omen-sec-cli 1.0.19 → 1.0.20
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.omen/context.json +565 -0
- package/README.md +2 -2
- package/bin/index.js +1 -1
- package/core/discover/stack-detector.js +56 -7
- package/core/engine-v2.js +33 -9
- package/core/remote-scanner.js +2 -2
- package/core/reporters/fix-plan-reporter.js +1 -1
- package/core/ui-server.js +12 -8
- package/omen-reports/omen-fix-plan.md +139 -0
- package/omen-reports/omen-report.json +557 -22
- package/omen-reports/omen-report.md +129 -0
- package/omen-reports/omen-report.txt +53 -7
- package/package.json +1 -1
- package/ui/banner.js +1 -1
|
@@ -0,0 +1,565 @@
|
|
|
1
|
+
{
|
|
2
|
+
"schema_version": "1.0",
|
|
3
|
+
"project": {},
|
|
4
|
+
"discovery": {
|
|
5
|
+
"path": "https://www.fnstore.com.br/",
|
|
6
|
+
"stack": "Vercel",
|
|
7
|
+
"entrypoints": [],
|
|
8
|
+
"boot_strategy": "Remote URL",
|
|
9
|
+
"critical_files": [],
|
|
10
|
+
"dependencies": {},
|
|
11
|
+
"is_remote": true
|
|
12
|
+
},
|
|
13
|
+
"plan": {
|
|
14
|
+
"steps": [
|
|
15
|
+
{
|
|
16
|
+
"id": "static",
|
|
17
|
+
"action": "Static Analysis",
|
|
18
|
+
"status": "pending"
|
|
19
|
+
},
|
|
20
|
+
{
|
|
21
|
+
"id": "dynamic",
|
|
22
|
+
"action": "Dynamic Analysis (Remote)",
|
|
23
|
+
"status": "pending"
|
|
24
|
+
}
|
|
25
|
+
]
|
|
26
|
+
},
|
|
27
|
+
"execution": {
|
|
28
|
+
"status": "completed",
|
|
29
|
+
"vulnerabilities": [
|
|
30
|
+
{
|
|
31
|
+
"id": "REM-VULN-1774371576147-2",
|
|
32
|
+
"kind": "header",
|
|
33
|
+
"category": "confirmed",
|
|
34
|
+
"confidence": "high",
|
|
35
|
+
"severity": "high",
|
|
36
|
+
"title": "Content-Security-Policy Missing",
|
|
37
|
+
"description": "CSP header is missing. Without a strict Content-Security-Policy, the application is highly vulnerable to Cross-Site Scripting (XSS) and data injection attacks.",
|
|
38
|
+
"cwe": "CWE-1022",
|
|
39
|
+
"evidence": {
|
|
40
|
+
"request": {
|
|
41
|
+
"headers": {}
|
|
42
|
+
},
|
|
43
|
+
"response": {
|
|
44
|
+
"status": 200,
|
|
45
|
+
"headers": {
|
|
46
|
+
"access-control-allow-origin": "*",
|
|
47
|
+
"age": "386824",
|
|
48
|
+
"cache-control": "public, max-age=0, must-revalidate",
|
|
49
|
+
"content-disposition": "inline",
|
|
50
|
+
"content-type": "text/html; charset=utf-8",
|
|
51
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
52
|
+
"etag": "W/\"b0ab7ef6eae8580cc8fa3a3fe31ee2d2\"",
|
|
53
|
+
"last-modified": "Fri, 20 Mar 2026 05:32:30 GMT",
|
|
54
|
+
"server": "Vercel",
|
|
55
|
+
"strict-transport-security": "max-age=63072000",
|
|
56
|
+
"x-vercel-cache": "HIT",
|
|
57
|
+
"x-vercel-id": "gru1::8jtdg-1774371575419-f8ab848b9f21",
|
|
58
|
+
"transfer-encoding": "chunked"
|
|
59
|
+
}
|
|
60
|
+
},
|
|
61
|
+
"reason": "Security header \"Content-Security-Policy\" not found in server response."
|
|
62
|
+
},
|
|
63
|
+
"remediation": "Define a strict Content-Security-Policy to restrict source domains for scripts, styles, and other resources."
