ZAP Full Scan Report

[github-actions[bot]]

• Site: //localhost:8080

• Site: http://localhost:8080 New Alerts

  • Absence of Anti-CSRF Tokens [10202] total: 1:
    • http://localhost:8080/WebGoat/login
  • Anti-CSRF Tokens Check [20012] total: 1:
    • http://localhost:8080/WebGoat/login
  • Content Security Policy (CSP) Header Not Set [10038] total: 1:
    • http://localhost:8080/WebGoat/login
  • HTTP Only Site [10106] total: 1:
    • http://localhost:8080
  • Cookie No HttpOnly Flag [10010] total: 1:
    • http://localhost:8080/WebGoat/
  • Cookie Slack Detector [90027] total: 2:
    • http://localhost:8080/WebGoat/
    • http://localhost:8080/WebGoat/login
  • Cookie without SameSite Attribute [10054] total: 1:
    • http://localhost:8080/WebGoat/
  • Permissions Policy Header Not Set [10063] total: 1:
    • http://localhost:8080/WebGoat/login
  • Loosely Scoped Cookie [90033] total: 1:
    • http://localhost:8080/WebGoat/
  • Non-Storable Content [10049] total: 2:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat/
  • Storable and Cacheable Content [10049] total: 5:
    • http://localhost:8080/
    • http://localhost:8080/favicon.ico
    • http://localhost:8080/robots.txt
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/WebGoat/login
  • User Agent Fuzzer [10104] total: 24:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • ..

View the following link to download the report. RunnerID:5209066174

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts
  • Cloud Metadata Potentially Exposed [90034] total: 1:
    • http://localhost:3000/latest/meta-data/
  • Backup File Disclosure [10095] total: 31:
    • http://localhost:3000/ftp/quarantine%20-%20Copy
    • http://localhost:3000/ftp/quarantine%20-%20Copy%20(2)
    • http://localhost:3000/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_linux_amd_64.url
    • http://localhost:3000/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_linux_arm_64.url
    • http://localhost:3000/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_macos_64.url
    • ..
  • Bypassing 403 [40038] total: 5:
    • http://localhost:3000/%2e/ftp/coupons_2013.md.bak
    • http://localhost:3000/%2e/ftp/eastere.gg
    • http://localhost:3000/%2e/ftp/encrypt.pyc
    • http://localhost:3000/%2e/ftp/package.json.bak
    • http://localhost:3000/%2e/ftp/suspicious_errors.yml
  • CORS Misconfiguration [40040] total: 99:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/assets
    • http://localhost:3000/assets/public
    • http://localhost:3000/assets/public/favicon_js.ico
    • ..
  • Content Security Policy (CSP) Header Not Set [10038] total: 10:
    • http://localhost:3000
    • http://localhost:3000/ftp
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • http://localhost:3000/ftp/eastere.gg
    • http://localhost:3000/ftp/encrypt.pyc
    • ..
  • Cross-Domain Misconfiguration [10098] total: 10:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/ftp/acquisitions.md
    • http://localhost:3000/main.js
    • ..
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 10:
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/
    • http://localhost:3000/home/runner/work/DevSecOps-toolcha1n/DevSecOps-toolcha1n/juice-shop/build/routes/fileServer.js:39:13
    • ..
  • Dangerous JS Functions [10110] total: 2:
    • http://localhost:3000/main.js
    • http://localhost:3000/vendor.js
  • Deprecated Feature Policy Header Set [10063] total: 11:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/ftp
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • http://localhost:3000/ftp/eastere.gg
    • ..
  • Timestamp Disclosure - Unix [10096] total: 1:
    • http://localhost:3000/main.js
  • Information Disclosure - Suspicious Comments [10027] total: 2:
    • http://localhost:3000/main.js
    • http://localhost:3000/vendor.js
  • Modern Web Application [10109] total: 11:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/home/runner/work/DevSecOps-toolcha1n/DevSecOps-toolcha1n/juice-shop/build/routes/fileServer.js:39:13
    • http://localhost:3000/home/runner/work/DevSecOps-toolcha1n/DevSecOps-toolcha1n/juice-shop/build/routes/fileServer.js:55:18
    • http://localhost:3000/home/runner/work/DevSecOps-toolcha1n/DevSecOps-toolcha1n/juice-shop/node_modules/express/lib/router/index.js:286:9
    • ..
  • Storable and Cacheable Content [10049] total: 1:
    • http://localhost:3000/robots.txt
  • Storable but Non-Cacheable Content [10049] total: 10:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/ftp/acquisitions.md
    • http://localhost:3000/main.js
    • ..
  • User Agent Fuzzer [10104] total: 24:
    • http://localhost:3000/assets
    • http://localhost:3000/assets
    • http://localhost:3000/assets
    • http://localhost:3000/assets
    • http://localhost:3000/assets
    • ..

