- * Examples: {@literal "nmap"}, {@literal }"zap-api-scan"}, {@literal "zap-baseline-scan"} + * Examples: {@literal "nmap"}, {@literal }"zap-automation-framework"} *
*/ public final String secureCodeBoxbScanType; diff --git a/operator/Chart.yaml b/operator/Chart.yaml index 50c7fb63d6..4f386b4375 100644 --- a/operator/Chart.yaml +++ b/operator/Chart.yaml @@ -133,24 +133,20 @@ annotations: - apiVersion: "cascading.securecodebox.io/v1" kind: CascadingRule metadata: - name: "zap-http" + name: "nmap-hostscan" labels: securecodebox.io/invasive: non-invasive - securecodebox.io/intensive: medium + securecodebox.io/intensive: light spec: matches: anyOf: - - category: "Open Port" - attributes: - service: http - state: open - - category: "Open Port" - attributes: - service: https - state: open + - category: "Subdomain" + osi_layer: "NETWORK" scanSpec: - scanType: "zap-baseline-scan" - parameters: ["-t", "{{attributes.service}}://{{$.hostOrIP}}"] + scanType: "nmap" + parameters: + - "-Pn" + - "{{location}}" artifacthub.io/license: Apache-2.0 artifacthub.io/links: | - name: Documentation diff --git a/operator/internal/telemetry/telemetry.go b/operator/internal/telemetry/telemetry.go index 9af2214dbc..cceaa45320 100644 --- a/operator/internal/telemetry/telemetry.go +++ b/operator/internal/telemetry/telemetry.go @@ -48,12 +48,12 @@ var officialScanTypes map[string]bool = map[string]bool{ "typo3scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions "whatweb": true, "wpscan": true, - "zap-baseline-scan": true, + "zap-baseline-scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions "zap-api-scan": true, "zap-full-scan": true, "zap-automation-scan": true, "zap-automation-framework": true, - "zap-advanced-scan": true, + "zap-advanced-scan": true, // deprecated. we'll keep it in this list to still recieve telemetry data from older versions } // telemetryData submitted by operator diff --git a/scanners/zap-advanced/.gitignore b/scanners/zap-advanced/.gitignore deleted file mode 100644 index cdda09d9f0..0000000000 --- a/scanners/zap-advanced/.gitignore +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -*.tar -/scanner/tests/results/* diff --git a/scanners/zap-advanced/.helm-docs.gotmpl b/scanners/zap-advanced/.helm-docs.gotmpl deleted file mode 100644 index 18106eaec4..0000000000 --- a/scanners/zap-advanced/.helm-docs.gotmpl +++ /dev/null @@ -1,467 +0,0 @@ -{{- /* -SPDX-FileCopyrightText: the secureCodeBox authors - -SPDX-License-Identifier: Apache-2.0 -*/ -}} - -{{- define "extra.docsSection" -}} ---- -title: "ZAP Advanced" -category: "scanner" -type: "WebApplication" -state: "released" -appVersion: "{{ template "chart.appVersion" . }}" -usecase: "WebApp & OpenAPI Vulnerability Scanner extend with authentication features" ---- - - - -{{- end }} - -{{- define "extra.dockerDeploymentSection" -}} -## Supported Tags -- `latest` (represents the latest stable release build) -- tagged releases, e.g. `3.0.0`, `2.9.0`, `2.8.0`, `2.7.0` -{{- end }} - -{{- define "extra.chartAboutSection" -}} -## What is ZAP? -:::caution Deprecation Notice -The `zap-advanced` and `zap` ScanType are being deprecated in favor of the `zap-automation-framework`, which encompasses all functionalities of the previous ScanTypes. We recommend transitioning to the "zap-automation-framework" as soon as possible. `zap-advanced` and `zap` ScanTypes will be removed in the upcoming v5 release. For guidance on migrating to "zap-automation-framework," please refer to [migration to zap-automation framework](/docs/scanners/zap-automation-framework#migration-to-zap-automation-framework). -::: - -The Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers*. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. It's also a great tool for experienced pentesters to use for manual security testing. - -To learn more about the ZAP scanner itself visit [https://www.zaproxy.org/](https://www.zaproxy.org/). -{{- end }} - -{{- define "extra.scannerConfigurationSection" -}} -## Scanner Configuration - -Listed below are the arguments supported by the `zap-advanced-scan` script. - -The command line interface can be used to easily run server scans: `-t www.example.com` - -```bash -usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD] - -OWASP secureCodeBox ZAP Client (can be used to automate ZAP instances based on YAML configuration files.) - -optional arguments: - -h, --help show this help message and exit - -z ZAP_URL, --zap-url ZAP_URL - The ZAP API Url used to call the ZAP API. - -a API_KEY, --api-key API_KEY - The ZAP API Key used to call the ZAP API. - -c CONFIG_FOLDER, --config-folder CONFIG_FOLDER - The path to a local folder containing the additional ZAP configuration YAMLs used to configure ZAP. - -t TARGET, --target TARGET - The target to scan with ZAP. - -o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER - The path to a local folder used to store the output files, eg. the ZAP Report or logfiles. - -r XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD, --report-type XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD - The ZAP Report Type. -``` -{{- end }} - -{{- define "extra.chartConfigurationSection" -}} -## Additional Chart Configurations - -By default, the secureCodeBox ZAP Helm Chart installs the scanType `zap-advanced-scan` along with a minimal _default configuration_ based on the HelmChart value `zapConfiguration`. The configuration will be stored in a dedicate scanType specific _configMap_ named `zap-advanced-scantype-config`. Feel free to use the `configMap` or even the HelmChart values to adjust the advanced ZAP configuration settings according to your needs. Details about the different configuration options can be found below. - -Additionally, there