|
|
64
|
+
},
|
|
65
|
+
{
|
|
66
|
+
"id": "REM-VULN-1774371576147-4",
|
|
67
|
+
"kind": "header",
|
|
68
|
+
"category": "hardening",
|
|
69
|
+
"confidence": "high",
|
|
70
|
+
"severity": "low",
|
|
71
|
+
"title": "X-Frame-Options Missing",
|
|
72
|
+
"description": "Missing X-Frame-Options header. This allows the application to be embedded in an iframe on other domains, increasing Clickjacking risk.",
|
|
73
|
+
"cwe": "CWE-1021",
|
|
74
|
+
"evidence": {
|
|
75
|
+
"request": {
|
|
76
|
+
"headers": {}
|
|
77
|
+
},
|
|
78
|
+
"response": {
|
|
79
|
+
"status": 200,
|
|
80
|
+
"headers": {
|
|
81
|
+
"access-control-allow-origin": "*",
|
|
82
|
+
"age": "386824",
|
|
83
|
+
"cache-control": "public, max-age=0, must-revalidate",
|
|
84
|
+
"content-disposition": "inline",
|
|
85
|
+
"content-type": "text/html; charset=utf-8",
|
|
86
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
87
|
+
"etag": "W/\"b0ab7ef6eae8580cc8fa3a3fe31ee2d2\"",
|
|
88
|
+
"last-modified": "Fri, 20 Mar 2026 05:32:30 GMT",
|
|
89
|
+
"server": "Vercel",
|
|
90
|
+
"strict-transport-security": "max-age=63072000",
|
|
91
|
+
"x-vercel-cache": "HIT",
|
|
92
|
+
"x-vercel-id": "gru1::8jtdg-1774371575419-f8ab848b9f21",
|
|
93
|
+
"transfer-encoding": "chunked"
|
|
94
|
+
}
|
|
95
|
+
},
|
|
96
|
+
"reason": "Security header \"X-Frame-Options\" not found. This allows the site to be embedded in iframes on third-party domains."
|
|
97
|
+
},
|
|
98
|
+
"remediation": "Set the X-Frame-Options header to DENY or SAMEORIGIN."
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "REM-VULN-1774371576147-6",
|
|
102
|
+
"kind": "header",
|
|
103
|
+
"category": "hardening",
|
|
104
|
+
"confidence": "high",
|
|
105
|
+
"severity": "low",
|
|
106
|
+
"title": "X-Content-Type-Options Missing",
|
|
107
|
+
"description": "The X-Content-Type-Options: nosniff header is missing. This could allow the browser to \"sniff\" the content type, potentially leading to MIME-type sniffing attacks.",
|
|
108
|
+
"cwe": "CWE-116",
|
|
109
|
+
"evidence": {
|
|
110
|
+
"response": {
|
|
111
|
+
"headers": {
|
|
112
|
+
"access-control-allow-origin": "*",
|
|
113
|
+
"age": "386824",
|
|
114
|
+
"cache-control": "public, max-age=0, must-revalidate",
|
|
115
|
+
"content-disposition": "inline",
|
|
116
|
+
"content-type": "text/html; charset=utf-8",
|
|
117
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
118
|
+
"etag": "W/\"b0ab7ef6eae8580cc8fa3a3fe31ee2d2\"",
|
|
119
|
+
"last-modified": "Fri, 20 Mar 2026 05:32:30 GMT",
|
|
120
|
+
"server": "Vercel",
|
|
121
|
+
"strict-transport-security": "max-age=63072000",
|
|
122
|
+
"x-vercel-cache": "HIT",
|
|
123
|
+
"x-vercel-id": "gru1::8jtdg-1774371575419-f8ab848b9f21",
|
|
124
|
+
"transfer-encoding": "chunked"
|
|
125
|
+
}
|
|
126
|
+
}
|
|
127
|
+
},
|
|
128
|
+
"remediation": "Add the \"X-Content-Type-Options: nosniff\" header to all responses."
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "REM-CORS-1774371576147",
|
|
132
|
+
"kind": "header",
|
|
133
|
+
"category": "confirmed",
|
|
134
|
+
"confidence": "high",
|
|
135
|
+
"severity": "high",
|
|
136
|
+
"title": "Permissive CORS Policy",
|
|
137
|
+
"description": "The application allows Cross-Origin Resource Sharing from any domain (Access-Control-Allow-Origin: *).",
|
|
138
|
+
"cwe": "CWE-942",
|
|
139
|
+
"evidence": {
|
|
140
|
+
"finding": "Access-Control-Allow-Origin: *"
|
|
141
|
+
},
|
|
142
|
+
"remediation": "Restrict Access-Control-Allow-Origin to trusted domains only."
