Used checks

This section describes the checks used during application scanning.

For more precise vulnerability detection, the scanner can check addresses outside the scan scope. Some checks are performed only within the target address (specified by the user). Others will execute requests outside the specified address as well.

Besides, there are also checks that are performed only outside the scan scope: Version vulnerabilities of software components, Protocol checks, and Source map disclosure.

A full list of vulnerabilities detected by PT BlackBox during a specific check is described in the Detectable vulnerabilities appendix.

Used checks
Check	Description	Category of tests	Scan profile that includes the check
Version vulnerabilities of software components	Detects versions of third-party components and checks them for possible vulnerabilities. The scan results report will list confirmed and unconfirmed vulnerabilities in the target system	Target address and check outside the scan area	Server security
			Optimal scan
			Passive scan
			Full scan
Bitrix vulnerabilities	Detects 1C-Bitrix vulnerabilities used in massive attacks based on public exploits	Target address. Using the Path value in the Scan scope setting is not recommended	Server security
			Dangerous vulnerabilities
			Optimal scan
			Full scan
Cross-site requests	Detects HTTP vulnerabilities that can be exploited to attack application users using malicious websites and scripts	Specified scan scope	Full scan
Directory disclosure	Notifies about open directories on the web server. If you use the Full scan profile, all found directories are checked regardless of the crawling type. In this case, scan duration is significantly increased	Target address. Using the Path value in the Scan scope setting is not recommended	Server security
			Dangerous vulnerabilities
			Optimal scan
			Passive scan
			Full scan
DNS rebinding	Checks how a web server processes HTTP requests with arbitrary `Host` header values	Target address	Server security
			Optimal scan
			Passive scan
			Full scan
Checking the network perimeter	Searches for subdomains, open ports, and web services deployed on them	Specified scan scope	Server security
			Transport-layer security
			Optimal scan
			Full scan
			Perimeter scan
File operations	Detects vulnerabilities that allow arbitrary local and deleted files and scripts with malicious code to be executed	Specified scan scope	Server security
			Dangerous vulnerabilities
			Optimal scan
			Full scan
Arbitrary file upload	Sends files with various extensions and content to the web server file system and attempts to run them. If during the check the scanner fails to access the uploaded file, the severity level decreases	Specified scan scope	Server security
			Dangerous vulnerabilities
			Optimal scan
			Full scan
HTML code injection	Checks an application for HTML code injection, for example, if the `<iframe>` tag has a link to a malicious resource	Specified scan scope	Full scan
HTTP header injection	Detects vulnerabilities that allow an attacker to control an HTTP response body and headers, run cross-site scripts, and conduct attacks on intermediate proxy servers	Specified scan scope	Server security
			Optimal scan
			Full scan
Protocol checks	Checks that an application uses a secure protocol and redirects from HTTP to HTTPS	Target address and check outside the scan area	Server security
			Transport-layer security
			Optimal scan
			Passive scan
			Full scan
Information vulnerabilities	Checks the application for compliance with the information security guidelines and for the presence of sensitive information in the public domain	Specified scan scope	Server security
			Optimal scan
			Passive scan
			Full scan
MS HTTP system vulnerabilities	Checks Microsoft systems for vulnerabilities that allow attackers to execute arbitrary code using a system account	Target address	Server security
			Dangerous vulnerabilities
			Full scan
Open redirect	Checks an application for vulnerabilities that allow automatic user redirection to a malicious address	Specified scan scope. Using the Path scan scope is not recommended. (It does not guarantee correct vulnerability search.)	Full scan
OS command execution	Detects vulnerabilities that allow an attacker to execute arbitrary operating system commands on a target	Specified scan scope	Server security
			Dangerous vulnerabilities
			Optimal scan
			Full scan
PHP configuration checks	Checks the PHP configuration file settings that affect application security and the presence of excessive sensitive information in public access	Specified scan scope	Server security
			Optimal scan
			Passive scan
			Full scan
Arbitrary code execution	Detects vulnerabilities that allow attackers to execute arbitrary code (RCE)	Specified scan scope	Server security
			Dangerous vulnerabilities
			Optimal scan
			Full scan
Shellshock	Checks the operating system for the Bash interpreter vulnerability	Target address	Server security
			Dangerous vulnerabilities
			Optimal scan
			Full scan
Source map disclosure	Public access to .map files	Target address and check outside the scan area	Optimal scan
			Passive scan
			Full scan
SQL injection	Checks if SQL queries can be injected via user input. During scanning, the following attack types are used: error-based, time-based, and boolean-based attacks. For a thorough check of the target system, you must use the SQL injection check together with the SQL injection or Full scan profile	Specified scan scope	Server security
			SQL injection
			Dangerous vulnerabilities
			Optimal scan
			Full scan
SSI injection	Checks if SSI commands can be injected via user input. An attacker may exploit this vulnerability to inject any content including malicious JavaScript code	Specified scan scope	Server security
			Optimal scan
			Full scan
SSL configuration checks	Verifies the secure connection configuration (SSL/TLS), such as encryption algorithms	Target address	Server security
			Transport-layer security
			Optimal scan
			Full scan
Server-side template injection	Checks if code can be injected into an application template via user input, passed, and executed on the server side (SSTI)	Specified scan scope	Server security
			Dangerous vulnerabilities
			Optimal scan
			Full scan
Insecure HTTP method checks	Checks if the insecure HTTP methods (`OPTIONS`, `TRACK`, and `TRACE`) are used	Target address	Full scan
XPath injection	Checks if arbitrary operators can be injected into XPath queries due to incorrect validation of user input	Specified scan scope	Full scan
Cross-site scripting	Checks if malicious scripts can be executed in the user's browser because of vulnerable GET parameters in the application	Specified scan scope	Cross-site scripting
			Optimal scan
			Full scan
Stored cross-site scripting	Checks if malicious scripts can be executed in the user's browser because of vulnerable POST parameters in the application. The Stored cross-site scripting check cannot be performed without the Cross-site scripting check	Specified scan scope	Cross-site scripting
			Optimal scan
			Full scan
XML external entity injection	Checks if XML external entities can be injected (XXE attack). The vulnerability allows attackers to interfere with XML data processing in the application	Specified scan scope	Server security
			Dangerous vulnerabilities
			Optimal scan
			Full scan