ZAP by Checkmarx Scanning Report

Alerts

1. Risk=High, Confidence=Medium (1)

   1. https://connect.gcpaybuild.site (1)

      1. SQL Injection (1)

         1. POST https://connect.gcpaybuild.site/api/ngenius/initiate-payment

            Alert tags	POLICY_SEQUENCE = OWASP_2021_A03 PCI_DSS CWE-89 POLICY_QA_CICD = POLICY_DEV_CICD = OWASP_2025_A05 WSTG-v42-INPV-05 POLICY_API = POLICY_DEV_FULL = POLICY_QA_STD = POLICY_QA_FULL = POLICY_PENTEST = HIPAA OWASP_2017_A01 API_2023_API10 POLICY_DEV_STD =
            Alert description	SQL injection may be possible.
            Other info	The original page results were successfully replicated using the expression [200/2] as the parameter value The parameter value being modified was stripped from the HTML output for the purposes of the comparison.
            Request	Request line and header section (1435 bytes) POST https://connect.gcpaybuild.site/api/ngenius/initiate-payment HTTP/1.1 Content-Type: application/json Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8 lang: en gcpay-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8 User-Agent: PostmanRuntime/7.51.1 Accept: */* Cache-Control: no-cache Postman-Token: 71460c9d-3d8b-40e3-a0c4-9a341b61d5a1 host: connect.gcpaybuild.site Connection: keep-alive content-length: 50 Request body (50 bytes) { "amount": "200/2", "country_code": "BD" }
            Response	Status line and header section (1004 bytes) HTTP/1.1 429 Too Many Requests Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:36:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 40 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Vary: Origin Access-Control-Allow-Credentials: true X-Request-Id: 55a66b0f-b085-463f-bd5e-73ba1ab45c6b ETag: W/"28-ig1m/FgMF5zMV0DMx8xdKIEqM1g" Response body (40 bytes) {"message":"Duplicate request detected"}
            Parameter	amount
            Attack	200/2
            Solution	Do not trust client side input, even if there is client side validation in place. In general, type check all data on the server side. If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?' If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries. If database Stored Procedures can be used, use them. Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality! Do not create dynamic SQL queries using simple string concatenation. Escape all data received from the client. Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input. Apply the principle of least privilege by using the least privileged database user possible. In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact. Grant the minimum database access that is necessary for the application.

2. Risk=Medium, Confidence=Medium (1)

   1. https://socket.gcpaybuild.site (1)

      1. Cross-Domain Misconfiguration (1)

         1. GET https://socket.gcpaybuild.site/socket.io/?EIO=4&transport=websocket

            Alert tags	OWASP_2021_A01 POLICY_QA_STD = POLICY_PENTEST = SYSTEMIC OWASP_2025_A01 OWASP_2017_A05 CWE-264
            Alert description	Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server.
            Other info	The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
            Request	Request line and header section (735 bytes) GET https://socket.gcpaybuild.site/socket.io/?EIO=4&transport=websocket HTTP/1.1 host: socket.gcpaybuild.site User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0 Accept: */* Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Version: 13 Origin: https://newweb.gcpaybuild.site Sec-WebSocket-Key: ak6RYtq1VDSgwF17DFaVRw== Connection: Upgrade Cookie: _ga_B0ZYZYXEHW=GS2.1.s1780330372$o1$g1$t1780330419$j13$l0$h0; _ga=GA1.1.729134309.1780330372; _ga_35M4CXK84W=GS2.1.s1780330372$o1$g1$t1780330419$j13$l0$h0; _fbp=fb.1.1780330373666.388827821206435748 Sec-Fetch-Dest: empty Sec-Fetch-Mode: websocket Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket Request body (0 bytes)
            Response	Status line and header section (229 bytes) HTTP/1.1 101 Switching Protocols Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:35:16 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: dWlgAtXKai4sWi0n8AvV4nE1kVc= Access-Control-Allow-Origin: * Response body (0 bytes)
            Evidence	Access-Control-Allow-Origin: *
            Solution	Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance). Configure the "Access-Control-Allow-Origin" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.