|
|
143
|
+
},
|
|
144
|
+
{
|
|
145
|
+
"id": "REM-TECH-1774371576168",
|
|
146
|
+
"kind": "tech",
|
|
147
|
+
"category": "informational",
|
|
148
|
+
"confidence": "high",
|
|
149
|
+
"severity": "info",
|
|
150
|
+
"title": "Technology Stack Identified",
|
|
151
|
+
"description": "Fingerprinting identified the following technologies: Vercel",
|
|
152
|
+
"cwe": "CWE-200",
|
|
153
|
+
"evidence": {
|
|
154
|
+
"tech_stack": [
|
|
155
|
+
"Vercel"
|
|
156
|
+
]
|
|
157
|
+
},
|
|
158
|
+
"remediation": "Minimal tech disclosure is recommended to prevent targeted attacks."
|
|
159
|
+
},
|
|
160
|
+
{
|
|
161
|
+
"id": "REM-PROBABLE-PANEL-1774371576279",
|
|
162
|
+
"kind": "path",
|
|
163
|
+
"category": "probable",
|
|
164
|
+
"confidence": "low",
|
|
165
|
+
"severity": "medium",
|
|
166
|
+
"title": "Potential Admin Panel Exposure",
|
|
167
|
+
"description": "Potential exposed admin panel or dashboard at https://www.fnstore.com.br/admin. Manual verification required.",
|
|
168
|
+
"cwe": "CWE-284",
|
|
169
|
+
"evidence": {
|
|
170
|
+
"request": {
|
|
171
|
+
"url": "https://www.fnstore.com.br/admin",
|
|
172
|
+
"method": "GET"
|
|
173
|
+
},
|
|
174
|
+
"response": {
|
|
175
|
+
"status": 200,
|
|
176
|
+
"headers": {
|
|
177
|
+
"access-control-allow-origin": "*",
|
|
178
|
+
"age": "264802",
|
|
179
|
+
"cache-control": "public, max-age=0, must-revalidate",
|
|
180
|
+
"content-disposition": "inline; filename=\"admin\"",
|
|
181
|
+
"content-type": "text/html; charset=utf-8",
|
|
182
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
183
|
+
"etag": "W/\"2e05586be4170168d7ee1475611f1a84\"",
|
|
184
|
+
"last-modified": "Sat, 21 Mar 2026 15:26:13 GMT",
|
|
185
|
+
"server": "Vercel",
|
|
186
|
+
"strict-transport-security": "max-age=63072000",
|
|
187
|
+
"x-vercel-cache": "HIT",
|
|
188
|
+
"x-vercel-id": "gru1::fcpg7-1774371575555-1ef20f14ca93",
|
|
189
|
+
"transfer-encoding": "chunked"
|
|
190
|
+
},
|
|
191
|
+
"body_snippet": "<!DOCTYPE html>\n<html lang=\"pt-BR\">\n<head>\n <meta charset=\"UTF-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n <title>Admin - FN Store</title>\n <link href=\"css/all.min.css\" rel=\"stylesheet\">\n <link href=\"ht"
|
|
192
|
+
},
|
|
193
|
+
"reason": "200 OK on admin-like path, but no explicit login form detected. Could be an unauthorized dashboard."
|
|
194
|
+
},
|
|
195
|
+
"remediation": "Restrict access to the admin panel using IP whitelisting or other access control mechanisms."
|
|
196
|
+
},
|
|
197
|
+
{
|
|
198
|
+
"id": "REM-INFO-FORBIDDEN-1774371576298",
|
|
199
|
+
"kind": "path",
|
|
200
|
+
"category": "informational",
|
|
201
|
+
"confidence": "medium",
|
|
202
|
+
"severity": "info",
|
|
203
|
+
"title": "Protected Path Discovered",
|
|
204
|
+
"description": "Potential protected path discovered (403 Forbidden): https://www.fnstore.com.br/wp-admin. This confirms the path exists but access is restricted.",
|
|
205
|
+
"cwe": "CWE-204",
|
|
206
|
+
"evidence": {
|
|
207
|
+
"request": {
|
|
208
|
+
"url": "https://www.fnstore.com.br/wp-admin",
|
|
209
|
+
"method": "GET"
|
|
210
|
+
},
|
|
211
|
+
"response": {
|
|
212
|
+
"status": 403,
|
|
213
|
+
"headers": {
|
|
214
|
+
"cache-control": "private, no-store, max-age=0",
|
|
215
|
+
"content-type": "application/json",
|
|
216
|
+
"server": "Vercel",
|
|
217
|
+
"x-vercel-id": "gru1::zkxpx-1774371575586-72583de74fa4",
|
|
218
|
+
"x-vercel-mitigated": "deny",
|
|
219
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
220
|
+
"content-length": "93"
|
|
221
|
+
},
|
|
222
|
+
"body_snippet": ""
|
|
223
|
+
},
|
|
224
|
+
"reason": "Server returned 403 Forbidden. This confirms path existence but access control is active. No immediate exposure detected."
