OpenVAPTCheck Catalogue
Every check OpenVAPT runs, generated from the code. Sort, filter or search, then open a check to see its rationale, detection logic, fix, references, standards mapping and full source.
310 checks
| ID | Check | Category | Severity | CWE |
|---|---|---|---|---|
HOST-AUD-001 | Audit Daemon Not Enabled at Boot Checks that the audit daemon (auditd) is set to start at every boot, not only running now. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-002 | Identity Files Not Audited Checks that changes to the account, group, password and sudo files are recorded by the audit system. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-003 | Login and Logout Events Not Audited Checks that the files recording logins, failed logins and sessions are watched by the audit system. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-004 | System Time Changes Not Audited Checks that the audit system records changes to the system clock and time zone. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-005 | Kernel Module Loading Not Audited Checks that loading and unloading kernel modules is recorded by the audit system. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-006 | Privileged Command Use Not Audited Checks that the audit system records when ordinary users run privileged (setuid or setgid) programs. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-007 | Audit Configuration Not Immutable Checks that the audit rule set ends with -e 2, which locks the rules until the next reboot. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-008 | Audit Log Files Readable by Others Checks that the audit log directory and files can be read only by root. |
Logging and Monitoring | Low | CWE-532, CWE-732 |
HOST-AUD-009 | Audit Daemon Ignores a Full Log Disk Checks that auditd is told what to do when its log file is full or the disk runs low, rather than silently dropping events. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-010 | Journal Not Persistent or Not Compressed Checks that systemd-journald is configured to keep the journal on disk and to compress it. |
Logging and Monitoring | Low | CWE-778 |
HOST-AUD-011 | Logs Not Forwarded to a Remote Collector Checks that system logs are sent to another machine, so an intruder with root cannot erase the only copy. |
Logging and Monitoring | Low | CWE-778 |
HOST-BOOT-001 | Boot Loader Has No Password Checks that GRUB is configured with a superuser and a hashed password so the boot entries cannot be edited at the console. |
Access Control | Medium | CWE-306 |
HOST-BOOT-002 | UEFI Secure Boot Disabled Checks the firmware's SecureBoot variable to see whether the boot chain is verified. |
Secure Configuration | Medium | CWE-1326 |
HOST-BOOT-003 | Uncommon Filesystem Modules Not Disabled Checks that the cramfs, freevxfs, jffs2, hfs, hfsplus, udf and squashfs kernel modules are disabled in modprobe.d. |
Secure Configuration | Medium | CWE-1188 |
HOST-BOOT-004 | USB Storage Driver Not Disabled Checks that the usb-storage kernel module is disabled in modprobe.d on servers that do not need removable media. |
Secure Configuration | Medium | CWE-1188 |
HOST-BOOT-005 | Kernel Module Loading Unrestricted Checks that the running kernel refuses unsigned modules or has module loading switched off entirely. |
Secure Configuration | Low | CWE-1188 |
HOST-BOOT-006 | No File Integrity Monitoring Checks that a file integrity tool (AIDE, Tripwire, Samhain or equivalent) is installed and scheduled to run. |
Logging and Monitoring | Medium | CWE-778 |
HOST-BOOT-007 | Prelink Installed Checks that the prelink tool is absent, or disabled where the package is still installed. |
Secure Configuration | Low | CWE-344 |
HOST-BOOT-008 | Core Dumps Not Restricted Checks that process core dumps are turned off through PAM limits, and through systemd-coredump where the kernel hands dumps to it. |
Information Exposure | Low | CWE-528 |
HOST-CRON-001 | Cron Jobs Run Programs Other Users Can Modify Resolves the programs and scripts that system and root cron jobs run and checks whether any is world-writable or sits in a world-writable folder. |
Access Control | High | CWE-732, CWE-426 |
HOST-CRON-002 | World-Writable Directory in Cron's PATH Checks the PATH that system cron jobs search for commands for world-writable or relative entries. |
Access Control | High | CWE-426, CWE-427 |
HOST-CTR-001 | Docker API Exposed Over TCP Without TLS Checks whether the Docker daemon is configured to listen on a TCP socket without TLS client verification. |
Network Exposure | Critical | CWE-306, CWE-319 |
HOST-CTR-002 | Docker Daemon Not Hardened Checks the Docker daemon defaults: no-new-privileges, inter-container communication, user namespace remapping and live restore. |
Secure Configuration | Medium | CWE-250, CWE-1188 |
HOST-CTR-003 | Privileged or Host-Namespace Containers Looks for containers running privileged, sharing the host's PID, network or IPC namespace, or with dangerous added capabilities. |
Secure Configuration | High | CWE-250, CWE-653 |
HOST-CTR-004 | Containers Mount the Docker Socket or Host Root Looks for containers that bind-mount the Docker socket, the host root filesystem or sensitive host paths. |
Access Control | High | CWE-250, CWE-732 |
HOST-CTR-005 | Docker Container Logs Have No Size Limit Checks whether the Docker daemon's default log driver caps log file size and rotation. |
Logging and Monitoring | Low | CWE-779, CWE-770 |
HOST-CTR-006 | Docker Userland Proxy Enabled Checks whether the Docker daemon still uses the docker-proxy userland process for published ports. |
Secure Configuration | Low | CWE-1188 |
HOST-CTR-007 | Docker Default Ulimits Not Set Checks whether the Docker daemon sets default ulimits (open files and processes) for containers. |
Secure Configuration | Low | CWE-770 |
HOST-CTR-008 | Docker Socket Accessible to Non-Administrators Checks the Docker socket's permissions and who belongs to the docker group. |
Access Control | High | CWE-732, CWE-250 |
HOST-CTR-009 | Docker Not Running in Rootless Mode Reports whether the Docker daemon runs as root or in rootless mode. Informational. |
Secure Configuration | Info | CWE-250 |
HOST-CTR-010 | Docker Daemon Allows Insecure Registries or Debug Features Checks daemon.json for insecure-registries, debug mode and experimental features. |
Secure Configuration | Medium | CWE-494, CWE-1188 |
HOST-CTR-011 | Seccomp or AppArmor Disabled for Containers Looks for the daemon or individual containers turning off the default seccomp profile, AppArmor or SELinux labelling. |
Secure Configuration | High | CWE-653, CWE-250 |
HOST-CTR-012 | Containers Run Without Memory or Process Limits Looks for containers with no memory limit and no PID limit. |
Secure Configuration | Medium | CWE-770 |
HOST-CTR-013 | Containers Run as Root With a Writable Root Filesystem Looks for containers whose process runs as root and whose root filesystem is writable. |
Secure Configuration | Medium | CWE-250, CWE-732 |
HOST-CTR-014 | containerd Remote API or Podman Unconfined Defaults Checks the containerd and Podman configuration files for a TCP API without TLS and for unconfined seccomp or disabled labelling defaults. |
Secure Configuration | High | CWE-306, CWE-1188 |
HOST-CTR-015 | Docker Content Trust Not Enabled Checks whether DOCKER_CONTENT_TRUST=1 is set system-wide so that only signed images are pulled. |
Secure Configuration | Low | CWE-494, CWE-347 |
HOST-CVE-001 | Installed OS Packages With Known Vulnerabilities Checks installed packages against an offline vulnerability snapshot. |
Patch and Vulnerability Management | High | CWE-1104 |