will be some ZAP Scripts included, these are stored in the corresponding configMaps `zap-scripts-authentication` and `zap-scripts-session`. Scripts can be used to implement a specific behavior or even new authentication patterns, which are not supported by ZAP out of the box. Feel free to add additional scripts in your own, if you need them. - -```bash - ┌────────────────────────────────────────┐ -┌──────────────────────────────────────┐ │A YAML configuration file for ZAP that │ -│This CM contains ZAP authentication │ │relates to the scanType directly. │ -│scripts that are already included │ │- will be used for all scans by default │ -│within the zap-advanced scanner. │ │- can be configured via Helm Values: │ -│Feel free to add your own. │────────┐ ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐ ┌───────│ zapConfiguration │ -│ │ │ │ │- add your baseline config here │ -│ConfigMap: zap-scripts-authentication │ │ │ ┌───────────────────┐ │ │ │ │ -└──────────────────────────────────────┘ │ │ │ │ │ConfigMap: zap-advanced-scantype-config │ - │ │ │ ZAP Client │ │ │ └────────────────────────────────────────┘ - All scripts are mounted as files │ │ Python3 Module │◀─────┤ - directly into the ZAP container. To use │ │ │ │ │ │ All referenced YAML files will be merged into - them add a corresponding script section │ └───────────────────┘ │ one single YAML configuration. The merged one - in your config YAML. │ │ │ │ │ will be used to configure the ZAP instance. - │ uses API │ -┌──────────────────────────────────────┐ │ │ │ │ │ ┌────────────────────────────────────────┐ -│This CM contains ZAP session │ │ ▼ │ │A YAML configuration for ZAP that │ -│scripts that are already included │ │ │ ┌───────────────────┐ │ │ │relates to a single scan execution. │ -│within the zap-advanced scanner. │ │ │ │ │ │- can by used for selected scans │ -│Feel free to add your own. │────────┼─────┼─▶│ ZAP Proxy │ │ │- not created by default │ -│ │ │ │ │ └───────│- add your scan target specific config │ -│ConfigMap: zap-scripts-session │ │ │ └───────────────────┘ │ │- needs to be referenced in Scan │ -└──────────────────────────────────────┘ │ │- please use SecretMap for credentials! │ -┌──────────────────────────────────────┐ │ │ secureCodeBox scanner │ │ │ -│Feel free to add your own scripts :) │ │ scanType: zap-advanced │ConfigMap: zap-advanced-scan-config │ -│ │────────┘ └ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┘ └────────────────────────────────────────┘ -│ConfigMap: zap-scripts-your-name │ -└──────────────────────────────────────┘ - -``` - -The following picture outlines the reference concept of the ZAP YAML configuration `zapConfiguration`. If you want to configure an `api` scan, `spider` or active `scan` you must at least add one `context` item with a `name` and `url` configured. The context `url` must match the target url used in the `Scan` execution: - -```yaml -spec: - scanType: "zap-advanced-scan" - parameters: - # target URL must match with `context.url` to identify the corresponding configurations. - - "-t" - - "http://bodgeit.default.svc:8080/bodgeit/" -``` - -If you want to configure the `api` scan, `spider` or active `scan` section it is mandatory to add the `context: ` reference the section. Otherwise it is not possible to identify which configuration must be used for a scan. The `url` in the `api` , `spider` or active 'scan` section can be different to the context.url (and scan target url). - -```bash -┌────────────────────────────────────────────────────────────────┐ -│ ZAP Configuration YAML - reference by "context name" │ -└────────────────────────────────────────────────────────────────┘ - -┌────────────────┐ ┌────────────────┐ -│ Context │ │ Context │ -│ - name: ABC │◀───┬─┬─┐ │ - name: XYZ │◀───┬─┬─┐ -│ url: ... │ │ │ │ │ url: ... │ │ │ │ -└────────────────┘ │ │ │ └────────────────┘ │ │ │ - ┌─────────────────┐ │ │ │ ┌─────────────────┐ │ │ │ - │ API: │ │ │ │ │ API: │ │ │ │ - │ - context: ABC │──┘ │ │ │ - context: XYZ │──┘ │ │ - │ - ... │ │ │ │ - ... │ │ │ - └─────────────────┘ │ │ └─────────────────┘ │ │ - ┌─────────────────┐ │ │ ┌─────────────────┐ │ │ - │ Spider: │ │ │ │ Spider: │ │ │ - │ - context: ABC │──┘ │ │ - context: XYZ │──┘ │ - │ - ... │ │ │ - ... │ │ - └─────────────────┘ │ └─────────────────┘ │ - ┌─────────────────┐ │ ┌─────────────────┐ │ - │ Scanner: │ │ │ Scanner: │ │ - │ - context: ABC │──┘ │ - context: XYZ │──┘ - │ - ... │ │ - ... │ - └─────────────────┘ └─────────────────┘ - -``` - -## ZAP Configuration -The following YAMl gives you an overview about all the different configuration options you have to configure the ZAP advanced scan. Please have a look into our `./examples/...` to find some working examples. We provide a list of working examples to scan our `demo-targets` with the `zap-advanced-scan`. - -:::note - -The YAML format is based on the new [ZAP Automation Framework](https://www.zaproxy.org/docs/desktop/addons/automation-framework/) but not exactly the same. The ZAP Automation Framework is a new approach of the ZAP Team to ease up the automation possibilities of the ZAP scanner itself. Since this ZAP Automation Framework is not ready yet we are not using it for now. We track the progress in this [issue #321](https://github.com/secureCodeBox/secureCodeBox/issues/321) for the future. - -The ZAP Automation format represents a more "imperative" semantic, due to the fact that you have to configure sequences of "jobs" containing the steps to configure and automate ZAP. In contrast to that has the secureCodeBox `zap-advanced` YAML format `zapConfiguration` a "declarative" semantic. The similarity of both YAML formats can help to migrate to the ZAP Automation Framework. - -::: - -```yaml -zapConfiguration: - # -- Optional general ZAP Configurations settings. - global: - # -- The ZAP internal Session name. Default: secureCodeBox - sessionName: secureCodeBox - # -- Updates all installed ZAP AddOns on startup if true, otherwise false. - addonUpdate: true - # -- Installs additional ZAP AddOns on startup, listed by their name: - addonInstall: - - pscanrulesBeta - - ascanrulesBeta - - pscanrulesAlpha - - ascanrulesAlpha - # -- An optional list of global regexes to include - includePaths: - - "https://example.com/.