This repository has been archived by the owner on Jun 21, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathowaspzap-pre-fix.txt
101 lines (101 loc) · 5.68 KB
/
owaspzap-pre-fix.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
➜ ~ docker run -t owasp/zap2docker-stable zap-baseline.py -t http://host.docker.internal:5000
Using the Automation Framework
Total of 25 URLs
PASS: Vulnerable JS Library (Powered by Retire.js) [10003]
PASS: In Page Banner Information Leak [10009]
PASS: Cookie No HttpOnly Flag [10010]
PASS: Cookie Without Secure Flag [10011]
PASS: Re-examine Cache-control Directives [10015]
PASS: Cross-Domain JavaScript Source File Inclusion [10017]
PASS: Content-Type Header Missing [10019]
PASS: Information Disclosure - Debug Error Messages [10023]
PASS: Information Disclosure - Sensitive Information in URL [10024]
PASS: Information Disclosure - Sensitive Information in HTTP Referrer Header [10025]
PASS: HTTP Parameter Override [10026]
PASS: Open Redirect [10028]
PASS: Cookie Poisoning [10029]
PASS: User Controllable Charset [10030]
PASS: User Controllable HTML Element Attribute (Potential XSS) [10031]
PASS: Viewstate [10032]
PASS: Directory Browsing [10033]
PASS: Heartbleed OpenSSL Vulnerability (Indicative) [10034]
PASS: Strict-Transport-Security Header [10035]
PASS: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037]
PASS: X-Backend-Server Header Information Leak [10039]
PASS: Secure Pages Include Mixed Content [10040]
PASS: HTTP to HTTPS Insecure Transition in Form Post [10041]
PASS: HTTPS to HTTP Insecure Transition in Form Post [10042]
PASS: User Controllable JavaScript Event (XSS) [10043]
PASS: Big Redirect Detected (Potential Sensitive Information Leak) [10044]
PASS: Retrieved from Cache [10050]
PASS: X-ChromeLogger-Data (XCOLD) Header Information Leak [10052]
PASS: Cookie without SameSite Attribute [10054]
PASS: CSP [10055]
PASS: X-Debug-Token Information Leak [10056]
PASS: Username Hash Found [10057]
PASS: X-AspNet-Version Response Header [10061]
PASS: PII Disclosure [10062]
PASS: Timestamp Disclosure [10096]
PASS: Hash Disclosure [10097]
PASS: Cross-Domain Misconfiguration [10098]
PASS: Weak Authentication Method [10105]
PASS: Reverse Tabnabbing [10108]
PASS: Dangerous JS Functions [10110]
PASS: Private IP Disclosure [2]
PASS: Session ID in URL Rewrite [3]
PASS: Script Passive Scan Rules [50001]
PASS: Stats Passive Scan Rule [50003]
PASS: Insecure JSF ViewState [90001]
PASS: Java Serialization Object [90002]
PASS: Sub Resource Integrity Attribute Missing [90003]
PASS: Charset Mismatch [90011]
PASS: WSDL File Detection [90030]
PASS: Loosely Scoped Cookie [90033]
WARN-NEW: Missing Anti-clickjacking Header [10020] x 4
http://host.docker.internal:5000 (200 OK)
http://host.docker.internal:5000/login (200 OK)
http://host.docker.internal:5000/login?btn=Confirm+Pin&pin=ZAP (200 OK)
http://host.docker.internal:5000/register (200 OK)
WARN-NEW: X-Content-Type-Options Header Missing [10021] x 7
http://host.docker.internal:5000 (200 OK)
http://host.docker.internal:5000/login (200 OK)
http://host.docker.internal:5000/login?__debugger__=yes&cmd=resource&f=console.png (200 OK)
http://host.docker.internal:5000/login?__debugger__=yes&cmd=resource&f=debugger.js (200 OK)
http://host.docker.internal:5000/login?__debugger__=yes&cmd=resource&f=style.css (200 OK)
WARN-NEW: Information Disclosure - Suspicious Comments [10027] x 2
http://host.docker.internal:5000/login?__debugger__=yes&cmd=resource&f=debugger.js (200 OK)
http://host.docker.internal:5000/login?__debugger__=yes&cmd=resource&f=debugger.js (200 OK)
WARN-NEW: Server Leaks Version Information via "Server" HTTP Response Header Field [10036] x 11
http://host.docker.internal:5000 (200 OK)
http://host.docker.internal:5000/login (200 OK)
http://host.docker.internal:5000/login?__debugger__=yes&cmd=resource&f=console.png (200 OK)
http://host.docker.internal:5000/login?__debugger__=yes&cmd=resource&f=style.css (200 OK)
http://host.docker.internal:5000/opt/homebrew/lib/python3.11/site-packages/flask/app.py (404 Not Found)
WARN-NEW: Content Security Policy (CSP) Header Not Set [10038] x 10
http://host.docker.internal:5000 (200 OK)
http://host.docker.internal:5000/login (200 OK)
http://host.docker.internal:5000/opt/homebrew/lib/python3.11/site-packages/flask/app.py (404 Not Found)
http://host.docker.internal:5000/opt/homebrew/lib/python3.11/site-packages/flask/templating.py (404 Not Found)
http://host.docker.internal:5000/opt/homebrew/lib/python3.11/site-packages/jinja2/environment.py (404 Not Found)
WARN-NEW: Non-Storable Content [10049] x 11
http://host.docker.internal:5000/register (302 Found)
http://host.docker.internal:5000 (200 OK)
http://host.docker.internal:5000/login (200 OK)
http://host.docker.internal:5000/opt/homebrew/lib/python3.11/site-packages/flask/app.py (404 Not Found)
http://host.docker.internal:5000/opt/homebrew/lib/python3.11/site-packages/flask/templating.py (404 Not Found)
WARN-NEW: Permissions Policy Header Not Set [10063] x 11
http://host.docker.internal:5000 (200 OK)
http://host.docker.internal:5000/login (200 OK)
http://host.docker.internal:5000/login?btn=Confirm+Pin&pin=ZAP (200 OK)
http://host.docker.internal:5000/opt/homebrew/lib/python3.11/site-packages/flask/app.py (404 Not Found)
http://host.docker.internal:5000/opt/homebrew/lib/python3.11/site-packages/flask/templating.py (404 Not Found)
WARN-NEW: Modern Web Application [10109] x 1
http://host.docker.internal:5000/login (500 Internal Server Error)
WARN-NEW: Absence of Anti-CSRF Tokens [10202] x 4
http://host.docker.internal:5000/login (200 OK)
http://host.docker.internal:5000/login?btn=Confirm+Pin&pin=ZAP (200 OK)
http://host.docker.internal:5000/register (200 OK)
http://host.docker.internal:5000/login (500 Internal Server Error)
WARN-NEW: Application Error Disclosure [90022] x 1
http://host.docker.internal:5000/login (500 Internal Server Error)
FAIL-NEW: 0 FAIL-INPROG: 0 WARN-NEW: 10 WARN-INPROG: 0 INFO: 0 IGNORE: 0 PASS: 50