HOST-CVE-002 | Known Exploited Vulnerabilities Present Checks installed packages against an offline vulnerability snapshot. |
Patch and Vulnerability Management | Critical | CWE-1104 |
HOST-CVE-003 | Vulnerability Snapshot Outdated or Test Data Checks installed packages against an offline vulnerability snapshot. |
Patch and Vulnerability Management | Low | CWE-1104 |
HOST-DKR-001 | Users With Root-Equivalent Docker Access Checks whether non-root users can control Docker, which is equivalent to root access. |
Identity and Authentication | High | CWE-250, CWE-266 |
HOST-FS-001 | Sensitive Account Files Have Unsafe Permissions Checks that /etc/shadow and /etc/gshadow are not readable by others, and /etc/passwd and /etc/group are not writable by others. |
Access Control | High | CWE-732 |
HOST-FS-002 | Temporary Directory Missing the Sticky Bit Checks that world-writable temp directories have the sticky bit set. |
Access Control | High | CWE-377, CWE-732 |
HOST-FS-003 | World-Writable Files in System Configuration Looks for files under /etc and in cron directories that any user can modify. |
Access Control | High | CWE-732 |
HOST-FS-004 | Unexpected SUID or SGID Programs Looks for set-user-ID or set-group-ID programs in places where packages do not normally install them. |
Access Control | High | CWE-250 |
HOST-FS-005 | Cron Files Writable by Non-Root Users Checks that system cron files and directories are owned by root and not writable by others. |
Access Control | High | CWE-732 |
HOST-FS-006 | Boot Loader Configuration Exposed Checks that the GRUB configuration is not readable or writable by normal users. |
Access Control | Medium | CWE-732 |
HOST-FS-007 | Private TLS Keys Readable by Others Checks that TLS private keys under the standard key directories are not readable by other users. |
Cryptography and TLS | High | CWE-732 |
HOST-FS-008 | Temporary Filesystems Allow Executables or Devices Checks that /tmp, /var/tmp and /dev/shm are mounted with nodev and nosuid. |
Secure Configuration | Low | CWE-276 |
HOST-FS-009 | Default File Creation Mask Too Permissive Checks that the default umask makes new files unreadable to other users (027 or stricter). |
Access Control | Low | CWE-276 |
HOST-FS-010 | /var/tmp Not a Separate Filesystem Checks that /var/tmp is its own mount (or a bind mount of /tmp) with nodev, nosuid and noexec. |
Secure Configuration | Low | CWE-276 |
HOST-FS-011 | /home Not a Separate Filesystem With nodev Checks that user home directories live on their own mount with nodev (and nosuid where practical). |
Secure Configuration | Low | CWE-276 |
HOST-FS-012 | Log Directories on the Root Filesystem Checks that /var/log (or /var) is a separate filesystem so runaway logging cannot fill the root disk. |
Secure Configuration | Low | CWE-770 |
HOST-FS-013 | Temporary Filesystems Allow Executables Checks that /tmp, /var/tmp and /dev/shm, where they are separate mounts, carry the noexec option. |
Secure Configuration | Low | CWE-276 |
HOST-FS-014 | World-Writable Files Outside Temporary Directories Looks for files that any user can modify in program, service and home locations other than /etc (which HOST-FS-003 covers). |
Access Control | Medium | CWE-732 |
HOST-FS-015 | Files With No Known Owner or Group Looks for files whose owner or group id no longer appears in /etc/passwd or /etc/group. |
Access Control | Low | CWE-282 |
HOST-FS-016 | SUID or SGID Programs Outside the Known Baseline Lists set-user-ID and set-group-ID programs in the system binary directories that are not on the documented baseline of what distributions ship. |
Access Control | Medium | CWE-250 |
HOST-FS-017 | World-Writable Directories Without the Sticky Bit Looks for shared writable directories outside /tmp and /etc that let any user delete or replace other users' files. |
Access Control | Medium | CWE-732, CWE-377 |
HOST-FS-018 | Kernel Symbol Map or Initial RAM Disk Readable by Others Checks that /boot/System.map-* and the initial RAM disk images are not readable by every user. |
Information Exposure | Low | CWE-497, CWE-732 |
HOST-FS-019 | Cron and At Not Restricted to Allowed Users Checks that cron.allow and at.allow exist, are private to root, and that the deny lists are not relied upon instead. |
Access Control | Low | CWE-862 |
HOST-FS-020 | Cron Configuration Readable by Other Users Checks that /etc/crontab is mode 600 and the cron.d, cron.hourly, cron.daily, cron.weekly and cron.monthly directories are mode 700, all owned by root. |
Access Control | Low | CWE-732 |
HOST-FS-021 | Shell Profile Sets a Permissive File Creation Mask Checks that system-wide shell start-up files do not set a umask that leaves new files readable by every user. |
Access Control | Low | CWE-276 |
HOST-FS-022 | Account Database Files or Their Backups Not Owned and Locked by Root Checks the owner and permissions of /etc/passwd, /etc/group, /etc/shadow, /etc/gshadow and their dash-suffixed backup copies. |
Access Control | High | CWE-732, CWE-522 |
HOST-IDS-001 | No Brute-Force Protection Service Checks that a log-based intrusion prevention service (fail2ban, sshguard or CrowdSec) is running. |
Logging and Monitoring | Low | CWE-307 |
HOST-K8S-001 | Kubelet Allows Anonymous or Unauthorised Access Checks the kubelet configuration for anonymous authentication, AlwaysAllow authorisation or the unauthenticated read-only port. |
Identity and Authentication | Critical | CWE-306, CWE-862 |
HOST-K8S-002 | Kubernetes Data Directory Accessible to Others Checks that the etcd data directory is accessible only by its owner. |
Access Control | High | CWE-732 |
HOST-K8S-003 | Kubernetes Credential Files Readable by Others Checks that kubeconfig files and Kubernetes PKI private keys are not readable by other users. |
Identity and Authentication | High | CWE-732 |
HOST-KRN-001 | Address Space Layout Randomisation Not Fully Enabled Checks that the kernel randomises memory layout for stack, libraries, heap and VDSO. |
Secure Configuration | Medium | CWE-344 |
HOST-KRN-002 | Kernel Pointers Exposed to Unprivileged Users Checks that kernel memory addresses are hidden from normal users. |
Secure Configuration | Low | CWE-497 |
HOST-KRN-003 | Kernel Log Readable by Unprivileged Users Checks that only privileged users can read the kernel log (dmesg). |
Secure Configuration | Low | CWE-497 |
HOST-KRN-004 | Setuid Programs May Dump Core Checks that privileged programs do not write core dumps. |
Secure Configuration | Low | CWE-528 |
HOST-KRN-005 | IP Forwarding Enabled Checks that the server does not route packets between networks. |
Secure Configuration | Low | CWE-1188 |
HOST-KRN-006 | ICMP Redirects Accepted Checks that the kernel ignores ICMP redirect messages. |
Secure Configuration | Low | CWE-940 |
HOST-KRN-007 | Source-Routed Packets Accepted Checks that the kernel drops packets that dictate their own route. |
Secure Configuration | Low | CWE-940 |
HOST-KRN-008 | TCP SYN Cookies Disabled Checks that SYN cookies protect the server from SYN flood attacks. |
Secure Configuration | Low | CWE-770 |
HOST-KRN-009 | Unprivileged eBPF Allowed Checks that normal users cannot load eBPF programs into the kernel. |
Secure Configuration | Medium | CWE-749 |
HOST-KRN-010 | Process Tracing Not Restricted Checks that processes cannot attach a debugger to other processes of the same user. |
Secure Configuration | Low | CWE-749 |
HOST-KRN-011 | Symlink Protection Disabled Checks that the kernel blocks following symlinks owned by other users in world-writable sticky directories. |
Secure Configuration | Low | CWE-59 |