*" - # -- An optional list of global regexes to exclude - excludePaths: - # - "https://example.com/authserver/v1/.*" - - ".*\\.js" - - ".*\\.css" - - ".*\\.png" - - ".*\\.jpeg" - # -- Configures a proxy for ZAP to tunnel the traffic somewhere else - proxy: - # -- Define if an outgoing proxy server is used. - enabled: false - # -- The proxy port to use - port: 8080 - # -- MANDATORY only if useProxyChain is True, ignored otherwise. Outgoing proxy address and port - address: my.corp.proxy - # -- Define the addresses to skip in case useProxyChain is True. Ignored otherwise. List can be empty. - skipProxyAddresses: - - "127.0.0.1" - - localhost - # -- MANDATORY only if proxy.enabled is True. Ignored otherwise. Define if proxy server needs authentication - authentication: - enabled: false - proxyUsername: "" - proxyPassword: "" - proxyRealm: "" - # -- Configures existings ZAP Scripts or add new ZAP Scripts. For example can be used if a proxy script must be loaded. Proxy scripts are executed for every request traversing ZAP - scripts: - - name: "Alert_on_HTTP_Response_Code_Errors.js" - # -- True if the script must be enabled, false otherwise - enabled: false - # -- The complete filepath (inside the ZAP Container!) to the script file. - filePath: "/home/zap/.ZAP_D/scripts/scripts/httpsender/Alert_on_HTTP_Response_Code_Errors.js" - # -- The script engine. Possible values are: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts - engine: "Oracle Nashorn" - # -- The type of script engine used. Possible values are: 'httpsender', 'authentication', 'session', 'proxy', ... - type: "httpsender" - # -- A short description for the script. - description: "A HTTP Sender Script which will raise alerts based on HTTP Response codes." - - name: "Alert_on_Unexpected_Content_Types.js" - # -- True if the script must be enabled, false otherwise - enabled: false - # -- The complete filepath (inside the ZAP Container!) to the script file. - filePath: "/home/zap/.ZAP_D/scripts/scripts/httpsender/Alert_on_Unexpected_Content_Types.js" - # -- The type of script engine used. Possible values are: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts - engine: "Oracle Nashorn" - # -- The type of the script. Possible values are: 'httpsender', 'authentication', 'session', 'proxy', ... - type: "httpsender" - # -- A short description for the script. - description: "A HTTP Sender Script which will raise alerts based on unexpected Content-Types." - - # -- Optional list of ZAP Context definitions - contexts: - # -- Name to be used to refer to this context in other jobs, mandatory - - name: scbcontext - # -- The top level URL - url: https://example.com/ - # -- An optional list of regexes to include in the ZAP context - includePaths: - - "https://example.com/.*" - # -- An optional list of regexes to exclude in the ZAP context - excludePaths: - # - "https://example.com/authserver/v1/.*" - - ".*\\.js" - - ".*\\.css" - - ".*\\.png" - - ".*\\.jpeg" - # -- Optional technology list - technology: - # -- By default all technologies are enabed for each context by ZAP. You can use the following config to change that explicitly. - included: - - Db.CouchDB - - Db.Firebird - - Db.HypersonicSQL - - Language.ASP - - OS - # -- By default all technologies are enabed for each context by ZAP. You can use the following config to change that explicitly. - excluded: - - SCM - # -- Authentication Configuration that can be uses by ZAP Spider and/or Scanner. You need to reference the `context` name in the corresponding `zapConfiguration.spiders[0].context` and `zapConfiguration.scanners[0].context` section if you want to use them. - authentication: - # -- Currently supports "basic-auth", "form-based", "json-based", "script-based" - type: "script-based" - # -- Optional, only mandatory if zapConfiguration.contexts[0].authentication.type: "script-based". More ZAP details about 'script based' authentication can be found here: https://www.zaproxy.org/docs/api/#script-based-authentication. - script-based: - # -- The name of the authentication script - name: scb-oidc-password-grand-type.js - # -- Enables the script if true, otherwise false - enabled: true - # -- The type of script engine used. Possible values are: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts - engine: "Oracle Nashorn" - # -- Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount) - filePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js" - # -- A short description for the script. - description: "This is a description for the SCB OIDC Script." - # -- Optional list of all script arguments needed to be passed to the script. - arguments: - sub: "secureCodeBox@iteratec.com" - email: "secureCodeBox@teratec.com" - exp: "1609459140" - # -- Optional, only mandatory if zapConfiguration.contexts[0].authentication.type: "basic-auth". More ZAP details about 'basic auth' based authentication can be found here: https://www.zaproxy.org/docs/api/?python#general-steps. - basic-auth: - # -- The hostname that must be for the basic authentication - hostname: "https://example.com/" - # -- The realm that must be for the basic authentication - realm: "Realm" - # -- The port that must be for