ZAP Full Scan Report

[github-actions[bot]]

• Site: http://localhost:3000 New Alerts
  • Cloud Metadata Potentially Exposed [90034] total: 1:
    • http://localhost:3000/latest/meta-data/
  • Backup File Disclosure [10095] total: 31:
    • http://localhost:3000/ftp/quarantine%20-%20Copy
    • http://localhost:3000/ftp/quarantine%20-%20Copy%20(2)
    • http://localhost:3000/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_linux_amd_64.url
    • http://localhost:3000/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_linux_arm_64.url
    • http://localhost:3000/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_macos_64.url
    • ..
  • Bypassing 403 [40038] total: 5:
    • http://localhost:3000/%2e/ftp/coupons_2013.md.bak
    • http://localhost:3000/%2e/ftp/eastere.gg
    • http://localhost:3000/%2e/ftp/encrypt.pyc
    • http://localhost:3000/%2e/ftp/package.json.bak
    • http://localhost:3000/%2e/ftp/suspicious_errors.yml
  • CORS Misconfiguration [40040] total: 94:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/assets
    • http://localhost:3000/assets/public
    • http://localhost:3000/assets/public/favicon_js.ico
    • ..
  • Content Security Policy (CSP) Header Not Set [10038] total: 11:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/ftp
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • http://localhost:3000/ftp/eastere.gg
    • ..
  • Cross-Domain Misconfiguration [10098] total: 12:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/ftp/acquisitions.md
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • ..
  • Web Cache Deception [40039] total: 2:
    • http://localhost:3000/assets
    • http://localhost:3000/assets/public
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 10:
    • http://localhost:3000
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/
    • http://localhost:3000/juice-shop/build/routes/fileServer.js:55:18
    • ..
  • Dangerous JS Functions [10110] total: 2:
    • http://localhost:3000/main.js
    • http://localhost:3000/vendor.js
  • Deprecated Feature Policy Header Set [10063] total: 11:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/ftp
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • http://localhost:3000/ftp/eastere.gg
    • ..
  • Full Path Disclosure [110009] total: 5:
    • http://localhost:3000/ftp/coupons_2013.md.bak
    • http://localhost:3000/ftp/eastere.gg
    • http://localhost:3000/ftp/encrypt.pyc
    • http://localhost:3000/ftp/package.json.bak
    • http://localhost:3000/ftp/suspicious_errors.yml
  • Timestamp Disclosure - Unix [10096] total: 1:
    • http://localhost:3000/main.js
  • Base64 Disclosure [10094] total: 5:
    • http://localhost:3000/ftp
    • http://localhost:3000/ftp/
    • http://localhost:3000/ftp/quarantine
    • http://localhost:3000/main.js
    • http://localhost:3000/vendor.js
  • Information Disclosure - Suspicious Comments [10027] total: 2:
    • http://localhost:3000/main.js
    • http://localhost:3000/vendor.js
  • Modern Web Application [10109] total: 11:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/juice-shop/build/routes/fileServer.js:55:18
    • http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10
    • http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:328:13
    • ..
  • Sec-Fetch-Dest Header is Missing [90005] total: 3:
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/robots.txt
  • Sec-Fetch-Mode Header is Missing [90005] total: 3:
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/robots.txt
  • Sec-Fetch-Site Header is Missing [90005] total: 3:
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/robots.txt
  • Sec-Fetch-User Header is Missing [90005] total: 3:
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/robots.txt
  • Storable and Cacheable Content [10049] total: 1:
    • http://localhost:3000/robots.txt
  • Storable but Non-Cacheable Content [10049] total: 10:
    • http://localhost:3000
    • http://localhost:3000/
    • http://localhost:3000/assets/public/favicon_js.ico
    • http://localhost:3000/ftp/acquisitions.md
    • http://localhost:3000/main.js
    • ..
  • User Agent Fuzzer [10104] total: 24:
    • http://localhost:3000/assets
    • http://localhost:3000/assets
    • http://localhost:3000/assets
    • http://localhost:3000/assets
    • http://localhost:3000/assets
    • ..

