Security test sample report

This is a sample report illustrating the structure and content of a Cyberdur report. The target and data below are fictitious; the findings follow the exact format produced by our tools (DNS, TLS, nuclei templates, CORS, JavaScript libraries, secrets). Your report will have this same structure, applied to your own application.

CYBERDUR — Security test report

Target: https://shop.example.com (online shop, fictitious example)
Test date: September 18, 2026
Report ID: CYB-2026-K3F9Q2
Test type: External, black box, non-destructive, unauthenticated

Global severity CRITICAL

Summary

11 issues were detected in this test: 1 of critical severity, 2 of high severity, 5 of medium severity and 3 of low severity. See the detail below for the description and reproduction steps.

Test scope

This automated, external, non-destructive black-box test covers: crawling of the site across several depth levels; TLS/SSL analysis (protocols, ciphers, certificate, HSTS); detection of misconfigurations and exposed files; detection of common injections (XSS, error-based SQL injection, local file read); CORS policy control; vulnerable JavaScript libraries; secrets exposed in public code (keys, tokens); and domain email configuration (SPF, DMARC, CAA). No exploitation is carried out and none of your data is modified. When a check reports nothing, it means it did not reveal any flaw.

Critical

High

Medium

Low

Information

Findings (11 findings)

Error based SQL injection

CRITICAL

Reproduction steps

nuclei -t error-based-sql-injection -u https://shop.example.com/search?q=%27

Secret expose (generic-api-key) dans https://shop.example.com/static/js/app.8c1f2e.js

HIGH

Reproduction steps

Ligne 1 de https://shop.example.com/static/js/app.8c1f2e.js (regle Gitleaks 'generic-api-key').

Top 38 Parameters - Cross-Site Scripting

HIGH

Reproduction steps

nuclei -t top-xss-params -u https://shop.example.com/search?q=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

Git Configuration - Detect

MEDIUM

Reproduction steps

nuclei -t git-config -u https://shop.example.com/.git/config

This host has whitelisted a third party host for cross origin requests.

MEDIUM

Reproduction steps

If the whitelisted host is a code hosting platform such as codepen.io or has an XSS vulnerability, it can be used to exploit this misconfiguration.

jquery 3.3.1 : CVE-2019-11358

MEDIUM

Reproduction steps

Bibliotheque jquery v3.3.1 chargee publiquement par https://shop.example.com (cf. properties 'foundIn' du composant dans le SBOM).

Aucun enregistrement DMARC

MEDIUM

Description

No DMARC record is published (_dmarc subdomain). DMARC tells receiving servers what to do with emails that fail the SPF/DKIM checks, and reports abuse of your domain. Without it, anyone can more easily impersonate your domain in phishing emails.

Reproduction steps

dig TXT _dmarc.shop.example.com — aucune valeur ne commence par 'v=DMARC1'

Remediation recommendation

Set up SPF (and DKIM) first, then publish a TXT record at _dmarc.your-domain, starting in monitoring mode: v=DMARC1; p=none; rua=mailto:dmarc@your-domain. Move to p=quarantine or p=reject once the reports look clean.

HSTS: not offered

MEDIUM

Description

The site does not send the Strict-Transport-Security (HSTS) header. Without it, a visitor's first connection, or a connection on a hostile network, can be downgraded to unencrypted HTTP and intercepted.

Reproduction steps

testssl.sh --fast shop.example.com : HSTS = not offered

Remediation recommendation

Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains on your web server or CDN. Once HTTPS works everywhere on your domain, you can also add the preload directive.

BREACH: potentially VULNERABLE, gzip HTTP compression detected - only supplied '/' tested

LOW

Description

Gzip compression is enabled on HTTPS responses. Under specific conditions, the BREACH attack can then recover secrets (such as a CSRF token) from pages that also reflect user input. Exploitability depends on your pages: it is low for static content and higher for pages with forms, sessions or reflected search terms.

Reproduction steps

testssl.sh --fast shop.example.com : BREACH = potentially VULNERABLE, gzip HTTP compression detected  - only supplied '/' tested

Remediation recommendation

Disable HTTP compression on pages that reflect user input next to secrets, change CSRF tokens on every request, or rate-limit requests.

Aucun enregistrement CAA

LOW

Description

No CAA record is published for the domain. Without it, any certificate authority is allowed to issue certificates for your domain name.

Reproduction steps

dig CAA shop.example.com — reponse vide

Remediation recommendation

Add a CAA DNS record that lists only the certificate authorities you use, for example: 0 issue "letsencrypt.org".

Missing HTTP security headers: Content-Security-Policy, Referrer-Policy

LOW

Description

The headers listed in the title are missing from your site's responses. Content-Security-Policy limits which scripts can run on your pages (a defense against injection); X-Frame-Options (or frame-ancestors) prevents your pages from being embedded in another site (clickjacking); X-Content-Type-Options: nosniff stops browsers from guessing file types; Referrer-Policy controls what is shared with other sites.

Reproduction steps

curl -sI https://shop.example.com : absent = Content-Security-Policy, Referrer-Policy

Remediation recommendation

Add the missing headers on your web server or CDN. A simple starting point: X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin. Content-Security-Policy takes more care: start in report-only mode (Content-Security-Policy-Report-Only) to avoid breaking your own scripts, then enforce it.

Information (2)

Informational notes only: these are not security flaws.

cert_trust_wildcard: trust is via wildcard

The certificate covers the domain through a wildcard entry. This is normal. Note that a wildcard certificate protects every subdomain with the same key.

testssl.sh --fast shop.example.com : cert_trust_wildcard = trust is via wildcard

FS_KEMs: No KEMs offered

The server does not offer post-quantum key exchange yet. This is a precaution for the future, not a current flaw.

testssl.sh --fast shop.example.com : FS_KEMs = No KEMs offered

What a CYBERDUR test covers

This block details the scope of the test, including what is out of scope; only the scope paragraph at the top of the report is part of the delivered report.

Checks performed

Site crawl across multiple depth levels
TLS/SSL analysis: protocols, ciphers, certificate, HSTS
Detection of misconfigurations and exposed files
Detection of common injections: XSS, error-based SQLi, local file read
CORS policy check
Vulnerable JavaScript libraries
Secrets exposed in public code (keys, tokens)
Domain email configuration (SPF, DMARC, CAA)

Out of scope

Access control (IDOR, privilege escalation) and business logic
Authentication: brute force, session management, password policy
Blind injections and SSRF
Denial of service, social engineering, physical security
Hands-on help applying the fixes: the report gives the steps to follow for common findings, without a consultancy engagement

The test is external, black box and non-destructive: no exploitation, no changes to your data. Results reflect the state of the application at the time of the test.

Want a report like this for your own application?

CYBERDUR runs automated, external, non-destructive security tests on your application — the same kind of test described in this report, without a consultancy engagement.

Run your first scan See pricing