QCSS Passive Vulnerability Lab Discovery
All values are fake scanner fixtures.
/comments
/passive-html-secrets
/client-risks
/mixed-content
/profile-update
/csrf-weak
/oauth-info
/oauth-demo
/files/
/directory-listing
/backups/
/receipt?credit_card_number=4111111111111111
/checkout?credit_card_number=4111111111111111&api_key=fakepassiveapikey1234567890&token=fakepasstoken1234567890
/api/callback?token=fakecallbacktoken1234567890
/config
/config.php.bak
/index.php~
/app.old
/bucket
/robots.txt
/phpinfo.php
/xmlrpc.php
/.git/config
/.svn/entries
/site.zip
/backup.zip
/backup.tar.gz
/api/lab/secrets
/api/lab/env
/api/lab/private-key
/api/lab/contact-dump
/api/lab/internal-map
/api/lab/error/python
/api/lab/error/javascript
/api/lab/deserialization/java
/api/lab/deserialization/python
/api/lab/permissions
/api/lab/cookie-demo
/api/lab/cors/wildcard
/api/lab/cors/credentials
/api/lab/cors/null-origin
/api/lab/hpp?item=1&item=2
/api/jwt
/api/user/profile
/static/jquery-1.12.4.min.js
/static/obfuscated-demo.js
/static/client-logging-demo.js
/static/passive-extra.js
/weak-csp
/cache-test
/ws-demo