Using the Automation Framework Total of 566 URLs PASS: Vulnerable JS Library (Powered by Retire.js) [10003] PASS: In Page Banner Information Leak [10009] PASS: Cookie Without Secure Flag [10011] PASS: Content-Type Header Missing [10019] PASS: Anti-clickjacking Header [10020] PASS: X-Content-Type-Options Header Missing [10021] PASS: Information Disclosure - Debug Error Messages [10023] PASS: Information Disclosure - Sensitive Information in URL [10024] PASS: Information Disclosure - Sensitive Information in HTTP Referrer Header [10025] PASS: HTTP Parameter Override [10026] PASS: Information Disclosure - Suspicious Comments [10027] PASS: Off-site Redirect [10028] PASS: Cookie Poisoning [10029] PASS: User Controllable Charset [10030] PASS: Viewstate [10032] PASS: Directory Browsing [10033] PASS: Heartbleed OpenSSL Vulnerability (Indicative) [10034] PASS: Strict-Transport-Security Header [10035] PASS: HTTP Server Response Header [10036] PASS: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] PASS: Content Security Policy (CSP) Header Not Set [10038] PASS: X-Backend-Server Header Information Leak [10039] PASS: Secure Pages Include Mixed Content [10040] PASS: HTTP to HTTPS Insecure Transition in Form Post [10041] PASS: HTTPS to HTTP Insecure Transition in Form Post [10042] PASS: User Controllable JavaScript Event (XSS) [10043] PASS: Big Redirect Detected (Potential Sensitive Information Leak) [10044] PASS: Retrieved from Cache [10050] PASS: X-ChromeLogger-Data (XCOLD) Header Information Leak [10052] PASS: X-Debug-Token Information Leak [10056] PASS: Username Hash Found [10057] PASS: X-AspNet-Version Response Header [10061] PASS: PII Disclosure [10062] PASS: Permissions Policy Header Not Set [10063] PASS: Hash Disclosure [10097] PASS: Cross-Domain Misconfiguration [10098] PASS: Source Code Disclosure [10099] PASS: Weak Authentication Method [10105] PASS: Reverse Tabnabbing [10108] PASS: Dangerous JS Functions [10110] PASS: Authentication Request Identified [10111] PASS: Verification Request Identified [10113] PASS: Script Served From Malicious Domain (polyfill) [10115] PASS: ZAP is Out of Date [10116] PASS: Private IP Disclosure [2] PASS: Session ID in URL Rewrite [3] PASS: Script Passive Scan Rules [50001] PASS: Stats Passive Scan Rule [50003] PASS: Insecure JSF ViewState [90001] PASS: Java Serialization Object [90002] PASS: Charset Mismatch [90011] PASS: Application Error Disclosure [90022] PASS: WSDL File Detection [90030] PASS: Loosely Scoped Cookie [90033] WARN-NEW: Cookie No HttpOnly Flag [10010] x 1 https://www.steps.com.tw/wp-login.php?reauth=1&redirect_to=https%3A%2F%2Fwww.steps.com.tw%2Fwp-admin%2F (200 OK) WARN-NEW: Re-examine Cache-control Directives [10015] x 5 https://www.steps.com.tw/robots.txt (200 OK) https://www.steps.com.tw/wp-sitemap-posts-page-1.xml (200 OK) https://www.steps.com.tw/wp-sitemap-posts-post-1.xml (200 OK) https://www.steps.com.tw/wp-sitemap-taxonomies-post_format-1.xml (200 OK) https://www.steps.com.tw/wp-sitemap.xml (200 OK) WARN-NEW: Cross-Domain JavaScript Source File Inclusion [10017] x 1 https://www.steps.com.tw/2024/08/%e4%b8%ad%e8%8f%af%e6%b0%91%e5%9c%8b%e8%bb%9f%e9%ab%94%e5%8d%94%e6%9c%83-%e6%94%bf%e5%ba%9c%e7%b6%b2%e7%ab%99%e7%87%9f%e9%81%8b%e4%ba%a4%e6%b5%81%e5%b9%b3%e5%8f%b0/ (200 OK) WARN-NEW: User Controllable HTML Element Attribute (Potential XSS) [10031] x 1 https://www.steps.com.tw/wp-login.php?reauth=1&redirect_to=https%3A%2F%2Fwww.steps.com.tw%2Fwp-admin%2F (200 OK) WARN-NEW: Non-Storable Content [10049] x 9 https://www.steps.com.tw/sitemap.xml (302 Found) https://www.steps.com.tw (200 OK) https://www.steps.com.tw/robots.txt (200 OK) https://www.steps.com.tw/wp-json/ (200 OK) https://www.steps.com.tw/wp-sitemap-index.xsl (200 OK) WARN-NEW: Cookie without SameSite Attribute [10054] x 1 https://www.steps.com.tw/wp-login.php?reauth=1&redirect_to=https%3A%2F%2Fwww.steps.com.tw%2Fwp-admin%2F (200 OK) WARN-NEW: CSP: Wildcard Directive [10055] x 12 https://www.steps.com.tw/sitemap.xml (302 Found) https://www.steps.com.tw/wp-admin/ (302 Found) https://www.steps.com.tw/wp-admin/admin-ajax.php (400 Bad Request) https://www.steps.com.tw/sitemap.xml (302 Found) https://www.steps.com.tw/wp-admin/ (302 Found) WARN-NEW: Timestamp Disclosure - Unix [10096] x 5 https://www.steps.com.tw (200 OK) https://www.steps.com.tw (200 OK) https://www.steps.com.tw/2020/03/%e8%b3%80-%e5%85%83%e5%9f%b9%e7%a7%91%e6%8a%80%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99-2/ (200 OK) https://www.steps.com.tw/2020/10/%e8%b3%80-%e5%9c%8b%e7%ab%8b%e9%ab%94%e8%82%b2%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99/ (200 OK) https://www.steps.com.tw/2020/10/%e8%b3%80-%e8%8f%af%e5%a4%8f%e7%a7%91%e6%8a%80%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99/ (200 OK) WARN-NEW: Modern Web Application [10109] x 5 https://www.steps.com.tw (200 OK) https://www.steps.com.tw/2020/03/%e8%b3%80-%e5%85%83%e5%9f%b9%e7%a7%91%e6%8a%80%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99-2/ (200 OK) https://www.steps.com.tw/2020/06/%e8%b3%80-%e5%9c%8b%e7%ab%8b%e8%87%ba%e7%81%a3%e9%ab%94%e8%82%b2%e9%81%8b%e5%8b%95%e5%a4%a7%e5%ad%b8%e3%80%90%e6%95%99%e5%b8%ab%e8%a9%95%e9%91%91%e6%9a%a8%e6%95%99%e5%b8%ab%e6%ad%b7%e7%a8%8b%e7%b3%bb/ (200 OK) https://www.steps.com.tw/2020/10/%e8%b3%80-%e5%9c%8b%e7%ab%8b%e9%ab%94%e8%82%b2%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99/ (200 OK) https://www.steps.com.tw/2020/10/%e8%b3%80-%e8%8f%af%e5%a4%8f%e7%a7%91%e6%8a%80%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99/ (200 OK) WARN-NEW: Session Management Response Identified [10112] x 1 https://www.steps.com.tw/wp-login.php?reauth=1&redirect_to=https%3A%2F%2Fwww.steps.com.tw%2Fwp-admin%2F (200 OK) WARN-NEW: Absence of Anti-CSRF Tokens [10202] x 2 https://www.steps.com.tw/wp-login.php?reauth=1&redirect_to=https%3A%2F%2Fwww.steps.com.tw%2Fwp-admin%2F (200 OK) https://www.steps.com.tw/%e7%b4%a2%e5%8f%96%e6%9b%b4%e5%a4%9a%e8%b3%87%e8%a8%8a/ (200 OK) WARN-NEW: Sub Resource Integrity Attribute Missing [90003] x 5 https://www.steps.com.tw (200 OK) https://www.steps.com.tw/2020/03/%e8%b3%80-%e5%85%83%e5%9f%b9%e7%a7%91%e6%8a%80%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99-2/ (200 OK) https://www.steps.com.tw/2020/05/%e8%b3%80-%e5%ae%9c%e8%98%ad%e7%b8%a3%e6%94%bf%e5%ba%9c%e6%95%99%e8%82%b2%e8%99%95%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99/ (200 OK) https://www.steps.com.tw/2020/10/%e8%b3%80-%e5%9c%8b%e7%ab%8b%e9%ab%94%e8%82%b2%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99/ (200 OK) https://www.steps.com.tw/2020/10/%e8%b3%80-%e8%8f%af%e5%a4%8f%e7%a7%91%e6%8a%80%e5%a4%a7%e5%ad%b8%e6%a8%99%e6%a1%88%e5%be%97%e6%a8%99/ (200 OK) WARN-NEW: Cross-Origin-Embedder-Policy Header Missing or Invalid [90004] x 9 https://www.steps.com.tw (200 OK) https://www.steps.com.tw/wp-sitemap-index.xsl (200 OK) https://www.steps.com.tw/wp-sitemap-taxonomies-category-1.xml (200 OK) https://www.steps.com.tw (200 OK) https://www.steps.com.tw/wp-sitemap-index.xsl (200 OK) FAIL-NEW: 0 FAIL-INPROG: 0 WARN-NEW: 13 WARN-INPROG: 0 INFO: 0 IGNORE: 0 PASS: 54 [ZAP EXIT] 0