MENU
In the screenshot below, which of the following is incorrect?
Target: https://example.com
HTTP/1.1 404 Not Found
Date: Fri, 09 Dec 2022 18:03:49 GMT
Server: Apache
Vary: Cookie
X-Powered-By: PHP/5.4.5-5
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Cookie: JSESSIONID=1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789; secure; HttpOnly; SameSite=None
The screenshot shows an HTTP response header from https://example.com with a 404 status. Let's evaluate each option:
Option A ('The application discloses the framework name and version'): The X-Powered-By: PHP/5.4.5-5 header reveals the server is running PHP version 5.4.5-5, which is a security risk as it exposes the framework and version. This information can help attackers identify known vulnerabilities, making A incorrect (i.e., it is a problem).
Option B ('The application reveals user-agent details'): The response does not include user-agent details; it only shows the server's configuration. User-agent details are part of the request, not the response, so this is incorrect (not a problem here).
Option C ('A cookie is set with HttpOnly and a Secure flag'): The Cookie header includes HttpOnly and Secure attributes, which are best practices to prevent JavaScript access and ensure transmission over HTTPS, respectively. This is correct behavior, so it is not incorrect.
Option D ('The application accepts insecure protocol'): The response uses https://, indicating a secure protocol (TLS), and there's no evidence of accepting insecure protocols like HTTP. This is not incorrect.
Thus, the incorrect statement is A, as disclosing the framework name and version via X-Powered-By is a security misconfiguration. This aligns with the CAP syllabus under 'Security Headers' and 'Information Disclosure.'