A6:2021 Vulnerable and Outdated Components

Below we document the steps to test the A6:2021 Vulnerable and Outdated Components security risk only. Use this test to:

  • Leverage multi-vector testing to identify security misconfiguration issues across:
    • the web application
    • the underlying server
    • the backend environment

Please note that you can combine tests and run more than one on a specific target or set of targets.

  1. On the Risk Types dialogs of the Wizard, select A6 - Vulnerable and Outdated Components.

  2. Click Next until you are past the Risk Types selection. For the following steps ONLY A6 - Vulnerable and Outdated Components is selected.

    If you selected Look for Sensitive Information in documents, this dialog displays to configure.

    Authentication tests configuration

    You can instruct Core Impact to Search for credit card numbers or Search for social security numbers in any documents it finds.

    Additionally, add a Custom Search Pattern to help Core Impact find specific data - enter an extended regular expression and that would be run across all the HTML pages that the wizard is targeting.

    Check the Apply search filters inside Microsoft Office, OpenOffice and PDF Documents option if you want the test to search inside of documents that are linked from the HTML pages.

    Check the Save documents matching search filters option if you want Core Impact to save any documents where it locates sensitive data. Then provide a path where the documents should be saved.

    Press Next to continue.

  3. The final dialog—Session Management—displays.

    Session Management

    To configure a module to avoid testing pages that could terminate the session, use the ellipsis () button. By default, the Session arguments avoid list module will be enabled for this purpose. Click the Clear button if you do not want any module to perform this function.

  4. Click the Finish button to begin the test.

If the WebApps Attack and Penetration is successful, then a new XXE Agent will appear under vulnerable pages in the Entity View. See Interacting with WebApps Agents for information about how to leverage the WebApps Agents.

Return to WebApps Attack and Penetration.