Skip to content

Commit bff8ec1

Browse files
kingthorinkingthorin
authored
Merge pull request #2706 from ricekot/scripts-alert-pages
Update alert pages for script scan rules
2 parents c49d4a0 + 5064734 commit bff8ec1

29 files changed

+595
-4
lines changed

‎site/content/docs/alerts/100002.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: "Server is running on Clacks - GNU Terry Pratchett"
3+
alertid: 100002
4+
alertindex: 10000200
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Informational
10+
solution: "Give the sysadmin a high five and rejoice in the disc world."
11+
references:
12+
- https://xclacksoverhead.org/home/about
13+
other: ""
14+
cwe: 200
15+
wasc: 13
16+
alerttags:
17+
- CWE-200
18+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/clacks.js
19+
linktext: "passive/clacks.js"
20+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
21+
---
22+
The web/application server is running over the Clacks network, some say it's turtles/IP, some say it's turtles all the way down the layer stack.
23+

‎site/content/docs/alerts/100003.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
title: "Cookie Set Without HttpOnly Flag"
3+
alertid: 100003
4+
alertindex: 10000300
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Low
10+
solution: "Ensure that the HttpOnly flag is set for all cookies."
11+
other: ""
12+
wasc: 13
13+
alerttags:
14+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/CookieHTTPOnly.js
15+
linktext: "passive/CookieHTTPOnly.js"
16+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
17+
---
18+
A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.
19+

‎site/content/docs/alerts/100004.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
title: "Content Security Policy Violations Reporting Enabled"
3+
alertid: 100004
4+
alertindex: 10000400
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Informational
10+
solution: "Site owner will be notified at each policies violations, so, start by analyzing if a real monitoring of the notifications is in place before to use fuzzing or to be more aggressive. "
11+
references:
12+
- https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_CSP_violation_reports
13+
other: ""
14+
cwe: 200
15+
wasc: 13
16+
alerttags:
17+
- CWE-200
18+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/detect_csp_notif_and_reportonly.js
19+
linktext: "passive/detect_csp_notif_and_reportonly.js"
20+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
21+
---
22+

‎site/content/docs/alerts/100005.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: "SameSite Cookie Attribute Protection Used"
3+
alertid: 100005
4+
alertindex: 10000500
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Informational
10+
solution: "CSRF possible vulnerabilities presents on the site will be mitigated depending on the browser used by the user (browser defines the support level for this cookie attribute). "
11+
references:
12+
- https://tools.ietf.org/html/draft-west-first-party-cookies
13+
- https://chloe.re/2016/04/13/goodbye-csrf-samesite-to-the-rescue
14+
other: ""
15+
cwe: 352
16+
wasc: 9
17+
alerttags:
18+
- CWE-352
19+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/detect_samesite_protection.js
20+
linktext: "passive/detect_samesite_protection.js"
21+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
22+
---
23+

‎site/content/docs/alerts/100006.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: "Information Disclosure - IP Exposed via F5 BIG-IP Persistence Cookie"
3+
alertid: 100006
4+
alertindex: 10000600
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Informational
10+
solution: "Configure BIG-IP cookie encryption."
11+
references:
12+
- https://support.f5.com/kb/en-us/solutions/public/6000/900/sol6917.html
13+
other: ""
14+
cwe: 311
15+
wasc: 13
16+
alerttags:
17+
- CWE-311
18+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/f5_bigip_cookie_internal_ip.js
19+
linktext: "passive/f5_bigip_cookie_internal_ip.js"
20+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
21+
---
22+
The F5 BIG-IP Persistence cookie set for this website can be decoded to a specific IP and port. An attacker may leverage this information to conduct Social Engineering attacks or other exploits.
23+

‎site/content/docs/alerts/100007.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: "Information Disclosure - Base64-encoded String"
3+
alertid: 100007
4+
alertindex: 10000700
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Informational
10+
solution: "Base64-encoding should not be used to store or send sensitive information."
11+
other: ""
12+
cwe: 311
13+
wasc: 13
14+
alerttags:
15+
- CWE-311
16+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/find%20base64%20strings.js
17+
linktext: "passive/find base64 strings.js"
18+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
19+
---
20+
A Base64-encoded string has been found in the HTTP response body. Base64-encoded data may contain sensitive information such as usernames, passwords or cookies which should be further inspected.
21+

‎site/content/docs/alerts/100008.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: "Information Disclosure - Credit Card Number"
3+
alertid: 100008
4+
alertindex: 10000800
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: High
10+
solution: "Encrypt credit card numbers during transmission, use tokenization, and adhere to PCI DSS standards for secure handling and storage. "
11+
other: ""
12+
cwe: 311
13+
wasc: 13
14+
alerttags:
15+
- CWE-311
16+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/Find%20Credit%20Cards.js
17+
linktext: "passive/Find Credit Cards.js"
18+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
19+
---
20+
A credit card number was found in the HTTP response body.

‎site/content/docs/alerts/100009.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: "Information Disclosure - Email Addresses"
3+
alertid: 100009
4+
alertindex: 10000900
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Low
10+
solution: "Mask email addresses during transmission and ensure proper access controls to protect user privacy and prevent unauthorized access. "
11+
other: ""
12+
cwe: 311
13+
wasc: 13
14+
alerttags:
15+
- CWE-311
16+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/Find%20Emails.js
17+
linktext: "passive/Find Emails.js"
18+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
19+
---
20+
An email address was found in the HTTP response body. Exposure of email addresses in HTTP messages can lead to privacy violations and targeted phishing attacks.
21+

‎site/content/docs/alerts/100010.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: "Information Disclosure - Hash"
3+
alertid: 100010
4+
alertindex: 10001000
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Low
10+
solution: "Ensure that hashes that are used to protect credentials or other resources are not leaked by the web server or database. There is typically no requirement for password hashes to be accessible to the web browser. "
11+
other: ""
12+
cwe: 327
13+
wasc: 13
14+
alerttags:
15+
- CWE-327
16+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/Find%20Hashes.js
17+
linktext: "passive/Find Hashes.js"
18+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
19+
---
20+
A hash was discovered in the HTTP response body.

‎site/content/docs/alerts/100011.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: "Information Disclosure - HTML Comments"
3+
alertid: 100011
4+
alertindex: 10001100
5+
alerttype: "Script Passive"
6+
alertcount: 1
7+
status: alpha
8+
type: alert
9+
risk: Informational
10+
solution: "Remove comments which have sensitive information about the design/implementation of the application. Some of the comments may be exposed to the user and affect the security posture of the application. "
11+
other: ""
12+
cwe: 615
13+
wasc: 13
14+
alerttags:
15+
- CWE-615
16+
code: https://github.com/zaproxy/community-scripts/blob/main/passive/Find%20HTML%20Comments.js
17+
linktext: "passive/Find HTML Comments.js"
18+
help: https://www.zaproxy.org/docs/desktop/addons/community-scripts/
19+
---
20+
While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
21+

0 commit comments

Comments
 (0)