|
|
225
|
+
},
|
|
226
|
+
"remediation": "None required, but ensure that the 403 response does not leak information about the internal structure."
|
|
227
|
+
},
|
|
228
|
+
{
|
|
229
|
+
"id": "REM-INFO-FORBIDDEN-1774371576313",
|
|
230
|
+
"kind": "path",
|
|
231
|
+
"category": "informational",
|
|
232
|
+
"confidence": "medium",
|
|
233
|
+
"severity": "info",
|
|
234
|
+
"title": "Protected Path Discovered",
|
|
235
|
+
"description": "Potential protected path discovered (403 Forbidden): https://www.fnstore.com.br/config.php. This confirms the path exists but access is restricted.",
|
|
236
|
+
"cwe": "CWE-204",
|
|
237
|
+
"evidence": {
|
|
238
|
+
"request": {
|
|
239
|
+
"url": "https://www.fnstore.com.br/config.php",
|
|
240
|
+
"method": "GET"
|
|
241
|
+
},
|
|
242
|
+
"response": {
|
|
243
|
+
"status": 403,
|
|
244
|
+
"headers": {
|
|
245
|
+
"cache-control": "private, no-store, max-age=0",
|
|
246
|
+
"content-type": "application/json",
|
|
247
|
+
"server": "Vercel",
|
|
248
|
+
"x-vercel-id": "gru1::fcpg7-1774371575602-af9a6404ff4c",
|
|
249
|
+
"x-vercel-mitigated": "deny",
|
|
250
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
251
|
+
"content-length": "93"
|
|
252
|
+
},
|
|
253
|
+
"body_snippet": ""
|
|
254
|
+
},
|
|
255
|
+
"reason": "Server returned 403 Forbidden. This confirms path existence but access control is active. No immediate exposure detected."
|
|
256
|
+
},
|
|
257
|
+
"remediation": "None required, but ensure that the 403 response does not leak information about the internal structure."
|
|
258
|
+
},
|
|
259
|
+
{
|
|
260
|
+
"id": "REM-INFO-FORBIDDEN-1774371576351",
|
|
261
|
+
"kind": "path",
|
|
262
|
+
"category": "informational",
|
|
263
|
+
"confidence": "medium",
|
|
264
|
+
"severity": "info",
|
|
265
|
+
"title": "Protected Path Discovered",
|
|
266
|
+
"description": "Potential protected path discovered (403 Forbidden): https://www.fnstore.com.br/phpinfo.php. This confirms the path exists but access is restricted.",
|
|
267
|
+
"cwe": "CWE-204",
|
|
268
|
+
"evidence": {
|
|
269
|
+
"request": {
|
|
270
|
+
"url": "https://www.fnstore.com.br/phpinfo.php",
|
|
271
|
+
"method": "GET"
|
|
272
|
+
},
|
|
273
|
+
"response": {
|
|
274
|
+
"status": 403,
|
|
275
|
+
"headers": {
|
|
276
|
+
"cache-control": "private, no-store, max-age=0",
|
|
277
|
+
"content-type": "application/json",
|
|
278
|
+
"server": "Vercel",
|
|
279
|
+
"x-vercel-id": "gru1::j25vb-1774371575641-be18df35a350",
|
|
280
|
+
"x-vercel-mitigated": "deny",
|
|
281
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
282
|
+
"content-length": "93"
|
|
283
|
+
},
|
|
284
|
+
"body_snippet": ""
|
|
285
|
+
},
|
|
286
|
+
"reason": "Server returned 403 Forbidden. This confirms path existence but access control is active. No immediate exposure detected."
|
|
287
|
+
},
|
|
288
|
+
"remediation": "None required, but ensure that the 403 response does not leak information about the internal structure."
