ZAP Scan Baseline Report

[github-actions[bot]]

• Site: http://cdnjs.cloudflare.com

• Site: http://localhost:3000 New Alerts

  • Content Security Policy (CSP) Header Not Set [10038] total: 12:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/ftp
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • http://localhost:3000/ftp/eastere.gg
    • ..
  • Cross-Domain Misconfiguration [10098] total: 12:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/ftp/acquisitions.md
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • ..
  • Missing Anti-clickjacking Header [10020] total: 12:
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvF-wL&sid=3fcN6sVsuk44nkV0AAAE
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFxjY&sid=GB4nAynyjMfoVlCEAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFxsz&sid=GB4nAynyjMfoVlCEAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFxuT&sid=GB4nAynyjMfoVlCEAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFz1n&sid=xZvIndGpOCfeCbuIAAAC
    • ..
  • Session ID in URL Rewrite [3] total: 12:
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvF-wT&sid=3fcN6sVsuk44nkV0AAAE
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFxjb&sid=GB4nAynyjMfoVlCEAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFxt1&sid=GB4nAynyjMfoVlCEAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFz2C&sid=xZvIndGpOCfeCbuIAAAC
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFzLp&sid=xZvIndGpOCfeCbuIAAAC
    • ..
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 10:
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/
    • http://localhost:3000/home/runner/work/DevSecOps-toolcha1n/DevSecOps-toolcha1n/juice-shop/build/routes/fileServer.js:55:18
    • ..
  • Dangerous JS Functions [10110] total: 2:
    • http://localhost:3000/main.js
    • http://localhost:3000/vendor.js
  • Deprecated Feature Policy Header Set [10063] total: 11:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/ftp
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • http://localhost:3000/ftp/eastere.gg
    • ..
  • Private IP Disclosure [2] total: 1:
    • http://localhost:3000/rest/admin/application-configuration
  • Timestamp Disclosure - Unix [10096] total: 5:
    • http://localhost:3000/main.js
    • http://localhost:3000/rest/admin/application-configuration
    • http://localhost:3000/rest/admin/application-configuration
    • http://localhost:3000/rest/products/search?q=
    • http://localhost:3000/rest/products/search?q=
  • X-Content-Type-Options Header Missing [10021] total: 12:
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvF-hl
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFxjb&sid=GB4nAynyjMfoVlCEAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFxt1&sid=GB4nAynyjMfoVlCEAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFxZa
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=OYvFyjH
    • ..
  • Information Disclosure - Suspicious Comments [10027] total: 3:
    • http://localhost:3000/main.js
    • http://localhost:3000/tutorial.js
    • http://localhost:3000/vendor.js
  • Modern Web Application [10109] total: 11:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/home/runner/work/DevSecOps-toolcha1n/DevSecOps-toolcha1n/juice-shop/build/routes/fileServer.js:39:13
    • http://localhost:3000/home/runner/work/DevSecOps-toolcha1n/DevSecOps-toolcha1n/juice-shop/build/routes/fileServer.js:55:18
    • http://localhost:3000/home/runner/work/DevSecOps-toolcha1n/DevSecOps-toolcha1n/juice-shop/node_modules/express/lib/router/index.js:286:9
    • ..
  • Non-Storable Content [10049] total: 1:
    • http://localhost:3000/ftp/coupons_2013.md.bak
  • Storable and Cacheable Content [10049] total: 1:
    • http://localhost:3000/robots.txt
  • Storable but Non-Cacheable Content [10049] total: 9:
    • http://localhost:3000
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/ftp/acquisitions.md
    • http://localhost:3000/main.js
    • http://localhost:3000/polyfills.js
    • ..

View the following link to download the report. RunnerID:5265342519

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts
  • Absence of Anti-CSRF Tokens [10202] total: 5:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat/login
    • http://localhost:8080/WebGoat/login?error
    • http://localhost:8080/WebGoat/registration
    • http://localhost:8080/WebGoat/register.mvc
  • Content Security Policy (CSP) Header Not Set [10038] total: 5:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat/login
    • http://localhost:8080/WebGoat/login?error
    • http://localhost:8080/WebGoat/registration
    • http://localhost:8080/WebGoat/register.mvc
  • Cookie No HttpOnly Flag [10010] total: 1:
    • http://localhost:8080/WebGoat/
  • Cookie without SameSite Attribute [10054] total: 1:
    • http://localhost:8080/WebGoat/
  • Permissions Policy Header Not Set [10063] total: 5:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat/login
    • http://localhost:8080/WebGoat/login?error
    • http://localhost:8080/WebGoat/registration
    • http://localhost:8080/WebGoat/register.mvc
  • Loosely Scoped Cookie [90033] total: 1:
    • http://localhost:8080/WebGoat/
  • Non-Storable Content [10049] total: 3:
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat/
    • http://localhost:8080/WebGoat/start.mvc
  • Storable and Cacheable Content [10049] total: 8:
    • http://localhost:8080/
    • http://localhost:8080/robots.txt
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/WebGoat
    • http://localhost:8080/WebGoat/css/img/favicon.ico
    • ..
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

View the following link to download the report. RunnerID:5265688271

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

    Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 1:
  • HTTP Only Site [10106] total: 1:
  • Cookie Slack Detector [90027] total: 2:
  • User Agent Fuzzer [10104] total: 24:

View the following link to download the report. RunnerID:5271541733

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

    Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 1:
  • HTTP Only Site [10106] total: 1:
  • Cookie Slack Detector [90027] total: 2:
  • User Agent Fuzzer [10104] total: 24:

View the following link to download the report. RunnerID:5272030659

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

    Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 1:
  • HTTP Only Site [10106] total: 1:
  • Cookie Slack Detector [90027] total: 2:
  • User Agent Fuzzer [10104] total: 24:

View the following link to download the report. RunnerID:5388943291

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

    Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 1:
  • HTTP Only Site [10106] total: 1:
  • Cookie Slack Detector [90027] total: 2:
  • User Agent Fuzzer [10104] total: 24:

View the following link to download the report. RunnerID:5389054833

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

    Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 1:
  • HTTP Only Site [10106] total: 1:
  • Cookie Slack Detector [90027] total: 2:
  • User Agent Fuzzer [10104] total: 24:

View the following link to download the report. RunnerID:5389131504

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

    Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 1:
  • HTTP Only Site [10106] total: 1:
  • Cookie Slack Detector [90027] total: 2:
  • User Agent Fuzzer [10104] total: 24:

View the following link to download the report. RunnerID:5389205401

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

    Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 1:
  • HTTP Only Site [10106] total: 1:
  • Cookie Slack Detector [90027] total: 2:
  • User Agent Fuzzer [10104] total: 24:

View the following link to download the report. RunnerID:5389322685

[github-actions[bot]]

• Site: http://localhost:8080 New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 5:

    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc
    • http://localhost:8080/WebGoat/register.mvc

    Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 1:
  • HTTP Only Site [10106] total: 1:
  • Cookie Slack Detector [90027] total: 2:
  • User Agent Fuzzer [10104] total: 24:

View the following link to download the report. RunnerID:5399961763