the basic authentication - port: 8080 - # -- Optional, only mandatory if zapConfiguration.contexts[0].authentication.type: "form-based". More ZAP details about 'form-based' based authentication can be found here: https://www.zaproxy.org/docs/api/#form-based-authentication. - form-based: - # -- The URL to the login form that must be used - loginUrl: "http://localhost:8090/bodgeit/login.jsp" - # -- The mapping of username and password to HTTP post parameters. Hint: the value must be escaped already to prevent YAML parser colidations. Example the intended value 'username={%username%}&password={%password%}' must be ''username%3D%7B%25username%25%7D%26password%3D%7B%25password%25%7D. - loginRequestData: "username%3D%7B%25username%25%7D%26password%3D%7B%25password%25%7D" - # -- Optional, only mandatory if zapConfiguration.contexts[0].authentication.type: "json-based". More ZAP details about 'json-based' based authentication can be found here: https://www.zaproxy.org/docs/api/#json-based-authentication. - json-based: - loginUrl: "http://localhost:3000/rest/user/login" - # must be escaped already to prevent yaml parser colidations '{"user":{"id":1,"email":"test@test.com"}}'' - loginRequestData: '{"user":{"id":1,"email":"test@test.com"}}' - # -- Indicates if the current Zap User Session is based on a valid authentication (loggedIn) or not (loggedOut) - verification: - # -- The optional ZAP indiator string for loggedIn Users - isLoggedInIndicator: "" - # -- The optional ZAP indiator string for loggedOut Users - isLoggedOutIndicator: "" - # -- A list of users with credentials which can be referenced by spider or scanner configurations to run them authenticated (you have to configure the authentiation settings). Hint: you can use secretMaps to seperate credentails. - users: - # -- The name of this user configuration - - name: test-user-1 - # -- The username used to authenticate this user - username: user1 - # -- The password used to authenticate this user - password: password1 - # -- Optional, could be set to True only once in the users list. If not defined the first user in the list will be forced by default. - forced: true - # -- The name of this user configuration - - name: test-user-2 - # -- The username used to authenticate this user - username: user2 - # -- The password used to authenticate this user - password: password2 - # -- The optional ZAP session configuration - session: - # -- The ZAP Session type indicates how Zap identifies sessions. Currently supports the following types: "scriptBasedSessionManagement", "cookieBasedSessionManagement", "httpAuthSessionManagement" - type: "scriptBasedSessionManagement" - # -- Optional, only mandatory if zapConfiguration.contexts[0].session.type: "scriptBasedSessionManagement". Additional configrations for the session type "scriptBasedSessionManagement" - scriptBasedSessionManagement: - # -- The name of the session script to be used. - name: "juiceshop-session-management.js" - # -- Enables the script if true, otherwise false - enabled: true - # -- The type of script engine used. Possible values are: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts - engine: "Oracle Nashorn" - # -- Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount) - fileName: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js" - # -- An optional description used for the script. - description: "This is a JuiceShop specific SessionManagement Script used to handle JWT." - - # -- Optional list of ZAP OpenAPI configurations - apis: - # -- The name of the api configuration - - name: scb-petstore-api - # -- The Name of the context (zapConfiguration.contexts[x].name) to reference, default: the first context available - context: scb-petstore-context - # -- The used format of the API. Possible values are: 'openapi', 'grapql', 'soap' - format: openapi - # -- Url to start importing the API from, default: first context URL - url: http://localhost:8000/v2/swagger.json - # -- Optional: Override host setting in the API (e.g. swagger.json) if your API is using some kind of internal routing. - hostOverride: http://localhost:8000 - # -- Optional: Assumes that the API Spec has been saved to a configmap in the namespace of the scan / this release. Should be null if not used. - configMap: - # Object with two keys: "name" name of the config map, and "key" which is the key / property in the configmap which holds the openapi spec file. - name: my-configmap-with-openapi-spec - key: openapi.yaml - # -- Allows to embed the entire yaml / json API spec in the values (e.g. OpenAPI YAML spec). Should be null if not used. - spec: null - # -- Configures existings ZAP Scripts or add new ZAP Scripts. For example can be used if a proxy script must be loaded. Proxy scripts are executed for every request traversing ZAP - scripts: - - name: "Alert_on_HTTP_Response_Code_Errors.js" - # -- True if the script must be enabled, false otherwise - enabled: true - - name: "Alert_on_Unexpected_Content_Types.js" - # -- True if the script must be enabled, false otherwise - enabled: true - - # -- Optional list of ZAP Spider configurations - spiders: - # -- String: The name of the spider configuration - - name: scbspider - # -- String: The Name of the context (zapConfiguration.contexts[x].name) to spider, default: first context available - context: scbcontext - # -- String: The Name of the user (zapConfiguration.contexts[0].users[0].name) used to authenticate the spider with - user: "test-user-1" - # -- String: Url to start spidering from, default: first context URL - url: https://example.com/ - # -- Bool: Whether to use the ZAP ajax spider, default: false - ajax: false - # -- Int: Fail if spider finds less than the specified number of URLs, default: 