|
|
289
|
+
}
|
|
290
|
+
],
|
|
291
|
+
"logs": [
|
|
292
|
+
"Dynamic analysis performed on https://www.fnstore.com.br/"
|
|
293
|
+
],
|
|
294
|
+
"timestamp": "2026-03-24T16:59:36.549Z"
|
|
295
|
+
},
|
|
296
|
+
"verification": {},
|
|
297
|
+
"last_updated": "2026-03-24T16:59:36.550Z",
|
|
298
|
+
"score": 71,
|
|
299
|
+
"vulnerabilities": [
|
|
300
|
+
{
|
|
301
|
+
"id": "REM-VULN-1774371576147-2",
|
|
302
|
+
"kind": "header",
|
|
303
|
+
"category": "confirmed",
|
|
304
|
+
"confidence": "high",
|
|
305
|
+
"severity": "high",
|
|
306
|
+
"title": "Content-Security-Policy Missing",
|
|
307
|
+
"description": "CSP header is missing. Without a strict Content-Security-Policy, the application is highly vulnerable to Cross-Site Scripting (XSS) and data injection attacks.",
|
|
308
|
+
"cwe": "CWE-1022",
|
|
309
|
+
"evidence": {
|
|
310
|
+
"request": {
|
|
311
|
+
"headers": {}
|
|
312
|
+
},
|
|
313
|
+
"response": {
|
|
314
|
+
"status": 200,
|
|
315
|
+
"headers": {
|
|
316
|
+
"access-control-allow-origin": "*",
|
|
317
|
+
"age": "386824",
|
|
318
|
+
"cache-control": "public, max-age=0, must-revalidate",
|
|
319
|
+
"content-disposition": "inline",
|
|
320
|
+
"content-type": "text/html; charset=utf-8",
|
|
321
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
322
|
+
"etag": "W/\"b0ab7ef6eae8580cc8fa3a3fe31ee2d2\"",
|
|
323
|
+
"last-modified": "Fri, 20 Mar 2026 05:32:30 GMT",
|
|
324
|
+
"server": "Vercel",
|
|
325
|
+
"strict-transport-security": "max-age=63072000",
|
|
326
|
+
"x-vercel-cache": "HIT",
|
|
327
|
+
"x-vercel-id": "gru1::8jtdg-1774371575419-f8ab848b9f21",
|
|
328
|
+
"transfer-encoding": "chunked"
|
|
329
|
+
}
|
|
330
|
+
},
|
|
331
|
+
"reason": "Security header \"Content-Security-Policy\" not found in server response."
|
|
332
|
+
},
|
|
333
|
+
"remediation": "Define a strict Content-Security-Policy to restrict source domains for scripts, styles, and other resources."
|
|
334
|
+
},
|
|
335
|
+
{
|
|
336
|
+
"id": "REM-VULN-1774371576147-4",
|
|
337
|
+
"kind": "header",
|
|
338
|
+
"category": "hardening",
|
|
339
|
+
"confidence": "high",
|
|
340
|
+
"severity": "low",
|
|
341
|
+
"title": "X-Frame-Options Missing",
|
|
342
|
+
"description": "Missing X-Frame-Options header. This allows the application to be embedded in an iframe on other domains, increasing Clickjacking risk.",
|
|
343
|
+
"cwe": "CWE-1021",
|
|
344
|
+
"evidence": {
|
|
345
|
+
"request": {
|
|
346
|
+
"headers": {}
|
|
347
|
+
},
|
|
348
|
+
"response": {
|
|
349
|
+
"status": 200,
|
|
350
|
+
"headers": {
|
|
351
|
+
"access-control-allow-origin": "*",
|
|
352
|
+
"age": "386824",
|
|
353
|
+
"cache-control": "public, max-age=0, must-revalidate",
|
|
354
|
+
"content-disposition": "inline",
|
|
355
|
+
"content-type": "text/html; charset=utf-8",
|
|
356
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
357
|
+
"etag": "W/\"b0ab7ef6eae8580cc8fa3a3fe31ee2d2\"",
|
|
358
|
+
"last-modified": "Fri, 20 Mar 2026 05:32:30 GMT",
|
|
359
|
+
"server": "Vercel",
|
|
360
|
+
"strict-transport-security": "max-age=63072000",
|
|
361
|
+
"x-vercel-cache": "HIT",
|
|
362
|
+
"x-vercel-id": "gru1::8jtdg-1774371575419-f8ab848b9f21",
|
|
363
|
+
"transfer-encoding": "chunked"
|
|
364
|
+
}
|
|
365
|
+
},
|
|
366
|
+
"reason": "Security header \"X-Frame-Options\" not found. This allows the site to be embedded in iframes on third-party domains."