3. Risk=Low, Confidence=High (2)

   1. https://socket.gcpaybuild.site (2)

      1. Server Leaks Version Information via "Server" HTTP Response Header Field (1)

         1. GET https://socket.gcpaybuild.site/socket.io/?EIO=4&transport=websocket

            Alert tags	OWASP_2021_A05 POLICY_QA_STD = POLICY_PENTEST = SYSTEMIC OWASP_2017_A06 WSTG-v42-INFO-02 CWE-497 OWASP_2025_A02
            Alert description	The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
            Request	Request line and header section (735 bytes) GET https://socket.gcpaybuild.site/socket.io/?EIO=4&transport=websocket HTTP/1.1 host: socket.gcpaybuild.site User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0 Accept: */* Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Version: 13 Origin: https://newweb.gcpaybuild.site Sec-WebSocket-Key: ak6RYtq1VDSgwF17DFaVRw== Connection: Upgrade Cookie: _ga_B0ZYZYXEHW=GS2.1.s1780330372$o1$g1$t1780330419$j13$l0$h0; _ga=GA1.1.729134309.1780330372; _ga_35M4CXK84W=GS2.1.s1780330372$o1$g1$t1780330419$j13$l0$h0; _fbp=fb.1.1780330373666.388827821206435748 Sec-Fetch-Dest: empty Sec-Fetch-Mode: websocket Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket Request body (0 bytes)
            Response	Status line and header section (229 bytes) HTTP/1.1 101 Switching Protocols Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:35:16 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: dWlgAtXKai4sWi0n8AvV4nE1kVc= Access-Control-Allow-Origin: * Response body (0 bytes)
            Evidence	nginx/1.24.0 (Ubuntu)
            Solution	Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.

      2. Strict-Transport-Security Header Not Set (1)

         1. GET https://socket.gcpaybuild.site/socket.io/?EIO=4&transport=websocket

            Alert tags	OWASP_2021_A05 POLICY_QA_STD = POLICY_PENTEST = SYSTEMIC CWE-319 OWASP_2017_A06 OWASP_2025_A02
            Alert description	HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.
            Request	Request line and header section (735 bytes) GET https://socket.gcpaybuild.site/socket.io/?EIO=4&transport=websocket HTTP/1.1 host: socket.gcpaybuild.site User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0 Accept: */* Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Version: 13 Origin: https://newweb.gcpaybuild.site Sec-WebSocket-Key: ak6RYtq1VDSgwF17DFaVRw== Connection: Upgrade Cookie: _ga_B0ZYZYXEHW=GS2.1.s1780330372$o1$g1$t1780330419$j13$l0$h0; _ga=GA1.1.729134309.1780330372; _ga_35M4CXK84W=GS2.1.s1780330372$o1$g1$t1780330419$j13$l0$h0; _fbp=fb.1.1780330373666.388827821206435748 Sec-Fetch-Dest: empty Sec-Fetch-Mode: websocket Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket Request body (0 bytes)
            Response	Status line and header section (229 bytes) HTTP/1.1 101 Switching Protocols Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:35:16 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: dWlgAtXKai4sWi0n8AvV4nE1kVc= Access-Control-Allow-Origin: * Response body (0 bytes)
            Solution	Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.