0 - failIfFoundUrlsLessThan: 0 - # -- Int: Warn if spider finds less than the specified number of URLs, default: 0 - warnIfFoundUrlsLessThan: 0 - # -- Int: The max time in minutes the spider will be allowed to run for, default: 0 unlimited - maxDuration: 0 - # -- Int: The maximum tree depth to explore, default 5 - maxDepth: 5 - # -- Int: The maximum number of children to add to each node in the tree - maxChildren: 10 - # -- Bool: Whether the spider will accept cookies, default: true - acceptCookies: true - # -- Bool: Whether the spider will handle OData responses, default: false - handleODataParametersVisited: false - # -- Enum [ignore_completely, ignore_value, use_all]: How query string parameters are used when checking if a URI has already been visited, default: use_all - handleParameters: use_all - # -- Int: The max size of a response that will be parsed, default: 2621440 - 2.5 Mb - maxParseSizeBytes: 2621440 - # -- Bool: Whether the spider will parse HTML comments in order to find URLs, default: true - parseComments: true - # Bool: Whether the spider will parse Git metadata in order to find URLs, default: false - parseGit: false - # -- Bool: Whether the spider will parse 'robots.txt' files in order to find URLs, default: true - parseRobotsTxt: true - # -- Bool: Whether the spider will parse 'sitemap.xml' files in order to find URLs, default: true - parseSitemapXml: true - # -- Bool: Whether the spider will parse SVN metadata in order to find URLs, default: false - parseSVNEntries: false - # -- Bool: Whether the spider will submit POST forms, default: true - postForm: true - # -- Bool: Whether the spider will process forms, default: true - processForm: true - # -- Int: The time between the requests sent to a server in milliseconds, default: 200 - requestWaitTime: 200 - # -- Bool: Whether the spider will send the referer header, default: true - sendRefererHeader: true - # -- Int: The number of spider threads, default: 2 - threadCount: 2 - # -- String: The user agent to use in requests, default: '' - use the default ZAP one - userAgent: "secureCodeBox / ZAP Spider" - # -- Configures existings ZAP Scripts or add new ZAP Scripts. For example can be used if a proxy script must be loaded. Proxy scripts are executed for every request traversing ZAP - scripts: {} - - # -- Optional list of ZAP Active Scanner configurations - scanners: - # -- String: Name of the context to attack, default: first context - - name: scbscan - # -- String: Name of the context to attack, default: first context - context: scbcontext - # -- String: Url to start scaning from, default: first context URL - url: https://example.com/ - # -- String: The name of the default scan policy to use, default: Default Policy - defaultPolicy: "Default Policy" - # -- String: Name of the scan policy to be used, default: Default Policy - policy: "Default Policy" - # -- Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited - maxRuleDurationInMins: 0 - # -- Int: The max time in minutes the active scanner will be allowed to run for, default: 0 unlimited - maxScanDurationInMins: 0 - # -- Int: The delay in milliseconds between each request, use to reduce the strain on the target, default 0 - delayInMs: 0 - # -- Bool: If set will add an extra query parameter to requests that do not have one, default: false - addQueryParam: false - # -- Bool: If set then automatically handle anti CSRF tokens, default: false - handleAntiCSRFTokens: false - # -- Bool: If set then the relevant rule Id will be injected into the X-ZAP-Scan-ID header of each request, default: false - injectPluginIdInHeader: false - # -- Bool: If set then the headers of requests that do not include any parameters will be scanned, default: false - scanHeadersAllRequests: false - # -- Int: The max number of threads per host, default: 2 - threadPerHost: 2 - # -- The policy definition, only used if the 'policy' is not set - NOT YET IMPLEMENTED - policyDefinition: - # -- String: The default Attack Strength for all rules, one of Low, Medium, High, Insane (not recommended), default: Medium - defaultStrength: Medium - # -- String: The default Alert Threshold for all rules, one of Off, Low, Medium, High, default: Medium - defaultThreshold: Medium - # -- A list of one or more active scan rules and associated settings which override the defaults - rules: - # -- Int: The rule id as per https://www.zaproxy.org/docs/alerts/ - - id: 10106 - # -- The name of the rule for documentation purposes - this is not required or actually used - name: "rule" - # -- String: The Attack Strength for this rule, one of Low, Medium, High, Insane, default: Medium - strength: Medium - # -- String: The Alert Threshold for this rule, one of Off, Low, Medium, High, default: Medium - threshold: Low - # -- Configures existings ZAP Scripts or add new ZAP Scripts. For example can be used if a proxy script must be loaded. Proxy scripts are executed for every request traversing ZAP - scripts: {} -``` -{{- end }} - -{{- define "extra.scannerLinksSection" -}} -[zap github]: https://github.com/zaproxy/zaproxy/ -[zap user guide]: https://www.zaproxy.org/docs/ -{{- end }} diff --git a/scanners/zap-advanced/.helmignore b/scanners/zap-advanced/.helmignore deleted file mode 100644 index 73ddd6eb2c..0000000000 --- a/scanners/zap-advanced/.helmignore +++ /dev/null @@ -1,46 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ -# Node.js files -node_modules/* -package.json -package-lock.json -src/* -config/* -Dockerfile -.dockerignore -*.tar -parser/* -# this doesn't look too good but is required so that the scanners/scripts folder is included -scanner/*.