TH17126
Detected presence of files containing domains related to out-of-band application security testing tools.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | medium | high | None | None |
About the issue
Out-of-band application security testing tools (OAST) rely on external servers to detect security vulnerabilities in web applications. This form of security testing inspects the web application from the outside in, similar to how the attackers would probe its defenses. External domains are commonly used to facilitate out-of-band security testing. Attackers commonly abuse tools designed for security testing to monitor network traffic and find weaknesses that can be exploited. While the presence of domains related to OAST tools does not imply malicious intent, all of their uses in a software package should be documented and approved. Attackers might have purposely injected security testing tools in the software package to monitor the network traffic of the infected computer system. It is also possible that the software package has mistakenly included a part of its testing infrastructure during packaging.
How to resolve the issue
- Investigate reported detections.
- If the software should not include these network references, investigate your build and release environment for software supply chain compromise.
- You should delay the software release until the investigation is completed, or until the issue is risk accepted.
- Consider removing all references to flagged network locations.
Recommended reading
- Out-of-band application security testing (OAST) (External resource - PortSwigger)