HOST-KRN-012 | Hardlink Protection Disabled Checks that users cannot create hard links to files they do not own. |
Secure Configuration | Low | CWE-59 |
HOST-KRN-013 | Reverse Path Filtering Disabled Checks that the kernel drops packets whose source address could not be routed back through the receiving interface. |
Secure Configuration | Low | CWE-940 |
HOST-KRN-014 | Martian Packets Not Logged Checks that packets with impossible source addresses are logged. |
Secure Configuration | Low | CWE-778 |
HOST-KRN-015 | Server Sends ICMP Redirects Checks that the server does not send ICMP redirects, which only routers should do. |
Secure Configuration | Low | CWE-1188 |
HOST-KRN-016 | Broadcast ICMP Echo Answered Checks that the server ignores ping requests sent to broadcast addresses. |
Secure Configuration | Low | CWE-406 |
HOST-KRN-017 | IPv6 ICMP Redirects Accepted Checks that the kernel ignores IPv6 ICMP redirect messages. |
Secure Configuration | Low | CWE-940 |
HOST-KRN-018 | Performance Events Open to Unprivileged Users Checks that unprivileged users cannot use kernel performance events to observe the system. |
Secure Configuration | Low | CWE-749 |
HOST-KRN-019 | Magic SysRq Key Enabled Checks that the magic SysRq key combination is disabled or limited to keyboard synchronisation. |
Secure Configuration | Low | CWE-749 |
HOST-KRN-020 | FIFO Protection in Shared Directories Disabled Checks that the kernel refuses to open FIFOs in world-writable sticky directories that another user owns. |
Secure Configuration | Low | CWE-59 |
HOST-KRN-021 | Regular File Protection in Shared Directories Disabled Checks that the kernel refuses to open, with O_CREAT, regular files in world-writable sticky directories that another user owns. |
Secure Configuration | Low | CWE-59 |
HOST-KRN-022 | Unprivileged User Namespaces Allowed Checks that normal users cannot create user namespaces, unless the server runs containers that need them. |
Secure Configuration | Low | CWE-749 |
HOST-KRN-023 | IPv6 Source-Routed Packets Accepted Checks that the kernel drops IPv6 packets that dictate their own route. |
Secure Configuration | Low | CWE-940 |
HOST-KRN-024 | Secure ICMP Redirects Accepted Checks that the kernel also ignores ICMP redirects that come from its configured gateways. |
Secure Configuration | Low | CWE-940 |
HOST-KRN-025 | IPv6 Router Advertisements Accepted Checks that the server does not reconfigure its IPv6 addresses and routes from router advertisements. |
Secure Configuration | Low | CWE-940 |
HOST-KRN-026 | Bogus ICMP Error Responses Logged Checks that the kernel silently ignores malformed ICMP error responses instead of logging each one. |
Secure Configuration | Low | CWE-779 |
HOST-KRN-027 | Kexec Kernel Replacement Allowed Checks that a running kernel cannot be replaced at run time with kexec. |
Secure Configuration | Low | CWE-749 |
HOST-KRN-028 | Unprivileged userfaultfd Allowed Checks that only privileged processes can use userfaultfd. |
Secure Configuration | Low | CWE-749 |
HOST-KRN-029 | TTY Line Discipline Autoloading Enabled Checks that unprivileged users cannot make the kernel load terminal line discipline modules. |
Secure Configuration | Low | CWE-1188 |
HOST-KRN-030 | BPF JIT Hardening Off Checks that the BPF just-in-time compiler blinds constants in generated code for every user. |
Secure Configuration | Low | CWE-1188 |
HOST-KRN-031 | io_uring Open to Unprivileged Users Checks that io_uring is disabled, or limited to privileged processes, on kernels that offer the setting. |
Secure Configuration | Low | CWE-749 |
HOST-LOG-001 | System Logging Not Persistent Checks that system logs survive a reboot (rsyslog/syslog-ng running, or a persistent journal). |
Logging and Monitoring | Low | CWE-778 |
HOST-LOG-002 | Security Audit Daemon Not Running Checks whether the Linux audit daemon (auditd) is running. |
Logging and Monitoring | Low | CWE-778 |
HOST-LOG-003 | Security Logs Readable by All Users Checks that authentication and system logs are not world-readable. |
Logging and Monitoring | Low | CWE-532 |
HOST-LOG-004 | Log Rotation Not Configured Checks that logrotate (or journald size limits) keeps logs from filling the disk. |
Logging and Monitoring | Low | CWE-770 |
HOST-MAC-001 | No Mandatory Access Control Enforced Checks that AppArmor or SELinux is enabled and enforcing. |
Secure Configuration | Low | CWE-250 |
HOST-OS-001 | Operating System Past End of Security Support Checks whether the Linux distribution release still receives free security updates. |
Patch and Vulnerability Management | High | CWE-1104 |
HOST-PAM-001 | Password Quality Module Not Enforced Checks that new passwords pass through pam_pwquality with its dictionary check on, so dictionary words and user-name variants are rejected. |
Identity and Authentication | Low | CWE-521 |
HOST-PAM-002 | Account Lockout Releases Too Quickly Checks that a locked account stays locked for at least 15 minutes (or until an administrator unlocks it). |
Identity and Authentication | Low | CWE-307 |
HOST-PAM-003 | su Not Restricted to an Administrative Group Checks that only members of a named group (wheel or sudo) may use su to become another user. |
Identity and Authentication | Low | CWE-250, CWE-862 |
HOST-PAM-004 | Password History Not Enforced Checks that PAM remembers at least the last 5 passwords so a changed password cannot be changed straight back. |
Identity and Authentication | Low | CWE-262 |
HOST-PAM-005 | Minimum Password Age Not Set Checks that a password cannot be changed again on the same day it was set. |
Identity and Authentication | Low | CWE-262 |
HOST-PAM-006 | Password Expiry Warning Too Short Reports whether users are warned at least 7 days before a password expires. |
Identity and Authentication | Info | CWE-262 |
HOST-PAM-007 | Inactive Accounts Never Locked Checks that new accounts are set to lock automatically after a password has been expired and unused for at most 30 days. |
Identity and Authentication | Low | CWE-262 |
HOST-PAM-008 | Root PATH Contains Unsafe Entries Checks that the PATH set for root does not include the current directory, empty entries, relative paths or directories other users can write to. |
Identity and Authentication | Medium | CWE-426, CWE-427 |
HOST-PAM-009 | No Shell Idle Timeout Checks that interactive shells log out after at most 15 minutes without input (TMOUT). |
Identity and Authentication | Low | CWE-613 |
HOST-PKG-001 | Security Updates Waiting to Be Installed Checks the package manager for published security updates that are not installed yet. |
Patch and Vulnerability Management | High | CWE-1104 |
HOST-PKG-002 | Repository Signature Checks Disabled Checks that the package manager verifies repository signatures, so a tampered mirror or intercepted download cannot install code as root. |
Patch and Vulnerability Management | High | CWE-494, CWE-347 |
HOST-PKG-003 | Third-Party Package Repositories Present Lists package repositories that are not run by the distribution vendor, so each one can be justified. |
Patch and Vulnerability Management | Info | CWE-1357 |
HOST-PKG-004 | Many Old Kernels Retained Checks that no more than three kernel versions are installed. |
Patch and Vulnerability Management | Low | CWE-1104 |
HOST-PKG-005 | Running Kernel Older Than Installed Kernel Checks that the kernel in memory is the newest kernel installed, so kernel security fixes are actually in effect. |
Patch and Vulnerability Management | Medium | CWE-1104 |
HOST-PKG-006 | Package Lists Not Refreshed Automatically Checks that the package manager downloads fresh repository metadata on a schedule, so pending updates can be seen at all. |