* -scanner/zapclient/ -scanner/tests/ -scanner/venv/ -scanner/.pytest_cache/ -scanner/.idea/ -integration-tests/* -examples/* -docs/* -Makefile diff --git a/scanners/zap-advanced/Chart.yaml b/scanners/zap-advanced/Chart.yaml deleted file mode 100644 index a6bcd27c88..0000000000 --- a/scanners/zap-advanced/Chart.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 - -apiVersion: v2 -name: zap-advanced -description: A Helm chart for the ZAP (extended with advanced authentication features) security scanner that integrates with the secureCodeBox. -type: application -# version - gets automatically set to the secureCodeBox release version when the helm charts gets published -version: v3.1.0-alpha1 -appVersion: "2.16.1" -kubeVersion: ">=v1.11.0-0" -annotations: - versionApi: https://api.github.com/repos/zaproxy/zaproxy/releases/latest -keywords: - - security - - ZAP - - OWASP - - scanner - - secureCodeBox -home: https://www.securecodebox.io/docs/scanners/ZAP -icon: https://www.securecodebox.io/img/integrationIcons/ZAP.svg -sources: - - https://github.com/secureCodeBox/secureCodeBox -maintainers: - - name: iteratec GmbH - email: secureCodeBox@iteratec.com diff --git a/scanners/zap-advanced/Makefile b/scanners/zap-advanced/Makefile deleted file mode 100644 index e582962f3c..0000000000 --- a/scanners/zap-advanced/Makefile +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/make -f -# -# SPDX-FileCopyrightText: the secureCodeBox authors -# -# SPDX-License-Identifier: Apache-2.0 -# - -include_guard = set -scanner = zap-advanced -custom_scanner = set - -include ../../scanners.mk - -unit-tests: - @$(MAKE) -s unit-test-py - -unit-tests-parser: - $(MAKE) -s -f ../../scanners.mk unit-tests-parser include_guard=set scanner=zap - -install-deps: - cd $(SCANNERS_DIR)/zap/ && $(MAKE) -s install-deps - -docker-build-parser: - cd $(SCANNERS_DIR)/zap/ && $(MAKE) -s docker-build-parser - -docker-export-parser: - cd $(SCANNERS_DIR)/zap/ && $(MAKE) -s docker-export-parser - -kind-import-parser: - cd $(SCANNERS_DIR)/zap/ && $(MAKE) -s kind-import-parser - -deploy-with-scanner: - @echo ".: 💾 Deploying custom '$(scanner)' scanner HelmChart with the docker tag '$(IMG_TAG)' into kind namespace 'integration-tests'." - helm -n integration-tests upgrade --install $(scanner) ./ --wait \ - --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-zap" \ - --set="parser.image.tag=$(IMG_TAG)" \ - --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(scanner)" \ - --set="scanner.image.tag=$(IMG_TAG)" - -deploy-test-deps: deploy-test-dep-bodgeit deploy-test-dep-juiceshop deploy-test-dep-petstore - -integration-tests: - @echo ".: 🩺 Starting integration test in kind namespace 'integration-tests'." - kubectl -n integration-tests delete scans --all - kubectl apply -f ./integration-tests/scantype-configMap.yaml -n integration-tests - cd $(SCANNERS_DIR) && npm ci && cd $(scanner)/integration-tests && npm run test:integration -- $(scanner)/integration-tests diff --git a/scanners/zap-advanced/README.md b/scanners/zap-advanced/README.md deleted file mode 100644 index 97178085b6..0000000000 --- a/scanners/zap-advanced/README.md +++ /dev/null @@ -1,549 +0,0 @@ ---- -title: "ZAP Advanced" -category: "scanner" -type: "WebApplication" -state: "released" -appVersion: "2.16.1" -usecase: "WebApp & OpenAPI Vulnerability Scanner extend with authentication features" ---- - - - - - - -
- 
- 
-
-
- 
-
-
-
-
-
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.<\/p>", - "instances": [ - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/choose.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/valve.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/tagfiles/panel.jsp.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/loader.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/connectors.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/HelloWorldSimpleTag.java.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/apr.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/introduction.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/listeners.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample", - "method": "POST" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/class-loader-howto.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestParamExample", - "method": "POST" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspx/textRotate.jspx.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/helloworld.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/security-howto.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/jasper-howto.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/misc/config.jsp.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-interceptor.html", - "method": "GET" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/index.html", - "method": "GET" - } - ], - "count": "298", - "solution": "
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: \"Content-Security-Policy\" for Chrome 25+, Firefox 23+ and Safari 7+, \"X-Content-Security-Policy\" for Firefox 4.0+ and Internet Explorer 10+, and \"X-WebKit-CSP\" for Chrome 14+ and Safari 6+.<\/p>", - "reference": "
https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy<\/p>
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html<\/p>
http://www.w3.org/TR/CSP/<\/p>
http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html<\/p>
http://www.html5rocks.com/en/tutorials/security/content-security-policy/<\/p>
http://caniuse.com/#feat=contentsecuritypolicy<\/p>
http://content-security-policy.com/<\/p>", - "cweid": "16", - "wascid": "15", - "sourceid": "3" - }, - { - "pluginid": "10020", - "alert": "X-Frame-Options Header Not Set", - "name": "X-Frame-Options Header Not Set", - "riskcode": "2", - "confidence": "2", - "riskdesc": "Medium (Medium)", - "desc": "