|
|
367
|
+
},
|
|
368
|
+
"remediation": "Set the X-Frame-Options header to DENY or SAMEORIGIN."
|
|
369
|
+
},
|
|
370
|
+
{
|
|
371
|
+
"id": "REM-VULN-1774371576147-6",
|
|
372
|
+
"kind": "header",
|
|
373
|
+
"category": "hardening",
|
|
374
|
+
"confidence": "high",
|
|
375
|
+
"severity": "low",
|
|
376
|
+
"title": "X-Content-Type-Options Missing",
|
|
377
|
+
"description": "The X-Content-Type-Options: nosniff header is missing. This could allow the browser to \"sniff\" the content type, potentially leading to MIME-type sniffing attacks.",
|
|
378
|
+
"cwe": "CWE-116",
|
|
379
|
+
"evidence": {
|
|
380
|
+
"response": {
|
|
381
|
+
"headers": {
|
|
382
|
+
"access-control-allow-origin": "*",
|
|
383
|
+
"age": "386824",
|
|
384
|
+
"cache-control": "public, max-age=0, must-revalidate",
|
|
385
|
+
"content-disposition": "inline",
|
|
386
|
+
"content-type": "text/html; charset=utf-8",
|
|
387
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
388
|
+
"etag": "W/\"b0ab7ef6eae8580cc8fa3a3fe31ee2d2\"",
|
|
389
|
+
"last-modified": "Fri, 20 Mar 2026 05:32:30 GMT",
|
|
390
|
+
"server": "Vercel",
|
|
391
|
+
"strict-transport-security": "max-age=63072000",
|
|
392
|
+
"x-vercel-cache": "HIT",
|
|
393
|
+
"x-vercel-id": "gru1::8jtdg-1774371575419-f8ab848b9f21",
|
|
394
|
+
"transfer-encoding": "chunked"
|
|
395
|
+
}
|
|
396
|
+
}
|
|
397
|
+
},
|
|
398
|
+
"remediation": "Add the \"X-Content-Type-Options: nosniff\" header to all responses."
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"id": "REM-CORS-1774371576147",
|
|
402
|
+
"kind": "header",
|
|
403
|
+
"category": "confirmed",
|
|
404
|
+
"confidence": "high",
|
|
405
|
+
"severity": "high",
|
|
406
|
+
"title": "Permissive CORS Policy",
|
|
407
|
+
"description": "The application allows Cross-Origin Resource Sharing from any domain (Access-Control-Allow-Origin: *).",
|
|
408
|
+
"cwe": "CWE-942",
|
|
409
|
+
"evidence": {
|
|
410
|
+
"finding": "Access-Control-Allow-Origin: *"
|
|
411
|
+
},
|
|
412
|
+
"remediation": "Restrict Access-Control-Allow-Origin to trusted domains only."
|
|
413
|
+
},
|
|
414
|
+
{
|
|
415
|
+
"id": "REM-TECH-1774371576168",
|
|
416
|
+
"kind": "tech",
|
|
417
|
+
"category": "informational",
|
|
418
|
+
"confidence": "high",
|
|
419
|
+
"severity": "info",
|
|
420
|
+
"title": "Technology Stack Identified",
|
|
421
|
+
"description": "Fingerprinting identified the following technologies: Vercel",
|
|
422
|
+
"cwe": "CWE-200",
|
|
423
|
+
"evidence": {
|
|
424
|
+
"tech_stack": [
|
|
425
|
+
"Vercel"
|
|
426
|
+
]
|
|
427
|
+
},
|
|
428
|
+
"remediation": "Minimal tech disclosure is recommended to prevent targeted attacks."