Patch and Vulnerability Management | Low | CWE-1104 |
HOST-PWD-001 | Weak Password Hashing Algorithm Configured Checks that new passwords are hashed with a modern, slow algorithm (SHA-512 or yescrypt). |
Identity and Authentication | Medium | CWE-916, CWE-328 |
HOST-PWD-002 | Accounts With Obsolete Password Hashes Checks /etc/shadow for passwords still stored with MD5 or traditional DES crypt. |
Identity and Authentication | Medium | CWE-916, CWE-328 |
HOST-PWD-003 | Short Minimum Password Length Checks that the password quality policy requires at least 15 characters. |
Identity and Authentication | Low | CWE-521 |
HOST-PWD-004 | No Account Lockout After Failed Logins Checks that PAM temporarily locks accounts after repeated failed logins. |
Identity and Authentication | Medium | CWE-307 |
HOST-PWD-005 | Forced Periodic Password Rotation Configured Reports whether new accounts are forced to change passwords on a short fixed schedule. |
Identity and Authentication | Info | CWE-262 |
HOST-SEC-001 | Secrets in World-Readable Files Looks inside world-readable configuration files under /etc and the web roots for private keys, cloud access keys and password assignments. |
Information Exposure | High | CWE-312, CWE-732, CWE-798 |
HOST-SSH-001 | SSH Allows Direct Root Login Checks whether the SSH daemon accepts logins as root with a password. |
Identity and Authentication | High | CWE-250 |
HOST-SSH-002 | SSH Password Authentication Enabled Checks whether SSH accepts passwords instead of only keys. |
Identity and Authentication | Medium | CWE-307, CWE-521 |
HOST-SSH-003 | SSH Permits Empty Passwords Checks whether SSH lets accounts with an empty password log in. |
Identity and Authentication | Critical | CWE-258 |
HOST-SSH-004 | SSH Offers Weak Cryptography Checks the SSH ciphers, MACs, key exchange and host key algorithms for outdated choices. |
Cryptography and TLS | Medium | CWE-327 |
HOST-SSH-005 | SSH X11 Forwarding Enabled Checks whether SSH forwards graphical X11 sessions. |
Secure Configuration | Low | CWE-1188 |
HOST-SSH-006 | SSH Allows Many Authentication Attempts Checks whether MaxAuthTries is above 4. |
Identity and Authentication | Low | CWE-307 |
HOST-SSH-007 | SSH Forwarding Features Enabled Checks effective SSH Match contexts for TCP, agent, tunnel and gateway forwarding. |
Secure Configuration | Medium | CWE-441 |
HOST-SSH-008 | SSH Authentication Controls Too Permissive Checks effective SSH authentication method and login grace settings. |
Identity and Authentication | Low | CWE-307, CWE-308 |
HOST-SSH-009 | SSH Host Private Keys Readable by Others Checks that SSH host private keys are readable only by root. |
Cryptography and TLS | High | CWE-732 |
HOST-SSH-010 | SSH Server Configuration Writable by Non-Root Users Checks that the SSH daemon configuration cannot be modified by group or other users. |
Access Control | High | CWE-732 |
HOST-SSH-011 | SSH Legacy Trust Options Enabled Checks for host-based trust and user environment options that weaken SSH authentication. |
Identity and Authentication | Medium | CWE-290, CWE-15 |
HOST-SSH-012 | SSH Logging Level Too Low Checks that sshd logs at INFO or VERBOSE level. |
Logging and Monitoring | Low | CWE-778 |
HOST-SSH-013 | SSH Authorized Keys Without Restrictions or Protection Checks root's authorized_keys for keys without from= or command= options, and every authorized_keys file for permissive modes. |
Identity and Authentication | Low | CWE-732, CWE-250 |
HOST-SUDO-001 | Sudo Commands Not Logged to a Dedicated File Checks that sudo uses a pseudo-terminal and keeps its own log file. |
Logging and Monitoring | Low | CWE-778 |
HOST-SVC-001 | Unnecessary Legacy Services Running Checks for desktop and legacy network services that servers rarely need. |
Secure Configuration | Low | CWE-1188 |
HOST-SVC-002 | Telnet Server Installed or Enabled Checks whether a Telnet server is installed or set to start at boot. |
Secure Configuration | Medium | CWE-319, CWE-1188 |
HOST-SVC-003 | rsh, rlogin, rexec or finger Server Installed or Enabled Checks whether the Berkeley r-services (rsh, rlogin, rexec) or a finger server is installed or enabled. |
Secure Configuration | Medium | CWE-319, CWE-1188 |
HOST-SVC-004 | TFTP Server Installed or Enabled Checks whether a TFTP server is installed or set to start at boot. |
Secure Configuration | Medium | CWE-306, CWE-1188 |
HOST-SVC-005 | FTP Server Installed or Enabled Checks whether an FTP server (vsftpd, ProFTPD or Pure-FTPd) is installed or set to start at boot. |
Secure Configuration | Medium | CWE-319, CWE-1188 |
HOST-SVC-006 | NIS Server or Client Installed or Enabled Checks whether the Network Information Service (NIS, ypserv or ypbind) is installed or enabled. |
Secure Configuration | Medium | CWE-319, CWE-522 |
HOST-SVC-007 | Avahi or CUPS Installed or Enabled Checks whether zero-configuration discovery (Avahi) or the printing system (CUPS) is installed or enabled. |
Secure Configuration | Low | CWE-1188 |
HOST-SVC-008 | NFS Server or rpcbind Installed or Enabled Checks whether the NFS server or the RPC port mapper (rpcbind) is installed or enabled. |
Secure Configuration | Low | CWE-1188, CWE-306 |
HOST-SVC-009 | DHCP or DNS Server Installed or Enabled Checks whether a DHCP server or an authoritative or recursive DNS server (BIND) is installed or enabled on a machine that is not a network server. |
Secure Configuration | Low | CWE-1188 |
HOST-SVC-010 | Samba File Server Installed or Enabled Checks whether the Samba SMB file server is installed or set to start at boot. |
Secure Configuration | Low | CWE-1188 |
HOST-SVC-011 | SNMP Agent or Squid Proxy Installed or Enabled Checks whether an SNMP agent or the Squid caching proxy is installed or enabled. |
Secure Configuration | Low | CWE-1188, CWE-319 |
HOST-SVC-012 | inetd Super-Server Installed or Enabled Checks whether xinetd or another inetd super-server is installed or enabled. |
Secure Configuration | Low | CWE-1188 |
HOST-SYSD-001 | Custom Services Run as Root Checks whether long-running services written by the administrator run as root instead of a dedicated user. |
Identity and Authentication | Medium | CWE-250 |
HOST-SYSD-002 | Custom Services Lack Sandboxing Checks whether custom long-running services use systemd's basic sandboxing options. |
Secure Configuration | Low | CWE-250, CWE-653 |
HOST-SYSD-003 | Service Unit Files Writable by Non-Root Users Checks whether any systemd service unit or drop-in file can be changed by a user other than root. |
Access Control | High | CWE-732 |
HOST-SYSD-004 | Service Programs in Writable Locations Checks whether a service starts a program from a temporary folder, or a program file that other users can replace. |
Access Control | High | CWE-732, CWE-427 |
HOST-SYSD-005 | Secrets Written Into Service Unit Files Checks whether passwords, tokens or keys are set with Environment= in systemd unit files. |
Information Exposure | Medium | CWE-526, CWE-312 |
HOST-TIME-001 | Time Synchronisation Not Active Checks that the clock is kept in sync (chrony, ntpd or systemd-timesyncd). |
Logging and Monitoring | Low | CWE-778 |
HOST-UPD-001 | Automatic Security Updates Not Configured Checks that security updates are installed automatically. |
Patch and Vulnerability Management | Low | CWE-1104 |
HOST-UPD-002 | Reboot Required to Apply Updates Checks whether installed updates (often kernel or core library fixes) are waiting for a reboot. |
Patch and Vulnerability Management | Medium | CWE-1104 |
HOST-USR-001 | Extra Accounts With Root Privileges (UID 0) Checks /etc/passwd for accounts other than root that have user id 0. |