X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks.<\/p>", - "instances": [ - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/rewrite.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/mbean-names.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/faq.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/include/include.jsp.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/automatic-deployment.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colors.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/tagfiles/hello.jsp", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/index.xhtml", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/cluster-howto.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/echo.xhtml", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsptoserv/jts.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/simpletag/foo.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/Functions.java.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/choose.jsp", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/interceptors.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-jndi-realm.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/dates/date.html", - "method": "GET", - "param": "X-Frame-Options" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestHeaderExample", - "method": "GET", - "param": "X-Frame-Options" - } - ], - "count": "280", - "solution": "
Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. ALLOW-FROM allows specific websites to frame the web page in supported web browsers).<\/p>", - "reference": "
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options<\/p>", - "cweid": "16", - "wascid": "15", - "sourceid": "3" - }, - { - "pluginid": "10036", - "alert": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", - "name": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", - "riskcode": "1", - "confidence": "3", - "riskdesc": "Low (High)", - "desc": "
The web/application server is leaking version information via the \"Server\" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.<\/p>", - "instances": [ - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/filter.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/num/numguess.jsp.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/implicit-objects.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/cal/cal2.jsp.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/index.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/hello.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/book.jsp.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/basic-comparisons.jsp.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/http.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/developers.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/maven-jars.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/service.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/mbeans-descriptors-howto.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/chat.xhtml", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/api/org/apache/catalina/Host.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/snp/snoop.jsp.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/functions.jsp.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/foreach.jsp", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-objects.html", - "method": "GET", - "evidence": "Apache-Coyote/1.1" - } - ], - "count": "337", - "solution": "
Ensure that your web server, application server, load balancer, etc. is configured to suppress the \"Server\" header or provide generic details.<\/p>", - "reference": "
http://httpd.apache.org/docs/current/mod/core.html#servertokens<\/p>
http://msdn.microsoft.com/en-us/library/ff648552.aspx#ht_urlscan_007<\/p>
http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx<\/p>
http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html<\/p>", - "cweid": "200", - "wascid": "13", - "sourceid": "3" - }, - { - "pluginid": "10096", - "alert": "Timestamp Disclosure - Unix", - "name": "Timestamp Disclosure - Unix", - "riskcode": "0", - "confidence": "1", - "riskdesc": "Informational (Low)", - "desc": "
A timestamp was disclosed by the application/web server - Unix<\/p>", - "instances": [ - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000000039" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000000008" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000014963" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000018373" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/snp/snoop.jsp", - "method": "GET", - "evidence": "20100101" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000000018" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000005503" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000000026" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000015294" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000016347" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000002280" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000043589" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000015448" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000007734" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000010013" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/manager-howto.html", - "method": "GET", - "evidence": "46800300" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000005214" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000043442" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000005368" - }, - { - "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", - "method": "GET", - "evidence": "0000000301" - } - ], - "count": "51", - "solution": "
Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.<\/p>", - "otherinfo": "
0000000039, which evaluates to: 1970-01-01 00:00:39<\/p>", - "reference": "
http://projects.webappsec.org/w/page/13246936/Information%20Leakage<\/p>", - "cweid": "200", - "wascid": "13", - "sourceid": "3" - }, - { - "pluginid": "10108", - "alert": "Reverse Tabnabbing", - "name": "Reverse Tabnabbing", - "riskcode": "2", - "confidence": "2", - "riskdesc": "Medium (Medium)", - "desc": "
At least one link on this page is vulnerable to Reverse tabnabbing as it uses a target attribute without using both of the \"noopener\" and \"noreferrer\" keywords in the \"rel\" attribute, which allows the target page to take control of this page.<\/p>",
- "instances": [
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/class-loader-howto.html",
- "method": "GET",
- "evidence": " Do not use a target attribute, or if you have to then also add the attribute: rel=\"noopener noreferrer\".<\/p>",
- "reference": " https://owasp.org/www-community/attacks/Reverse_Tabnabbing<\/p> https://dev.to/ben/the-targetblank-vulnerability-by-example<\/p> https://mathiasbynens.github.io/rel-noopener/<\/p> https://medium.com/@jitbit/target-blank-the-most-underestimated-vulnerability-ever-96e328301f4c<\/p> <\/p>",
- "sourceid": "3"
- },
- {
- "pluginid": "10021",
- "alert": "X-Content-Type-Options Header Missing",
- "name": "X-Content-Type-Options Header Missing",
- "riskcode": "1",
- "confidence": "2",
- "riskdesc": "Low (Medium)",
- "desc": " The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.<\/p>",
- "instances": [
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsptoserv/jts.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/automatic-deployment.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/mbean-names.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/include/include.jsp.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/rewrite.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/basic-arithmetic.jsp",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/tomcat.png",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colors.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/images/asf-feather.png",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-apps.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/introduction.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/faq.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/servletapi/index.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/misc/dynamicattrs.jsp.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/building.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/images/code.gif",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-receiver.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/deployer-howto.html",
- "method": "GET",
- "param": "X-Content-Type-Options"
- }
- ],
- "count": "316",
- "solution": " Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.<\/p> If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.<\/p>",
- "otherinfo": " This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.<\/p> At \"High\" threshold this scanner will not alert on client or server error responses.<\/p>",
- "reference": " http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx<\/p> https://owasp.org/www-community/Security_Headers<\/p>",
- "cweid": "16",
- "wascid": "15",
- "sourceid": "3"
- },
- {
- "pluginid": "10202",
- "alert": "Absence of Anti-CSRF Tokens",
- "name": "Absence of Anti-CSRF Tokens",
- "riskcode": "1",
- "confidence": "2",
- "riskdesc": "Low (Medium)",
- "desc": " No Anti-CSRF tokens were found in a HTML submission form.<\/p> A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.<\/p> <\/p> CSRF attacks are effective in a number of situations, including:<\/p> * The victim has an active session on the target site.<\/p> * The victim is authenticated via HTTP auth on the target site.<\/p> * The victim is on the same local network as the target site.<\/p> <\/p> CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.<\/p>",
- "instances": [
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/num/numguess.jsp",
- "method": "GET",
- "evidence": "![\"The](\"./images/asf-feather.png\")
<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/virtual-hosting-howto.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-valve.html",
- "method": "GET",
- "evidence": "![\"The](\"../images/asf-feather.png\")
<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/windows-service-howto.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-manager.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/apr.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/connectors.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/security-howto.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-channel.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/jasper-howto.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/transport.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/status.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/processes.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/realm.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/index.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/building.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/introduction.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/systemprops.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/membership.html",
- "method": "GET",
- "evidence": "<\/a>"
- },
- {
- "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-deployer.html",
- "method": "GET",
- "evidence": "<\/a>"
- }
- ],
- "count": "102",
- "solution": "