4. Risk=Low, Confidence=Medium (1)

   1. https://connect.gcpaybuild.site (1)

      1. Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) (1)

         1. POST https://connect.gcpaybuild.site/api/auth/login

            Alert tags	OWASP_2021_A01 WSTG-v42-INFO-08 POLICY_QA_STD = POLICY_PENTEST = SYSTEMIC OWASP_2017_A03 OWASP_2025_A01 CWE-497
            Alert description	The web/application server is leaking information via one or more "X-Powered-By" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to.
            Request	Request line and header section (298 bytes) POST https://connect.gcpaybuild.site/api/auth/login HTTP/1.1 Content-Type: application/json User-Agent: PostmanRuntime/7.51.1 Accept: */* Cache-Control: no-cache Postman-Token: 9df91845-c596-4f28-88fc-0ec68805f15e host: connect.gcpaybuild.site Connection: keep-alive Content-Length: 174 Request body (174 bytes) { "email": "[email protected]", "password_type": "password", "password": "11223344", "fcm_token": "", "device_id": "device_id", "authtoken": "123123" }
            Response	Status line and header section (1014 bytes) HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:35:34 GMT Content-Type: application/json; charset=utf-8 Content-Length: 937 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Vary: Origin Access-Control-Allow-Credentials: true X-Request-Id: 13797e3a-f9ab-4804-b230-816f8348a09d X-Powered-By: Express ETag: W/"3a9-diIQaM5AcAlzXdraRZVyrYCrEd4" Response body (937 bytes) {"status":200,"message":"Login successful","data":{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8","user":{"id":465,"first_name":"Tester","last_name":"Arman","phone":"5421546385","phone_dial_code":"+44","email":"[email protected]","image":null,"status":3,"is_password_set":true,"is_kyc_verified":true,"is_kyc_submitted":true,"is_kyc_rejected":false,"is_pin_set":true,"notification_count":444,"default_currency":1}},"errors":null}
            Evidence	X-Powered-By: Express
            Solution	Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-Powered-By" headers.

5. Risk=Low, Confidence=Low (1)

   1. https://connect.gcpaybuild.site (1)

      1. Timestamp Disclosure - Unix (1)

         1. POST https://connect.gcpaybuild.site/api/ngenius/initiate-payment

            Alert tags	OWASP_2021_A01 OWASP_2017_A03 OWASP_2025_A01 POLICY_PENTEST = CWE-497 SYSTEMIC
            Alert description	A timestamp was disclosed by the application/web server. - Unix
            Other info	1780331734, which evaluates to: 2026-06-01 22:35:34.
            Request	Request line and header section (1435 bytes) POST https://connect.gcpaybuild.site/api/ngenius/initiate-payment HTTP/1.1 Content-Type: application/json Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8 lang: en gcpay-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8 User-Agent: PostmanRuntime/7.51.1 Accept: */* Cache-Control: no-cache Postman-Token: 71460c9d-3d8b-40e3-a0c4-9a341b61d5a1 host: connect.gcpaybuild.site Connection: keep-alive Content-Length: 46 Request body (46 bytes) { "amount": 100, "country_code": "BD" }
            Response	Status line and header section (1014 bytes) HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:35:36 GMT Content-Type: application/json; charset=utf-8 Content-Length: 259 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Vary: Origin Access-Control-Allow-Credentials: true X-Request-Id: 136436bd-7902-499d-bafd-1b2e38cd3d47 X-Powered-By: Express ETag: W/"103-QF9tWxiSt4I0tQIn+E6JI4FU4lU" Response body (259 bytes) {"status":200,"message":"Payment initiated successfully","data":{"redirect_url":"https://paypage.sandbox.ngenius-payments.com/?code=fe856b9d11f69bfd","order_id":"TAH-O-465-1780331734-TM","order_reference":"7ff44157-052b-4f20-8118-b4c437b0d24d"},"errors":null}
            Evidence	1780331734
            Solution	Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

6. Risk=Informational, Confidence=High (1)

   1. https://connect.gcpaybuild.site (1)