Identity and Authentication | High | CWE-250, CWE-266 |
HOST-USR-002 | Accounts Without a Password Checks /etc/shadow for accounts whose password field is empty. |
Identity and Authentication | High | CWE-258, CWE-521 |
HOST-USR-003 | Sudo Rules Without Password (NOPASSWD) Checks sudoers files for rules that grant root without asking for a password. |
Identity and Authentication | High | CWE-306 |
HOST-USR-004 | Duplicate User IDs Checks that no two accounts share the same numeric user id. |
Identity and Authentication | Medium | CWE-286 |
HOST-USR-005 | System Accounts With Login Shells Checks that service accounts (UID below UID_MIN, usually 1000, other than root) cannot log in interactively. |
Identity and Authentication | Low | CWE-250 |
HOST-USR-006 | Legacy NIS Entries in Account Files Checks /etc/passwd, /etc/shadow and /etc/group for legacy '+' NIS inclusion entries. |
Identity and Authentication | Medium | CWE-288 |
HOST-USR-007 | Insecure Trust Files in Home Directories Looks for .rhosts, .shosts and .netrc files in user home directories. |
Identity and Authentication | High | CWE-256, CWE-290 |
HOST-USR-008 | Duplicate Group IDs or Account Names Checks /etc/group for duplicate GIDs and group names, and /etc/passwd for duplicate user names. |
Identity and Authentication | Medium | CWE-286 |
HOST-USR-009 | Password and Shadow Files Out of Step Checks that every /etc/passwd account has a /etc/shadow entry, that no password hash sits in /etc/passwd, and that /etc/shadow has no orphan entries. |
Identity and Authentication | Medium | CWE-256, CWE-522 |
HOST-USR-010 | Home Directories Accessible to Other Users Checks that the home directory of each interactive account denies read, write and execute to others. |
Access Control | Low | CWE-732, CWE-276 |
NET-AI-001 | AI Model Server or Dashboard Reachable From the Network Checks whether a self-hosted AI model server, AI web interface, AI cluster dashboard or vector database listens on a network-reachable address. |
Network Exposure | High | CWE-306, CWE-1327 |
NET-AI-002 | Jupyter Configuration Weakens Authentication Checks whether a Jupyter configuration blanks the login token without setting a password, or turns off cross-site request protection. |
Identity and Authentication | High | CWE-306, CWE-352 |
NET-APP-001 | Debugger or Application Control Ports Exposed Checks whether the Node.js inspector, Tomcat AJP or shutdown port, PHP-FPM FastCGI or Jupyter listen on network-reachable addresses. |
Network Exposure | High | CWE-489, CWE-1327 |
NET-APP-002 | Application Server Ports Reachable Without a Reverse Proxy Checks whether application servers and developer tools (Node.js, Tomcat, Django, Flask, Vite) serve HTTP on network-reachable addresses. |
Network Exposure | Medium | CWE-1188, CWE-1327 |
NET-DB-001 | Database or Cache Service Exposed to the Network Checks whether databases, caches, search engines or the Docker API listen on a network-reachable address. |
Data Services | High | CWE-1327, CWE-306 |
NET-DB-002 | Redis Authentication and Network Binding Redis lacks protected mode, authentication, or a loopback-only bind. |
Data Services | Critical | CWE-306, CWE-1188 |
NET-DB-003 | MongoDB Authorization and Network Binding MongoDB authorization is disabled or it binds beyond loopback. |
Data Services | Critical | CWE-306, CWE-1188 |
NET-DB-004 | PostgreSQL Trust and Broad Client Access PostgreSQL accepts trust authentication or unrestricted client networks. |
Data Services | Critical | CWE-306, CWE-1188 |
NET-DB-005 | MySQL or MariaDB Unsafe Network Options MySQL or MariaDB enables local file loading, skips grants, or listens broadly with networking enabled. |
Data Services | High | CWE-306, CWE-1188 |
NET-DB-006 | Memcached UDP or Broad Listen Address Memcached enables UDP or listens on a non-loopback address. |
Data Services | High | CWE-406, CWE-1188 |
NET-DB-007 | Elasticsearch Security and Network Binding Elasticsearch security is disabled or network.host is broadly reachable. |
Data Services | Critical | CWE-306, CWE-1188 |
NET-DB-008 | Unsafe NFS Export Options NFS exports are world-accessible or use no_root_squash or insecure. |
Data Services | High | CWE-732, CWE-306 |
NET-DB-009 | Unsafe Samba Guest or SMB1 Configuration Samba permits guest access, maps unknown users to guest, or allows SMB1. |
Data Services | High | CWE-732, CWE-306 |
NET-DB-010 | BIND Open Recursion BIND enables recursion without restricting recursive clients. |
Data Services | High | CWE-406 |
NET-DB-011 | BIND Zone Transfers Allowed to Any BIND permits zone transfers to any client. |
Data Services | High | CWE-497 |
NET-DB-012 | Postfix Open Relay Controls Postfix relay restrictions are missing or mynetworks trusts overly broad ranges. |
Data Services | High | CWE-441 |
NET-DB-013 | Mail Cleartext Authentication Allowed Postfix or Dovecot permits plaintext authentication without requiring TLS. |
Cryptography and TLS | Medium | CWE-319, CWE-523 |
NET-DB-014 | MySQL Symbolic Links Allowed for Tables MySQL or MariaDB does not disable symbolic links for table files (skip-symbolic-links or symbolic-links=0). |
Data Services | Medium | CWE-59, CWE-732 |
NET-DB-015 | MySQL secure_file_priv Not Restricted secure_file_priv is not set, or is set to an empty value, so LOAD DATA and SELECT ... INTO OUTFILE can read and write anywhere the server process can. |
Data Services | Medium | CWE-73, CWE-250 |
NET-DB-016 | MySQL Does Not Require Encrypted Client Connections require_secure_transport is not ON, so clients may log in and query over plaintext TCP. |
Cryptography and TLS | Medium | CWE-319 |
NET-DB-017 | MySQL Error Log Not Configured log_error is not set, so server errors, failed logins and startup warnings go to the console or syslog without a dedicated, retained file. |
Logging and Monitoring | Low | CWE-778 |
NET-DB-018 | MySQL Resolves Client Host Names skip-name-resolve is not set, so grants that name hosts depend on DNS answers and every connection waits on a reverse lookup. |
Data Services | Low | CWE-350, CWE-290 |
NET-DB-019 | PostgreSQL Uses md5 or password Authentication pg_hba.conf has active rules with the md5 or password method instead of scram-sha-256. |
Identity and Authentication | Medium | CWE-328, CWE-916 |
NET-DB-020 | PostgreSQL SSL Not Enabled postgresql.conf does not set ssl = on, so TCP clients cannot encrypt their sessions and hostssl rules cannot apply. |
Cryptography and TLS | Medium | CWE-319 |
NET-DB-021 | PostgreSQL Connection Logging Off log_connections and log_disconnections are off, so successful logins leave no record. |
Logging and Monitoring | Low | CWE-778 |
NET-DB-022 | PostgreSQL Password Encryption Not SCRAM password_encryption is set to md5, so new and changed passwords are stored as md5 verifiers that work as pass-the-hash credentials. |
Identity and Authentication | Medium | CWE-916, CWE-328 |
NET-DB-023 | Redis Dangerous Commands Not Restricted redis.conf neither renames nor disables CONFIG, FLUSHALL, FLUSHDB, DEBUG and KEYS, and no ACL user excludes the @dangerous category. |
Data Services | Medium | CWE-749 |
NET-DNS-001 | BIND Version String Disclosed named.conf has no version statement in options, so a CHAOS class query for version.bind returns the exact BIND release. |
Information Exposure | Low | CWE-497 |
NET-DNS-002 | BIND DNSSEC Validation Disabled named.conf sets dnssec-validation no, so the resolver accepts forged answers for signed zones. |
Data Services | Medium | CWE-347, CWE-350 |
NET-FW-001 | No Active Host Firewall Checks whether a host firewall (nftables, iptables, ufw or firewalld) is filtering incoming traffic. |
