Author Topic: Why website flagged at VirusWatch archives?  (Read 981 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33921
  • malware fighter
Why website flagged at VirusWatch archives?
« on: February 22, 2016, 07:27:18 PM »
See Sucuri flag it and Quttera not: https://sitecheck.sucuri.net/results/techsanat.com
No vulnerable jQuery detected, but consider this:
http://www.domxssscanner.com/scan?url=http%3A%2F%2Fwww.techsanat.com%2Fcore%2Flib%2Fjquery.min.js
Name server versions exposed and other issues: http://www.dnsinspect.com/techsanat.com/1456164713
All scripts same origin - no SRI issues. 25% of the trackers on this site could be protecting you from NSA snooping. Tell techsanat.com to fix it
Website risk status: http://toolbar.netcraft.com/site_report?url=http://www.techsanat.com
Cookies not flagged as "HttpOnly" may be read by client side script and are at risk of being interpreted by a cross site scripting (XSS) attack. Whilst there are times where a cookie set by the server may be legitimately read by client script, most times the "HttpOnly" flag is missing it is due to oversight rather than by design.

Result
It looks like a cookie is being set without the "HttpOnly" flag being set (name : value):

PHPSESSID : fc71d465760xxxxxxxffab6d396516f
Unless the cookie legitimately needs to be read by JavaScript on the client, the "HttpOnly" flag should always be set to ensure it cannot be read by the client and used in an XSS attack.

Could be IP badness history: https://www.virustotal.com/en/ip-address/51.255.20.184/information/
Re: http://www.scumware.org/report/51.255.20.184.html

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!