Cirrocumulus
MVPI suggest you enable signature enforcement for server responses. In a lab environment it should be OK but in production it might impact the performance of the app
MVPYes, that's what I said. Signatures can be enforced also on responses.
CirrocumulusAmine_KadimiDaniel_Wolf
Sorry for the late response.
Regarding signature enforcement on the responses, I selected the following signature set.
The log events of the application:
On the file types specification of the response signatures:
What would be the appropriate file types, since the script is stored on a message box.
Since the above mentioned signature was unable to detect the stored XSS payload in the response.