      1. Authentication Request Identified (1)

         1. POST https://connect.gcpaybuild.site/api/auth/login

            Alert tags
            Alert description	The given request has been identified as an authentication request. The 'Other Info' field contains a set of key=value lines which identify any relevant fields. If the request is in a context which has an Authentication Method set to "Auto-Detect" then this rule will change the authentication to match the request identified.
            Other info	userParam=email [email protected] passwordParam=password
            Request	Request line and header section (298 bytes) POST https://connect.gcpaybuild.site/api/auth/login HTTP/1.1 Content-Type: application/json User-Agent: PostmanRuntime/7.51.1 Accept: */* Cache-Control: no-cache Postman-Token: 9df91845-c596-4f28-88fc-0ec68805f15e host: connect.gcpaybuild.site Connection: keep-alive Content-Length: 174 Request body (174 bytes) { "email": "[email protected]", "password_type": "password", "password": "11223344", "fcm_token": "", "device_id": "device_id", "authtoken": "123123" }
            Response	Status line and header section (1014 bytes) HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:35:34 GMT Content-Type: application/json; charset=utf-8 Content-Length: 937 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Vary: Origin Access-Control-Allow-Credentials: true X-Request-Id: 13797e3a-f9ab-4804-b230-816f8348a09d X-Powered-By: Express ETag: W/"3a9-diIQaM5AcAlzXdraRZVyrYCrEd4" Response body (937 bytes) {"status":200,"message":"Login successful","data":{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8","user":{"id":465,"first_name":"Tester","last_name":"Arman","phone":"5421546385","phone_dial_code":"+44","email":"[email protected]","image":null,"status":3,"is_password_set":true,"is_kyc_verified":true,"is_kyc_submitted":true,"is_kyc_rejected":false,"is_pin_set":true,"notification_count":444,"default_currency":1}},"errors":null}
            Parameter	email
            Evidence	password
            Solution	This is an informational alert rather than a vulnerability and so there is nothing to fix.

7. Risk=Informational, Confidence=Medium (2)

   1. https://connect.gcpaybuild.site (2)

      1. Session Management Response Identified (1)

         1. POST https://connect.gcpaybuild.site/api/auth/login

            Alert tags
            Alert description	The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to "Auto-Detect" then this rule will change the session management to use the tokens identified.
            Other info	json:data.token
            Request	Request line and header section (298 bytes) POST https://connect.gcpaybuild.site/api/auth/login HTTP/1.1 Content-Type: application/json User-Agent: PostmanRuntime/7.51.1 Accept: */* Cache-Control: no-cache Postman-Token: 9df91845-c596-4f28-88fc-0ec68805f15e host: connect.gcpaybuild.site Connection: keep-alive Content-Length: 174 Request body (174 bytes) { "email": "[email protected]", "password_type": "password", "password": "11223344", "fcm_token": "", "device_id": "device_id", "authtoken": "123123" }
            Response	Status line and header section (1014 bytes) HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:35:34 GMT Content-Type: application/json; charset=utf-8 Content-Length: 937 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Vary: Origin Access-Control-Allow-Credentials: true X-Request-Id: 13797e3a-f9ab-4804-b230-816f8348a09d X-Powered-By: Express ETag: W/"3a9-diIQaM5AcAlzXdraRZVyrYCrEd4" Response body (937 bytes) {"status":200,"message":"Login successful","data":{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8","user":{"id":465,"first_name":"Tester","last_name":"Arman","phone":"5421546385","phone_dial_code":"+44","email":"[email protected]","image":null,"status":3,"is_password_set":true,"is_kyc_verified":true,"is_kyc_submitted":true,"is_kyc_rejected":false,"is_pin_set":true,"notification_count":444,"default_currency":1}},"errors":null}
            Parameter	data.token
            Evidence	data.token
            Solution	This is an informational alert rather than a vulnerability and so there is nothing to fix.