Network Exposure | Medium | CWE-923 |
NET-FW-002 | IPv6 Listeners Without IPv6 Firewall Network-reachable IPv6 listeners exist without a default-deny IPv6 firewall policy. |
Network Exposure | High | CWE-923 |
NET-FW-003 | Firewall Allows Sensitive Services From Anywhere Checks whether the host firewall explicitly opens a listening database, administrative or application server port to every address on the internet. |
Network Exposure | High | CWE-923, CWE-1327 |
NET-FW-004 | Firewall Rules Open Ports With No Service Checks for firewall allow rules whose port has no listening service on this machine. |
Network Exposure | Low | CWE-1188 |
NET-FW-005 | Container Ports Bypass the Host Firewall Checks whether Docker publishes container ports through its own iptables chains with no DOCKER-USER filtering. |
Network Exposure | Medium | CWE-923, CWE-1327 |
NET-FW-006 | Firewall Exposure Map of Listening Services Shows, for every network-reachable listening socket, what the host firewall does with traffic to it. |
Network Exposure | Info | CWE-923 |
NET-LSN-001 | Inventory of Listening Network Services Lists every TCP and UDP port this machine listens on, and whether it is reachable from other machines. |
Network Exposure | Info | CWE-1327 |
NET-MAIL-001 | Postfix SMTP TLS Not Offered or Has No Certificate smtpd_tls_security_level is none or unset, or is may or encrypt without a server certificate, so incoming SMTP sessions cannot be encrypted. |
Cryptography and TLS | Medium | CWE-319 |
NET-MAIL-002 | Postfix Allows TLS 1.0 or 1.1 smtpd_tls_protocols or smtpd_tls_mandatory_protocols is unset or still allows TLSv1 or TLSv1.1. |
Cryptography and TLS | Medium | CWE-326, CWE-327 |
NET-MAIL-003 | Postfix VRFY Command Enabled disable_vrfy_command is not yes, so anyone who connects can ask the server whether a mailbox exists. |
Information Exposure | Low | CWE-204 |
NET-MAIL-004 | Dovecot Does Not Require TLS Dovecot's ssl setting is yes or no instead of required, so IMAP and POP3 clients may use unencrypted sessions. |
Cryptography and TLS | Medium | CWE-319 |
NET-SVC-001 | Cleartext Legacy Services Listening Checks for Telnet, FTP, rsh/rlogin, TFTP, plain POP3/IMAP/LDAP, SNMP v1/v2c and rsync daemons on network-reachable addresses. |
Network Exposure | High | CWE-319 |
NET-SVC-002 | Control Plane or Remote Desktop Ports Network-Reachable Docker API, Kubernetes API, kubelet, etcd, VNC or RDP listen on network-reachable addresses. |
Network Exposure | Critical | CWE-1327, CWE-923 |
NET-SVC-003 | Network Time Service Amplification Risk NTP or chrony serves broad clients or permits legacy monitoring commands that can amplify traffic. |
Network Exposure | High | CWE-406 |
NET-SVC-004 | Management Panel or Monitoring Ports Network-Reachable Webmin, cPanel, WHM, RabbitMQ Management, Consul, the Docker API with TLS or the Prometheus node exporter listen on network-reachable addresses. |
Network Exposure | Medium | CWE-1188, CWE-1327 |
NET-TLS-001 | Deprecated TLS 1.0 or 1.1 Accepted Checks whether local TLS services still accept TLS 1.0 or TLS 1.1. |
Cryptography and TLS | Medium | CWE-326, CWE-327 |
NET-TLS-002 | TLS Certificate Expired or Expiring Soon Checks the expiry date of the certificate each local TLS service presents. |
Cryptography and TLS | Medium | CWE-298 |
NET-TLS-003 | Self-Signed or Mismatched TLS Certificate Checks whether each site presents a self-signed certificate, or one that does not cover its name. |
Cryptography and TLS | Medium | CWE-295, CWE-297 |
NET-TLS-004 | Weak TLS 1.2 Cipher Suites Accepted A local TLS service accepts an RC4, 3DES, or CBC with SHA-1 cipher suite under TLS 1.2. |
Cryptography and TLS | Medium | CWE-326, CWE-327 |
NET-TLS-005 | TLS Certificate Public Key Too Small A TLS leaf certificate uses RSA below 2048 bits or an elliptic curve below 256 bits. |
Cryptography and TLS | Medium | CWE-326 |
NET-TLS-006 | SHA-1 Signed TLS Leaf Certificate A TLS leaf certificate is signed using SHA-1. |
Cryptography and TLS | Medium | CWE-327 |
WEB-APA-001 | Apache Reveals Version in Header and Footer ServerTokens is not Prod or ServerSignature is On, so responses and error pages show the Apache version and modules. |
Information Exposure | Low | CWE-497 |
WEB-APA-002 | Apache TRACE Method Enabled TraceEnable is not set to Off, so the HTTP TRACE method echoes requests back to the client. |
Secure Configuration | Low | CWE-1188, CWE-749 |
WEB-APA-003 | Apache Directory Indexes Enabled in Configuration An Options directive enables Indexes (or All), so folders without an index page list their files. |
Information Exposure | Medium | CWE-548 |
WEB-APA-004 | Apache AllowOverride All Permits .htaccess Control A Directory block sets AllowOverride All, so any .htaccess file under it can change handlers, options and access rules. |
Secure Configuration | Low | CWE-15, CWE-1188 |
WEB-APA-005 | Apache Allows TLS 1.0 or 1.1 SSLProtocol permits SSLv3, TLSv1 or TLSv1.1, or is not set on a TLS-enabled server (the default all -SSLv3 allows TLS 1.0 and 1.1). |
Cryptography and TLS | High | CWE-326, CWE-327 |
WEB-APA-006 | Apache Cipher Suite Includes Weak Suites SSLCipherSuite includes NULL, export, DES or 3DES, RC4, MD5, anonymous or other legacy suites, or SSLHonorCipherOrder forces a legacy order. |
Cryptography and TLS | High | CWE-327 |
WEB-APA-007 | Apache OCSP Stapling Not Enabled A TLS-enabled Apache does not set SSLUseStapling on. |
Cryptography and TLS | Low | CWE-299 |
WEB-APA-008 | Apache Has No Request Filtering Module Neither mod_security (ModSecurity) nor mod_evasive is loaded, so Apache has no request filtering or flood control in front of the application. |
Secure Configuration | Info | CWE-1188 |
WEB-APA-009 | Apache ETag Reveals Inode Numbers FileETag includes INode (or All), so ETag headers leak filesystem inode numbers of served files. |
Information Exposure | Low | CWE-497 |
WEB-APA-010 | Apache Serves Repository and Environment Files No DirectoryMatch, FilesMatch or RedirectMatch rule denies .git, .svn, .hg or .env paths, so they are served if present under a document root. |
Information Exposure | Low | CWE-538, CWE-527 |
WEB-APA-011 | Apache Has No Slow Request Protection mod_reqtimeout does not appear to be loaded and no RequestReadTimeout is set, so a client that sends its request very slowly can hold a worker for the whole Timeout. |
Secure Configuration | Medium | CWE-770 |
WEB-APP-001 | Laravel Debug Mode On or Application Key Missing Checks Laravel .env files for APP_DEBUG=true or an empty APP_KEY. |
Information Exposure | High | CWE-489, CWE-209, CWE-321 |
WEB-APP-002 | Application .env File Readable by All Users Checks the permission bits of framework .env files for world-read access. |
Access Control | Medium | CWE-732, CWE-312 |
WEB-APP-003 | Symfony Running in the Development Environment Checks Symfony .env files for APP_ENV=dev or APP_DEBUG=1. |
Information Exposure | High | CWE-489, CWE-215 |
WEB-APP-004 | Rails Master Key or Secrets File Exposed Checks Rails config/master.key, credentials key files and secrets.yml for world-read permissions or a location inside a web root. |
Access Control | High | CWE-732, CWE-312, CWE-321 |
WEB-APP-005 | Rails Production Does Not Force HTTPS Checks config/environments/production.rb for config.force_ssl = true. |
Web Application Security | Medium | CWE-319, CWE-614 |
WEB-APP-006 | Spring Boot Actuator Endpoints Fully Exposed Checks Spring Boot application properties for management.endpoints.web.exposure.include=* and probes the local site for an open /actuator/env. |
Information Exposure | High | CWE-306, CWE-497 |
