy header such as: "Content-Security-Policy: default-src 'self'; script-src 'self'".
4	Missing HttpOnly flag in cookies	CWE-1004	High	Cookies accessible by JavaScript can be stolen via XSS.	Set the HttpOnly flag to prevent client-side script access.
5	Missing Secure flag in cookies	CWE-614	High	Cookies without the Secure flag may be sent over unencrypted connections.	Enable the Secure flag for all session or sensitive cookies.
12	Missing Rate Limit header	CWE-770	Medium	Improper control of resource consumption may enable brute-force or DoS attacks.	Implement rate limiting and add headers such as 'X-RateLimit-Limit' and 'Retry-After'.
13	Missing Header: CONTENT-SECURITY-POLICY	CWE-693	Low	The security header CONTENT-SECURITY-POLICY is missing.	Add CONTENT-SECURITY-POLICY header to server configuration.
14	Missing Header: X-PERMITTED-CROSS-DOMAIN	CWE-693	Low	The security header X-PERMITTED-CROSS-DOMAIN is missing.	Add X-PERMITTED-CROSS-DOMAIN header to server configuration.
15	Emails exposed	CWE-200	Low	Publicly exposed email addresses may lead to phishing or spam attacks.	Obfuscate email addresses or remove unnecessary public exposure.