Web

Test Name

Synopsis

Eth-Sec-Web-001

Verify the Web Server Not Leaks Information via HTTP Headers

Eth-Sec-Web-002

Verify the Web Application Not Vulnerable to Clickjacking

Eth-Sec-Web-003

Verify the Content Security Policy Not Includes Weakening Rules

Eth-Sec-Web-004

Verify the web server enforce HTTP Strict Transport Security (HSTS)

Eth-Sec-Web-005

Verify the web server's unauthentication access via cgi-bin

Eth-Sec-Web-006

Verify the web server directory listing

Eth-Sec-Web-007

Verify path traversal of the web server

Eth-Sec-Web-008

Verify XSS for non-exist page

Eth-Sec-Web-009

Verify wrong password must not be able to login after user already login

Eth-Sec-Web-010

Verify user not able to login with correct credential after lock out

Eth-Sec-Web-011

Verify only allow one valid session at the same time