View the following link to download the report. RunnerID:11991656909

---

ZAP by Checkmarx

[github-actions[bot]]

• Site: http://localhost:3000 Ignored Alerts
  • Content Security Policy (CSP) Header Not Set [10038] total: 11:
  • Cross-Domain Misconfiguration [10098] total: 12:
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 10:
  • Dangerous JS Functions [10110] total: 2:
  • Deprecated Feature Policy Header Set [10063] total: 11:
  • Timestamp Disclosure - Unix [10096] total: 1:
  • Base64 Disclosure [10094] total: 5:
  • Information Disclosure - Suspicious Comments [10027] total: 2:
  • Modern Web Application [10109] total: 11:
  • Non-Storable Content [10049] total: 1:
  • Sec-Fetch-Dest Header is Missing [90005] total: 3:
  • Sec-Fetch-Mode Header is Missing [90005] total: 3:
  • Sec-Fetch-Site Header is Missing [90005] total: 3:
  • Sec-Fetch-User Header is Missing [90005] total: 3:
  • Storable and Cacheable Content [10049] total: 1:
  • Storable but Non-Cacheable Content [10049] total: 9:

View the following link to download the report. RunnerID:11991919032

[github-actions[bot]]

• Site: http://cdnjs.cloudflare.com New Alerts

  • Vulnerable JS Library [10003] total: 1:
    • http://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js

  • Retrieved from Cache [10050] total: 12:

    • http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css
    • http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css
    • http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css
    • http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css
    • http://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
    • ..

    Ignored Alerts

  • Base64 Disclosure [10094] total: 3:
  • Information Disclosure - Suspicious Comments [10027] total: 2:

• Site: http://localhost:3000 New Alerts

  • Open Redirect [10028] total: 1:
    • http://localhost:3000/redirect?to=https://github.com/juice-shop/juice-shop
  • SQL Injection - SQLite [40018] total: 1:
    • http://localhost:3000/rest/products/search?q=%27%28
  • Missing Anti-clickjacking Header [10020] total: 12:
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5E2K&sid=1mWHC8_5OwAJ7c0vAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5E59&sid=1mWHC8_5OwAJ7c0vAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5E61&sid=1mWHC8_5OwAJ7c0vAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5Egc&sid=NV3DKkOvAH8u8gj9AAAC
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5G73&sid=H8aYIIaojO9t40_9AAAE
    • ..
  • Session ID in URL Rewrite [3] total: 12:
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5E2M&sid=1mWHC8_5OwAJ7c0vAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5E5C&sid=1mWHC8_5OwAJ7c0vAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5Egd&sid=NV3DKkOvAH8u8gj9AAAC
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5EkJ&sid=NV3DKkOvAH8u8gj9AAAC
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5G77&sid=H8aYIIaojO9t40_9AAAE
    • ..
  • Private IP Disclosure [2] total: 1:
    • http://localhost:3000/rest/admin/application-configuration
  • X-Content-Type-Options Header Missing [10021] total: 12:
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5Dzn
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5E2M&sid=1mWHC8_5OwAJ7c0vAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5E5C&sid=1mWHC8_5OwAJ7c0vAAAA
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5EcL
    • http://localhost:3000/socket.io/?EIO=4&transport=polling&t=PDS5Egd&sid=NV3DKkOvAH8u8gj9AAAC
    • ..
  • Cookie Slack Detector [90027] total: 101:
    • http://localhost:3000/103.js
    • http://localhost:3000/ae.svg
    • http://localhost:3000/api/Challenges/?name=Score%20Board
    • http://localhost:3000/api/Feedbacks
    • http://localhost:3000/api/Feedbacks/
    • ..
  • Session Management Response Identified [10112] total: 1:
    • http://localhost:3000/rest/continue-code

View the following link to download the report. RunnerID:11992472803

[github-actions[bot]]

• Site: http://cdnjs.cloudflare.com

• Site: http://localhost:3000 Resolved Alerts

  • Open Redirect [10028] total: 1:

View the following link to download the report. RunnerID:11992684442

[github-actions[bot]]

• Site: http://localhost:3000 Resolved Alerts
  • SQL Injection - SQLite [40018] total: 1:
  • Missing Anti-clickjacking Header [10020] total: 12:
  • Session ID in URL Rewrite [3] total: 12:
  • Private IP Disclosure [2] total: 1:
  • X-Content-Type-Options Header Missing [10021] total: 12:
  • Cookie Slack Detector [90027] total: 26:
  • Session Management Response Identified [10112] total: 2:

View the following link to download the report. RunnerID:11992999211