WEB-APP-007 | Flask Debug Mode Enabled in Application Code Looks for app.run(debug=True) or app.debug = True in Flask entry files. A heuristic; the service check WEB-PY-004 covers the environment switches. |
Secure Configuration | Low | CWE-489, CWE-215 |
WEB-APP-008 | Dependency Lock Files Older Than a Year Reports composer.lock, package-lock.json, yarn.lock, Gemfile.lock and poetry.lock files not modified for 365 days or more (dependency freshness). Informational. |
Patch and Vulnerability Management | Info | CWE-1104, CWE-1395 |
WEB-APP-009 | Git Repository Stored Inside a Web Root Looks on disk for a .git folder directly inside each web document root. |
Information Exposure | Medium | CWE-527, CWE-538 |
WEB-APP-010 | Framework Writable Folders Open to All Users Checks Laravel and Symfony cache, log and storage folders for world-write permission. |
Access Control | Medium | CWE-732, CWE-94 |
WEB-CK-001 | Cookies Missing Secure, HttpOnly or SameSite Checks the security flags on cookies the home page sets. |
Web Application Security | Medium | CWE-614, CWE-1004, CWE-1275 |
WEB-CMS-001 | WordPress Version Disclosed Checks whether WordPress sites reveal their exact version in the page or in readme.html. |
Information Exposure | Low | CWE-497 |
WEB-CMS-002 | WordPress XML-RPC Interface Enabled Checks whether xmlrpc.php answers on WordPress sites. |
Web Application Security | Low | CWE-307 |
WEB-CMS-003 | WordPress User Accounts Enumerable Checks whether the WordPress REST API lists user accounts to anonymous visitors. |
Information Exposure | Low | CWE-204 |
WEB-CMS-004 | CMS Configuration Readable by All Users Checks whether wp-config.php, Joomla configuration.php or Drupal settings.php can be read by every local user. |
Access Control | High | CWE-732, CWE-260 |
WEB-CMS-005 | CMS Configuration Writable by Other Users Checks whether wp-config.php, Joomla configuration.php or Drupal settings.php is group- or world-writable. |
Access Control | High | CWE-732 |
WEB-CMS-006 | WordPress Shows Debug Output to Visitors Checks wp-config.php for WP_DEBUG enabled without WP_DEBUG_DISPLAY set to false. |
Information Exposure | Medium | CWE-209, CWE-489 |
WEB-CMS-007 | WordPress Dashboard File Editor Enabled Checks whether wp-config.php leaves the built-in theme and plugin file editor enabled. |
Secure Configuration | Low | CWE-94, CWE-1188 |
WEB-CMS-008 | WordPress Automatic Updates Disabled Checks whether wp-config.php turns off WordPress background updates, including security releases. |
Patch and Vulnerability Management | Medium | CWE-1104 |
WEB-CMS-009 | Joomla Debug or Verbose Error Reporting Enabled Checks Joomla configuration.php for debug mode or maximum/development error reporting. |
Information Exposure | Medium | CWE-209, CWE-489 |
WEB-CMS-010 | Joomla Version Disclosed Checks whether a Joomla site serves its version manifest at /administrator/manifests/files/joomla.xml. |
Information Exposure | Low | CWE-497 |
WEB-CMS-011 | Drupal Version Disclosed by Changelog Checks whether a Drupal site serves CHANGELOG.txt, which names the exact Drupal version. |
Information Exposure | Low | CWE-497 |
WEB-CMS-012 | Drupal Core Past End of Life Reads the installed Drupal core version from disk and compares its major release with the Drupal security coverage dates. |
Patch and Vulnerability Management | High | CWE-1104 |
WEB-CMS-013 | Drupal Trusted Host Patterns Not Set Checks Drupal settings.php for the trusted_host_patterns setting. |
Web Application Security | Medium | CWE-644, CWE-346 |
WEB-CMS-014 | Joomla Core Past End of Life Reads the installed Joomla version from administrator/manifests/files/joomla.xml on disk and compares it with the Joomla support dates. |
Patch and Vulnerability Management | High | CWE-1104 |
WEB-CMS-015 | Magento Not in Production Mode Checks app/etc/env.php for a MAGE_MODE other than production. |
Information Exposure | Medium | CWE-489, CWE-209 |
WEB-CMS-016 | Ghost Configured With a Plain HTTP Site URL Checks Ghost config.production.json for a url that starts with http://. |
Web Application Security | Medium | CWE-319 |
WEB-CMS-017 | WordPress Cron Reachable by Visitors Reports whether /wp-cron.php answers to anonymous requests on WordPress sites. Informational. |
Secure Configuration | Info | CWE-770 |
WEB-CMS-018 | WordPress Author Archive Reveals Login Names Checks whether /?author=1 redirects to an author archive, which exposes the first account's login name in the address. |
Information Exposure | Low | CWE-204 |
WEB-CMS-019 | Drupal update.php Open Without Authentication Checks Drupal settings.php for $settings['update_free_access'] = TRUE. |
Secure Configuration | High | CWE-306 |
WEB-COR-001 | Cross-Origin Resource Sharing Allows Any Origin With Credentials Checks the home page's CORS headers for a wildcard origin combined with credentials, or an origin of null. |
Web Application Security | Medium | CWE-942 |
WEB-CVE-001 | Vulnerable Web Application Libraries Matches local web library versions against offline OSV advisories; WordPress core is inventoried and reported Incomplete because OSV publishes no WordPress feed. |
Patch and Vulnerability Management | High | CWE-1104 |
WEB-DOC-001 | Secrets or Backups Stored Inside a Web Root Looks on disk inside each web document root for environment files, database dumps, backups, archives and private keys. |
Information Exposure | High | CWE-530, CWE-538, CWE-312 |
WEB-DOC-002 | Web Root Files Writable by Other Users Looks for world-writable files inside web document roots. |
Access Control | High | CWE-732 |
WEB-DOC-003 | Archives or Certificates Inside a Web Root Lists archives (*.tar.gz, *.tgz, *.tar, *.7z) and certificate files (*.pem, *.crt) inside each web document root for review, outside download folders. |
Information Exposure | Medium | CWE-538, CWE-552 |
WEB-EXP-001 | Git Repository Exposed on the Website Checks whether the .git folder can be downloaded from each site. |
Information Exposure | High | CWE-527, CWE-538 |
WEB-EXP-002 | Environment or Secrets File Exposed Checks whether .env and similar configuration files can be downloaded. |
Information Exposure | Critical | CWE-538, CWE-260 |
WEB-EXP-003 | PHP Information Page Exposed Checks for phpinfo() pages left on the site. |
Information Exposure | Medium | CWE-497 |
WEB-EXP-004 | Backup or Database Dump Files Downloadable Checks for common backup archives and SQL dumps left in the web root. |
Information Exposure | High | CWE-530 |
WEB-EXP-005 | Directory Listing Enabled Checks whether the web server lists folder contents when there is no index page. |
Information Exposure | Medium | CWE-548 |
WEB-EXP-006 | Web Server Status Page Exposed Checks whether Apache server-status/server-info or nginx stub_status are reachable for each site. |
Information Exposure | Medium | CWE-497 |
WEB-EXP-007 | Other Version Control Metadata Exposed Checks for exposed Subversion, Mercurial and Bazaar metadata folders. |
Information Exposure | High | CWE-527 |
WEB-EXP-008 | Log Files Downloadable From the Website Checks for application and debug logs published under the web root. |
Information Exposure | High | CWE-532, CWE-538 |
WEB-EXP-009 | Dependency Manifests Exposed Checks whether package manifests and lock files are downloadable. |
Information Exposure | Low | CWE-538 |
WEB-EXP-010 | Default Web Server Page Served Checks whether a site shows the web server's default installation page. |
Information Exposure | Low | CWE-1188, CWE-497 |
WEB-EXP-011 | Database Administration Tool Exposed Checks whether phpMyAdmin or Adminer login pages are publicly reachable. |
