diff --git a/addOns/websocket/src/main/javahelp/org/zaproxy/zap/extension/websocket/resources/help/contents/pscanrules.html b/addOns/websocket/src/main/javahelp/org/zaproxy/zap/extension/websocket/resources/help/contents/pscanrules.html index f0910a8c9d6..e69ed834fb8 100644 --- a/addOns/websocket/src/main/javahelp/org/zaproxy/zap/extension/websocket/resources/help/contents/pscanrules.html +++ b/addOns/websocket/src/main/javahelp/org/zaproxy/zap/extension/websocket/resources/help/contents/pscanrules.html @@ -34,6 +34,27 @@

Base64 Disclosure

ConfidenceMedium +

Information Disclosure: Application Errors

+ + This passive scanner checks incoming WebSocket message payload for known Application Error messages. Access to such details may provide a malicious individual with means by which to further abuse the web site. They may also leak data not specifically meant for end user consumption.
+ +
+ + + + + + +
Use caseOutcome
Warning: Cannot modify header information - headers already sentTrue Positive
'this' is null or not an objectTrue Positive
System.Data.OleDb.OleDbException: Syntax error in string in query expression 'User ID = ? And Password = ?\'True Positive
Examples
+
+ + + + + + +
Default Values
RiskMedium
ConfidenceMedium
CWE ID209: Information Exposure Through an Error Message
WASC ID13: Information Leakage
+

Information Disclosure: Email address

This script scans incoming WebSocket messages for email addresses. Email addresses may be not specifically meant for end user consumption.