Alert Rules

Active Scan Rules:

Alert	Risk	Type	CWE
Advanced SQL Injection	High	Active	89
Cross-Domain Misconfiguration	High	Active	N/A
Cross Site Scripting (Persistent)	High	Active	79
Cross Site Scripting (Reflected)	High	Active	79
Cross Site WebSocket Hijacking	High	Active	346
Cross Site Scripting (DOM Based)	High	Active	79
Expression Language Injection	High	Active	917
External Redirect	High	Active	N/A
File Content Disclosure (CVE-2019-5418)	High	Active	74
Heartbleed OpenSSL Vulnerability	High	Active	119
Httpoxy - Proxy Header Misuse	High	Active	20
JWT None Hashing Algorithm Attack	High	Active	347
JWT Algorithm Confusion Attack	High	Active	327
JWT Algorithm JSON Web Key (JWK) Based Attack	High	Active	290
JWT Empty Token Injection Attack	High	Active	345
JWT Signature Not Verified	High	Active	347
JWT Null Byte Injection Attack	High	Active	1321
JWT Publicly Well Known HMac Secret Attack	High	Active	798
Log4Shell	High	Active	117
NoSQL Injection - MongoDB	High	Active	943
Out of Band XSS	High	Active	79
Remote File Inclusion	High	Active	98
Remote OS Command Injection	High	Active	78
Server Side Code Injection	High	Active	N/A
Server Side Include	High	Active	97
Server Side Request Forgery	High	Active	918
Server Side Request Forgery (Blind)	High	Active	918
Server Side Template Injection	High	Active	1336
Server Side Template Injection (Blind)	High	Active	1336
Session Fixation	High	Active	384
SOAP Action Spoofing	High	Active	N/A
SOAP XML Injection	High	Active	N/A
Spring4Shell	High	Active	78
SQL Injection	High	Active	89
SQL Injection - Hypersonic SQL	High	Active	89
SQL Injection - MsSQL	High	Active	89
SQL Injection - Oracle	High	Active	89
SQL Injection - PostgreSQL	High	Active	89
SQL Injection - SQLite	High	Active	89
Text4shell (CVE-2022-42889)	High	Active	117
XML External Entity Attack	High	Active	611
XPath Injection	High	Active	643
Bypassing 403	Medium	Active	N/A
Directory Browsing	Medium	Active	548
Exponential Entity Expansion (Billion Laughs Attack)	Medium	Active	776
File Upload	Medium	Active	N/A
HTTP Only Site	Medium	Active	311
JWT Scan Rule	Medium	Active	N/A
Spring Actuator Information Leak	Medium	Active	215
Web Cache Deception	Medium	Active	N/A
Cross Site Scripting (Persistent) - Prime	Informational	Active	79
Cross Site Scripting (Persistent) - Spider	Informational	Active	79
HTTP Parameter Pollution	Informational	Active	20

Passive Scan Rules:

Alert	Risk	Type	CWE
ASP.NET ViewState Integrity	High	Passive	642
Heartbleed OpenSSL Vulnerability (Indicative)	High	Passive	119
JWT Leaked in URL	High	Passive
Open Redirect	High	Passive	601
Personally Identifiable Information via WebSocket	High	Passive	359
Script Served From Malicious Domain (polyfill)	High	Passive	829
Viewstate without MAC Signature (Unsure)	High	Passive	642
Viewstate without MAC Signature (Sure)	High	Passive	642
Absence of Anti-CSRF Tokens	Medium	Passive	352
Application Error Disclosure via WebSockets	Medium	Passive	209
Authentication Credentials Captured	Medium	Passive	287
Cookie Containing JWT is Lacking SameSite Attribute	Medium	Passive	1004
Cookie Containing JWT is Lacking Secure Flag	Medium	Passive	614
Cookie Containing JWT is Lacking __Secure- or __Host- Prefixes	Medium	Passive	565
Cross-Domain Misconfiguration	Medium	Passive	264
Directory Browsing	Medium	Passive	548
HTTP to HTTPS Insecure Transition in Form Post	Medium	Passive	319
HTTPS to HTTP Insecure Transition in Form Post	Medium	Passive	319
Information Disclosure - JWT in Browser localStorage	Medium	Passive	200
Insecure JSF ViewState	Medium	Passive	642
Java Serialization Object	Medium	Passive	502
JWT is in Form	Medium	Passive	522
JWT is in HTTP Header	Medium	Passive	522
No HttpOnly Flag on Cookie Containing JWT	Medium	Passive	1004
Missing Anti-clickjacking Header	Medium	Passive	1021
Potential IP Addresses Found in the Viewstate	Medium	Passive	642
Emails Found in the Viewstate	Medium	Passive	642
Session ID in URL Rewrite	Medium	Passive	200
Reverse Tabnabbing	Medium	Passive	N/A
Vulnerable JS Library	Medium	Passive	829
Weak Authentication Method	Medium	Passive	326
CSP	Medium	Passive	693
Big Redirect Detected (Potential Sensitive Information Leak)	Low	Passive	201
Cookie No HttpOnly Flag	Low	Passive	1004
Cookie without SameSite Attribute	Low	Passive	1275
Cookie Without Secure Flag	Low	Passive	614
Cross-Domain JavaScript Source File Inclusion	Low	Passive	829
Deprecated Feature Policy Header Set	Low	Passive	16
Hash Disclosure - MD4 / MD5	Low	Passive	200
Information Disclosure - Sensitive Information in Browser Storage	Low	Passive	200
Information Disclosure - Debug Error Messages	Low	Passive	200
Information Disclosure - Debug Error Messages via WebSocket	Low	Passive	200
Multiple HREFs Redirect Detected (Potential Sensitive Information Leak)	Low	Passive	201
Old Asp.Net Version in Use	Low	Passive	642
Permissions Policy Header Not Set	Low	Passive	693
Private IP Disclosure	Low	Passive	200
Private IP Disclosure via WebSocket	Low	Passive	N/A
Secure Pages Include Mixed Content	Low	Passive	311
Server Leaks Version Information via “Server” HTTP Response Header Field	Low	Passive	200
Strict-Transport-Security Header	Low	Passive	319
X-Backend-Server Header Information Leak	Low	Passive	200
X-Debug-Token Information Leak	Low	Passive	200
X-AspNet-Version Response Header	Low	Passive	933
ASP.NET ViewState Disclosure	Informational	Passive	200
Base64 Disclosure in WebSocket message	Informational	Passive	N/A
Content-Type Header Missing	Informational	Passive	345
Content Security Policy (CSP) Report-Only Header Found	Informational	Passive	693
Cookie Poisoning	Informational	Passive	565
Email address found in WebSocket message	Informational	Passive	200
Image Exposes Location or Privacy Data	Informational	Passive	200
Information Disclosure - Information in Browser Storage	Informational	Passive	200
Information Disclosure - JWT in Browser sessionStorage	Informational	Passive	200
Information Disclosure - Sensitive Information in HTTP Referrer Header	Informational	Passive	200
Information Disclosure - Sensitive Information in URL	Informational	Passive	200
Information Disclosure - Suspicious Comments in XML via WebSocket	Informational	Passive	200
Obsolete Content Security Policy (CSP) Header Found	Informational	Passive	693
Re-examine Cache-control Directives	Informational	Passive	525
Server Leaks its Webserver Application via “Server” HTTP Response Header Field	Informational	Passive	200
Split Viewstate in Use	Informational	Passive	642
Storable but Non-Cacheable Content	Informational	Passive	524
User Controllable Charset	Informational	Passive	20
Username Hash Found	Informational	Passive	284
Username Hash Found in WebSocket message	Informational	Passive	284
Verification Request Identified	Informational	Passive	N/A

Nuclei Templates

We also use nuclei templates for vulnerability detection of CVEs and misconfigurations. The specific templates will be added to these docs soon.