Information Exposure | Medium | CWE-1188, CWE-306 |
WEB-EXP-012 | Framework Debug Pages Exposed Checks for development debug tools and verbose error pages left enabled in production. |
Information Exposure | High | CWE-489, CWE-209 |
WEB-HDR-001 | Missing HTTP Strict Transport Security (HSTS) Checks that HTTPS sites tell browsers to always use HTTPS, for at least six months. |
Web Application Security | Medium | CWE-319, CWE-523 |
WEB-HDR-002 | Missing Content Security Policy Checks that each site sends a Content-Security-Policy header. |
Web Application Security | Medium | CWE-1021, CWE-79 |
WEB-HDR-003 | Site Can Be Framed (Clickjacking) Checks that each site forbids being embedded in other sites' frames. |
Web Application Security | Medium | CWE-1021 |
WEB-HDR-004 | Missing X-Content-Type-Options Checks that browsers are told not to guess (sniff) content types. |
Web Application Security | Low | CWE-430 |
WEB-HDR-005 | Missing Referrer-Policy Checks that each site limits what URL information is leaked to other sites in the Referer header. |
Web Application Security | Low | CWE-201 |
WEB-HDR-006 | Missing Permissions-Policy Checks that each site restricts powerful browser features (camera, microphone, geolocation) it does not use. |
Web Application Security | Low | CWE-1188 |
WEB-HDR-007 | Server Software Version Disclosed Checks whether response headers reveal exact web server, PHP or framework versions. |
Information Exposure | Low | CWE-497 |
WEB-NGX-001 | nginx Version Shown in Server Header nginx does not set server_tokens off, so responses and error pages carry the exact nginx version. |
Information Exposure | Low | CWE-497 |
WEB-NGX-002 | nginx Directory Listing Enabled in Configuration An nginx server or location block sets autoindex on. |
Information Exposure | Medium | CWE-548 |
WEB-NGX-003 | nginx Allows TLS 1.0 or 1.1 ssl_protocols lists SSLv3, TLSv1 or TLSv1.1, or is not set on a TLS-enabled server, so the allowed version depends on the nginx build. |
Cryptography and TLS | High | CWE-326, CWE-327 |
WEB-NGX-004 | nginx Cipher List Includes Weak Suites ssl_ciphers includes NULL, export, DES or 3DES, RC4, MD5, anonymous or other legacy suites, or ssl_prefer_server_ciphers forces a legacy order. |
Cryptography and TLS | High | CWE-327 |
WEB-NGX-005 | nginx OCSP Stapling Off or Session Tickets On A TLS-enabled nginx does not enable ssl_stapling, or leaves ssl_session_tickets on. |
Cryptography and TLS | Low | CWE-299, CWE-326 |
WEB-NGX-006 | nginx Request Limits Not Configured nginx sets no client_max_body_size, limit_req_zone or limit_conn_zone, so request size and rate rely on defaults alone. |
Secure Configuration | Info | CWE-770, CWE-307 |
WEB-NGX-007 | nginx Serves Hidden Files and Folders No location block denies paths that begin with a dot, so .git, .env, .svn and .htaccess files under the document root are served if present. |
Information Exposure | Medium | CWE-538, CWE-527 |
WEB-NODE-001 | Node.js Version Past End of Life Checks whether the installed Node.js runtime is a release line that no longer receives security fixes. |
Patch and Vulnerability Management | High | CWE-1104 |
WEB-NODE-002 | Node.js Debugger (Inspector) Enabled in a Service Checks whether a Node.js service is started with --inspect, which opens the V8 debugger. |
Secure Configuration | Critical | CWE-489, CWE-306 |
WEB-NODE-003 | Node.js Service Not Running in Production Mode Checks whether Node.js services set NODE_ENV=production. |
Secure Configuration | Low | CWE-489, CWE-209 |
WEB-PHP-001 | PHP Displays Errors to Visitors Checks whether PHP prints error messages into web pages. |
Secure Configuration | Medium | CWE-209 |
WEB-PHP-002 | PHP Version Exposed in Headers Checks whether PHP adds an X-Powered-By header with its version. |
Information Exposure | Low | CWE-497 |
WEB-PHP-003 | PHP Allows Remote File Inclusion Checks whether include() and require() may load code from URLs. |
Secure Configuration | High | CWE-98 |
WEB-PHP-004 | PHP Version Past End of Security Support Checks whether the installed PHP branch still receives security fixes from the PHP project. |
Patch and Vulnerability Management | High | CWE-1104 |
WEB-PHP-005 | PHP Session Cookies Not Hardened Checks PHP's session settings: HttpOnly and SameSite cookies and strict session id mode. |
Web Application Security | Medium | CWE-1004, CWE-384 |
WEB-PY-001 | Django Debug Mode Enabled Checks Django settings files for DEBUG = True with no production override. |
Information Exposure | High | CWE-489, CWE-215 |
WEB-PY-002 | Django Accepts Any Host Header Checks Django settings for ALLOWED_HOSTS = ['*']. |
Web Application Security | Medium | CWE-346 |
WEB-PY-003 | Django Uses the Generated Development Secret Key Checks Django settings for a SECRET_KEY that starts with django-insecure-, the marker of the key generated by startproject. |
Cryptography and TLS | High | CWE-798, CWE-321 |
WEB-PY-004 | Python Interactive Debugger Enabled in a Service Checks whether a service runs Flask or Werkzeug with the interactive debugger enabled. |
Secure Configuration | Critical | CWE-489, CWE-94 |
WEB-PY-005 | Python Development Server Used in a Service Checks whether a service runs a development web server such as manage.py runserver, flask run or python -m http.server. |
Secure Configuration | Medium | CWE-489, CWE-1188 |
WEB-SEC-001 | No security.txt Contact File Checks whether each site publishes /.well-known/security.txt (RFC 9116). |
Web Application Security | Info | CWE-1188 |
WEB-TLS-001 | Site Available Over Plain HTTP Without Redirect Checks that every site redirects http:// requests to https://. |
Cryptography and TLS | Medium | CWE-319 |
WEB-TOM-001 | Tomcat Manager Reachable Without Address Restriction Checks whether the Tomcat Manager or Host Manager application is deployed without an address filter limiting it to localhost. |
Web Application Security | High | CWE-1188, CWE-923 |
WEB-TOM-002 | Tomcat Administrative Users With Default or Weak Passwords Checks tomcat-users.xml for manager or admin accounts with well-known default passwords, passwords equal to the user name, or short passwords. |
Identity and Authentication | Critical | CWE-1392, CWE-521, CWE-256 |
WEB-TOM-003 | Tomcat Shutdown Port Uses the Default Command Checks whether Tomcat's shutdown port is enabled with the well-known default command SHUTDOWN. |
Secure Configuration | Medium | CWE-1188 |
WEB-TOM-004 | Tomcat AJP Connector Unprotected (Ghostcat) Checks for an active AJP connector that has no shared secret and is not bound to loopback, or that disables the secret requirement. |
Web Application Security | Critical | CWE-306, CWE-1327 |
WEB-TOM-005 | Tomcat Example and Documentation Applications Deployed Checks whether the examples or docs web applications that ship with Tomcat are deployed. |
Information Exposure | Medium | CWE-1188 |
| No checks match. Clear a filter or change the search. | ||||
Dataset
The whole catalogue is published as one JSON file, generated from the code at every build: id, title, domain, severity, CVSS v3.1 vector, control category with its CIS Controls v8 and NIST CSF 2.0 mapping, CWE, OWASP Top 10, ASVS, WSTG and NIST SP 800-53 identifiers, the Academy modules that teach each check, and a permalink to the source file at this commit.
Licence: OpenVAPT Source-Available Licence 1.3. Credit is required when you copy or adapt the data: "Data from OpenVAPT (openvapt.com), version 0.1.0-alpha.6, built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3." See How to Cite OpenVAPT. Severities describe a typical internet-facing server; they are not a measure of your own risk.