ZAP Scan Baseline Report

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts

  • CSP: Wildcard Directive [10055] total: 1:
    • http://localhost:3000/api-docs

  • Full Path Disclosure [110009] total: 5:

    • http://localhost:3000/ftp/coupons_2013.md.bak
    • http://localhost:3000/ftp/eastere.gg
    • http://localhost:3000/ftp/encrypt.pyc
    • http://localhost:3000/ftp/package.json.bak
    • http://localhost:3000/ftp/suspicious_errors.yml

    Ignored Alerts

  • Content Security Policy (CSP) Header Not Set [10038] total: 10:
  • Cross-Domain Misconfiguration [10098] total: 9:
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 12:
  • Dangerous JS Functions [10110] total: 3:
  • Deprecated Feature Policy Header Set [10063] total: 11:
  • Timestamp Disclosure - Unix [10096] total: 38:
  • Base64 Disclosure [10094] total: 8:
  • Information Disclosure - Suspicious Comments [10027] total: 4:
  • Modern Web Application [10109] total: 11:
  • Sec-Fetch-Dest Header is Missing [90005] total: 3:
  • Sec-Fetch-Mode Header is Missing [90005] total: 3:
  • Sec-Fetch-Site Header is Missing [90005] total: 3:
  • Sec-Fetch-User Header is Missing [90005] total: 3:
  • Storable and Cacheable Content [10049] total: 3:
  • Storable but Non-Cacheable Content [10049] total: 7:

View the following link to download the report. RunnerID:9034343553

---

ZAP is supported by the Crash Override Open Source Fellowship

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts

  • Content Security Policy (CSP) Header Not Set [10038] total: 11:
    • http://localhost:3000/
    • http://localhost:3000/api-docs
    • http://localhost:3000/api-docs/
    • http://localhost:3000/ftp
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • ..
  • Cross-Domain Misconfiguration [10098] total: 10:
    • http://localhost:3000/
    • http://localhost:3000/api-docs
    • http://localhost:3000/api-docs/
    • http://localhost:3000/api-docs/favicon-16x16.png
    • http://localhost:3000/api-docs/swagger-ui.css
    • ..
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 10:
    • http://localhost:3000/
    • http://localhost:3000/
    • http://localhost:3000/juice-shop/build/routes/fileServer.js:39:13
    • http://localhost:3000/juice-shop/build/routes/fileServer.js:39:13
    • http://localhost:3000/juice-shop/build/routes/fileServer.js:55:18
    • ..
  • Dangerous JS Functions [10110] total: 3:
    • http://localhost:3000/api-docs/swagger-ui-bundle.js
    • http://localhost:3000/main.js
    • http://localhost:3000/vendor.js
  • Deprecated Feature Policy Header Set [10063] total: 11:
    • http://localhost:3000/
    • http://localhost:3000/api-docs
    • http://localhost:3000/api-docs/
    • http://localhost:3000/api-docs/swagger-ui-bundle.js
    • http://localhost:3000/api-docs/swagger-ui-init.js
    • ..
  • Timestamp Disclosure - Unix [10096] total: 37:
    • http://localhost:3000/api-docs/swagger-ui-standalone-preset.js
    • http://localhost:3000/api-docs/swagger-ui-standalone-preset.js
    • http://localhost:3000/api-docs/swagger-ui-standalone-preset.js
    • http://localhost:3000/api-docs/swagger-ui-standalone-preset.js
    • http://localhost:3000/api-docs/swagger-ui-standalone-preset.js
    • ..
  • Information Disclosure - Suspicious Comments [10027] total: 4:
    • http://localhost:3000/api-docs/swagger-ui-bundle.js
    • http://localhost:3000/api-docs/swagger-ui-standalone-preset.js
    • http://localhost:3000/main.js
    • http://localhost:3000/vendor.js
  • Modern Web Application [10109] total: 11:
    • http://localhost:3000/
    • http://localhost:3000/api-docs
    • http://localhost:3000/api-docs/
    • http://localhost:3000/juice-shop/build/routes/fileServer.js:39:13
    • http://localhost:3000/juice-shop/build/routes/fileServer.js:55:18
    • ..
  • Storable and Cacheable Content [10049] total: 3:
    • http://localhost:3000/api-docs
    • http://localhost:3000/api-docs/
    • http://localhost:3000/robots.txt

  • Storable but Non-Cacheable Content [10049] total: 7:

    • http://localhost:3000/
    • http://localhost:3000/api-docs/favicon-16x16.png
    • http://localhost:3000/api-docs/favicon-32x32.png
    • http://localhost:3000/api-docs/swagger-ui.css
    • http://localhost:3000/assets/public/favicon_js.ico
    • ..

    Resolved Alerts

  • Full Path Disclosure [110009] total: 5:

View the following link to download the report. RunnerID:9034678527

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • CSP: Wildcard Directive [10055] total: 1:

View the following link to download the report. RunnerID:9075848678