      2. User Agent Fuzzer (1)

         1. POST https://connect.gcpaybuild.site/api/ngenius/initiate-payment

            Alert tags	CUSTOM_PAYLOADS = POLICY_PENTEST = SYSTEMIC
            Alert description	Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.
            Request	Request line and header section (1464 bytes) POST https://connect.gcpaybuild.site/api/ngenius/initiate-payment HTTP/1.1 Content-Type: application/json Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8 lang: en gcpay-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8 user-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1) Accept: */* Cache-Control: no-cache Postman-Token: 71460c9d-3d8b-40e3-a0c4-9a341b61d5a1 host: connect.gcpaybuild.site Connection: keep-alive Content-Length: 46 Request body (46 bytes) { "amount": 100, "country_code": "BD" }
            Response	Status line and header section (1013 bytes) HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:38:43 GMT Content-Type: application/json; charset=utf-8 Content-Length: 145 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Vary: Origin Access-Control-Allow-Credentials: true X-Request-Id: d69e4f78-374c-4438-b1a1-395d9be4417b X-Powered-By: Express ETag: W/"91-83R4Y9jN5IjzLBoojwph2vKGOlM" Response body (145 bytes) {"status":400,"message":"Unable to initiate card payment","data":null,"errors":[{"field":"payment","message":"Something went wrong, try again"}]}
            Parameter	Header User-Agent
            Attack	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)

8. Risk=Informational, Confidence=Low (1)

   1. https://connect.gcpaybuild.site (1)

      1. Re-examine Cache-control Directives (1)

         1. GET https://connect.gcpaybuild.site/api/ngenius/payment-status?order_id=%7B%7Border_id%7D%7D

            Alert tags	OWASP_2025_A07 CWE-525 POLICY_PENTEST = OWASP_2021_A07 SYSTEMIC WSTG-v42-ATHN-06 OWASP_2017_A02
            Alert description	The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.
            Request	Request line and header section (1442 bytes) GET https://connect.gcpaybuild.site/api/ngenius/payment-status?order_id=%7B%7Border_id%7D%7D HTTP/1.1 Content-Type: application/json Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8 lang: en gcpay-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NDY1LCJmaXJzdF9uYW1lIjoiVGVzdGVyIiwibGFzdF9uYW1lIjoiQXJtYW4iLCJwaG9uZSI6IjU0MjE1NDYzODUiLCJwaG9uZV9kaWFsX2NvZGUiOiIrNDQiLCJlbWFpbCI6InRlc3RlcmFybWFuQGdtYWlsLmNvbSIsImltYWdlIjpudWxsLCJzdGF0dXMiOjMsImlzX3Bhc3N3b3JkX3NldCI6dHJ1ZSwiaXNfa3ljX3ZlcmlmaWVkIjp0cnVlLCJpc19reWNfc3VibWl0dGVkIjp0cnVlLCJpc19reWNfcmVqZWN0ZWQiOmZhbHNlLCJpc19waW5fc2V0Ijp0cnVlLCJub3RpZmljYXRpb25fY291bnQiOjQ0NCwiZGVmYXVsdF9jdXJyZW5jeSI6MSwiaWF0IjoxNzgwMzMxNzM0LCJleHAiOjE4MTE4Njc3MzR9.4LBb2XNdzoq7Iuwsrt0Et0pHWb9URtG21m9r7ASuFM8 User-Agent: PostmanRuntime/7.51.1 Accept: */* Cache-Control: no-cache Postman-Token: 65c816e0-e128-4502-8368-c326ceca4e06 host: connect.gcpaybuild.site Connection: keep-alive Request body (0 bytes)
            Response	Status line and header section (1013 bytes) HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 01 Jun 2026 16:35:36 GMT Content-Type: application/json; charset=utf-8 Content-Length: 113 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 Vary: Origin Access-Control-Allow-Credentials: true X-Request-Id: 59c63118-55f9-44e7-95f3-e3f881e8d583 X-Powered-By: Express ETag: W/"71-LiJi2iT/751yU29s6OtHlgdbDd4" Response body (113 bytes) {"status":400,"message":"Payment attempt not found","data":null,"errors":{"message":"Payment attempt not found"}}
            Parameter	cache-control
            Solution	For secure content, ensure the cache-control HTTP header is set with "no-cache, no-store, must-revalidate". If an asset should be cached consider setting the directives "public, max-age, immutable".