View the following link to download the report. RunnerID:5265342519

[github-actions[bot]]

• Site: //localhost:8080

• Site: http://localhost:8080 New Alerts

  • Absence of Anti-CSRF Tokens [10202] total: 1:
    • http://localhost:8080/WebGoat/login
  • Anti-CSRF Tokens Check [20012] total: 1:
    • http://localhost:8080/WebGoat/login
  • Content Security Policy (CSP) Header Not Set [10038] total: 1:
    • http://localhost:8080/WebGoat/login
  • HTTP Only Site [10106] total: 1:
    • http://localhost:8080
  • Cookie No HttpOnly Flag [10010] total: 1:
    • http://localhost:8080/WebGoat/
  • Cookie Slack Detector [90027] total: 2:
    • http://localhost:8080/WebGoat/
    • http://localhost:8080/WebGoat/login
  • Cookie without SameSite Attribute [10054] total: 1:
    • http://localhost:8080/WebGoat/
  • Permissions Policy Header Not Set [10063] total: 1:
    • http://localhost:8080/WebGoat/login
  • Loosely Scoped Cookie [90033] total: 1:
    • http://localhost:8080/WebGoat/
  • Non-Storable Content [10049] total: 2:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat/
  • Storable and Cacheable Content [10049] total: 5:
    • http://localhost:8080/
    • http://localhost:8080/favicon.ico
    • http://localhost:8080/robots.txt
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/WebGoat/login
  • User Agent Fuzzer [10104] total: 24:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • ..

• Site: http://localhost:8080 New Alerts

  • Absence of Anti-CSRF Tokens [10202] total: 1:
    • http://localhost:8080/WebGoat/login
  • Anti-CSRF Tokens Check [20012] total: 1:
    • http://localhost:8080/WebGoat/login
  • Content Security Policy (CSP) Header Not Set [10038] total: 1:
    • http://localhost:8080/WebGoat/login
  • HTTP Only Site [10106] total: 1:
    • http://localhost:8080
  • Cookie No HttpOnly Flag [10010] total: 1:
    • http://localhost:8080/WebGoat/
  • Cookie Slack Detector [90027] total: 2:
    • http://localhost:8080/WebGoat/
    • http://localhost:8080/WebGoat/login
  • Cookie without SameSite Attribute [10054] total: 1:
    • http://localhost:8080/WebGoat/
  • Permissions Policy Header Not Set [10063] total: 1:
    • http://localhost:8080/WebGoat/login
  • Loosely Scoped Cookie [90033] total: 1:
    • http://localhost:8080/WebGoat/
  • Non-Storable Content [10049] total: 2:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat/
  • Storable and Cacheable Content [10049] total: 5:
    • http://localhost:8080/
    • http://localhost:8080/favicon.ico
    • http://localhost:8080/robots.txt
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/WebGoat/login
  • User Agent Fuzzer [10104] total: 24:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat
    • ..

View the following link to download the report. RunnerID:5265688271