|
|
429
|
+
},
|
|
430
|
+
{
|
|
431
|
+
"id": "REM-PROBABLE-PANEL-1774371576279",
|
|
432
|
+
"kind": "path",
|
|
433
|
+
"category": "probable",
|
|
434
|
+
"confidence": "low",
|
|
435
|
+
"severity": "medium",
|
|
436
|
+
"title": "Potential Admin Panel Exposure",
|
|
437
|
+
"description": "Potential exposed admin panel or dashboard at https://www.fnstore.com.br/admin. Manual verification required.",
|
|
438
|
+
"cwe": "CWE-284",
|
|
439
|
+
"evidence": {
|
|
440
|
+
"request": {
|
|
441
|
+
"url": "https://www.fnstore.com.br/admin",
|
|
442
|
+
"method": "GET"
|
|
443
|
+
},
|
|
444
|
+
"response": {
|
|
445
|
+
"status": 200,
|
|
446
|
+
"headers": {
|
|
447
|
+
"access-control-allow-origin": "*",
|
|
448
|
+
"age": "264802",
|
|
449
|
+
"cache-control": "public, max-age=0, must-revalidate",
|
|
450
|
+
"content-disposition": "inline; filename=\"admin\"",
|
|
451
|
+
"content-type": "text/html; charset=utf-8",
|
|
452
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
453
|
+
"etag": "W/\"2e05586be4170168d7ee1475611f1a84\"",
|
|
454
|
+
"last-modified": "Sat, 21 Mar 2026 15:26:13 GMT",
|
|
455
|
+
"server": "Vercel",
|
|
456
|
+
"strict-transport-security": "max-age=63072000",
|
|
457
|
+
"x-vercel-cache": "HIT",
|
|
458
|
+
"x-vercel-id": "gru1::fcpg7-1774371575555-1ef20f14ca93",
|
|
459
|
+
"transfer-encoding": "chunked"
|
|
460
|
+
},
|
|
461
|
+
"body_snippet": "<!DOCTYPE html>\n<html lang=\"pt-BR\">\n<head>\n <meta charset=\"UTF-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n <title>Admin - FN Store</title>\n <link href=\"css/all.min.css\" rel=\"stylesheet\">\n <link href=\"ht"
|
|
462
|
+
},
|
|
463
|
+
"reason": "200 OK on admin-like path, but no explicit login form detected. Could be an unauthorized dashboard."
|
|
464
|
+
},
|
|
465
|
+
"remediation": "Restrict access to the admin panel using IP whitelisting or other access control mechanisms."
|
|
466
|
+
},
|
|
467
|
+
{
|
|
468
|
+
"id": "REM-INFO-FORBIDDEN-1774371576298",
|
|
469
|
+
"kind": "path",
|
|
470
|
+
"category": "informational",
|
|
471
|
+
"confidence": "medium",
|
|
472
|
+
"severity": "info",
|
|
473
|
+
"title": "Protected Path Discovered",
|
|
474
|
+
"description": "Potential protected path discovered (403 Forbidden): https://www.fnstore.com.br/wp-admin. This confirms the path exists but access is restricted.",
|
|
475
|
+
"cwe": "CWE-204",
|
|
476
|
+
"evidence": {
|
|
477
|
+
"request": {
|
|
478
|
+
"url": "https://www.fnstore.com.br/wp-admin",
|
|
479
|
+
"method": "GET"
|
|
480
|
+
},
|
|
481
|
+
"response": {
|
|
482
|
+
"status": 403,
|
|
483
|
+
"headers": {
|
|
484
|
+
"cache-control": "private, no-store, max-age=0",
|
|
485
|
+
"content-type": "application/json",
|
|
486
|
+
"server": "Vercel",
|
|
487
|
+
"x-vercel-id": "gru1::zkxpx-1774371575586-72583de74fa4",
|
|
488
|
+
"x-vercel-mitigated": "deny",
|
|
489
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
490
|
+
"content-length": "93"
|
|
491
|
+
},
|
|
492
|
+
"body_snippet": ""
|
|
493
|
+
},
|
|
494
|
+
"reason": "Server returned 403 Forbidden. This confirms path existence but access control is active. No immediate exposure detected."
|
|
495
|
+
},
|
|
496
|
+
"remediation": "None required, but ensure that the 403 response does not leak information about the internal structure."
