search

secureCodeBox / scanner-webapplication-zap

Part of the deprecated secureCodeBox v1, see secureCodeBox/secureCodeBox Repo for v2
Apache License 2.0
5 stars 4 forks source link

Further ZAP Scan improvments #8

Closed J12934 closed 6 years ago

J12934 commented 6 years ago

This PR does two things:

  1. Dramatically reduced verbosity of log statements. The target (which can be multiple thousands of lines long) was getting logged multiple times during a scan. This made it nearly impossible to gather useful information from the logs.
  2. Removed last use of request proxying. This isn't required anymore and caused some errors when trying to scan some https enabled targets.
  3. Zap previously tried to submit full stack traces as incident to the engine. These were often not accepted by the input validations rules. These were replaced by unfortunately more general message, which will not interfere with the validation. For more Information the zap scanner log have to be checked.