|
|
497
|
+
},
|
|
498
|
+
{
|
|
499
|
+
"id": "REM-INFO-FORBIDDEN-1774371576313",
|
|
500
|
+
"kind": "path",
|
|
501
|
+
"category": "informational",
|
|
502
|
+
"confidence": "medium",
|
|
503
|
+
"severity": "info",
|
|
504
|
+
"title": "Protected Path Discovered",
|
|
505
|
+
"description": "Potential protected path discovered (403 Forbidden): https://www.fnstore.com.br/config.php. This confirms the path exists but access is restricted.",
|
|
506
|
+
"cwe": "CWE-204",
|
|
507
|
+
"evidence": {
|
|
508
|
+
"request": {
|
|
509
|
+
"url": "https://www.fnstore.com.br/config.php",
|
|
510
|
+
"method": "GET"
|
|
511
|
+
},
|
|
512
|
+
"response": {
|
|
513
|
+
"status": 403,
|
|
514
|
+
"headers": {
|
|
515
|
+
"cache-control": "private, no-store, max-age=0",
|
|
516
|
+
"content-type": "application/json",
|
|
517
|
+
"server": "Vercel",
|
|
518
|
+
"x-vercel-id": "gru1::fcpg7-1774371575602-af9a6404ff4c",
|
|
519
|
+
"x-vercel-mitigated": "deny",
|
|
520
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
521
|
+
"content-length": "93"
|
|
522
|
+
},
|
|
523
|
+
"body_snippet": ""
|
|
524
|
+
},
|
|
525
|
+
"reason": "Server returned 403 Forbidden. This confirms path existence but access control is active. No immediate exposure detected."
|
|
526
|
+
},
|
|
527
|
+
"remediation": "None required, but ensure that the 403 response does not leak information about the internal structure."
|
|
528
|
+
},
|
|
529
|
+
{
|
|
530
|
+
"id": "REM-INFO-FORBIDDEN-1774371576351",
|
|
531
|
+
"kind": "path",
|
|
532
|
+
"category": "informational",
|
|
533
|
+
"confidence": "medium",
|
|
534
|
+
"severity": "info",
|
|
535
|
+
"title": "Protected Path Discovered",
|
|
536
|
+
"description": "Potential protected path discovered (403 Forbidden): https://www.fnstore.com.br/phpinfo.php. This confirms the path exists but access is restricted.",
|
|
537
|
+
"cwe": "CWE-204",
|
|
538
|
+
"evidence": {
|
|
539
|
+
"request": {
|
|
540
|
+
"url": "https://www.fnstore.com.br/phpinfo.php",
|
|
541
|
+
"method": "GET"
|
|
542
|
+
},
|
|
543
|
+
"response": {
|
|
544
|
+
"status": 403,
|
|
545
|
+
"headers": {
|
|
546
|
+
"cache-control": "private, no-store, max-age=0",
|
|
547
|
+
"content-type": "application/json",
|
|
548
|
+
"server": "Vercel",
|
|
549
|
+
"x-vercel-id": "gru1::j25vb-1774371575641-be18df35a350",
|
|
550
|
+
"x-vercel-mitigated": "deny",
|
|
551
|
+
"date": "Tue, 24 Mar 2026 16:59:35 GMT",
|
|
552
|
+
"content-length": "93"
|
|
553
|
+
},
|
|
554
|
+
"body_snippet": ""
|
|
555
|
+
},
|
|
556
|
+
"reason": "Server returned 403 Forbidden. This confirms path existence but access control is active. No immediate exposure detected."
|
|
557
|
+
},
|
|
558
|
+
"remediation": "None required, but ensure that the 403 response does not leak information about the internal structure."
|
|
559
|
+
}
|
|
560
|
+
],
|
|
561
|
+
"riskLevel": "Medium",
|
|
562
|
+
"timestamp": "2026-03-24T16:59:36.550Z",
|
|
563
|
+
"target": "https://www.fnstore.com.br/",
|
|
564
|
+
"scan_id": "OMEN-1774371576550"
|
|
565
|
+
}
|
package/README.md
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
# <p align="center"> <img src="https://img.icons8.com/nolan/128/security-shield.png" width="100" /> <br> OMEN SEC-CLI v1.0.
|
|
1
|
+
# <p align="center"> <img src="https://img.icons8.com/nolan/128/security-shield.png" width="100" /> <br> OMEN SEC-CLI v1.0.20 </p>
|
|
2
2
|
|
|
3
3
|
<p align="center">
|
|
4
|
-
<img src="https://img.shields.io/badge/Version-1.0.
|
|
4
|
+
<img src="https://img.shields.io/badge/Version-1.0.20-red?style=for-the-badge" />
|
|
5
5
|
<img src="https://img.shields.io/badge/Phase--Based-DevSecOps-000000?style=for-the-badge&logo=openai" />
|
|
6
6
|
<img src="https://img.shields.io/badge/Zero--Copy-AI--Protocol-green?style=for-the-badge" />
|
|
7
7
|
</p>
|
package/bin/index.js
CHANGED