ZAP 被动扫描规则是扫描的一部分,即使在禁用它们之后也是如此
Posted
技术标签:
【中文标题】ZAP 被动扫描规则是扫描的一部分,即使在禁用它们之后也是如此【英文标题】:ZAP Passive scan rules are part of scan even after disabing them 【发布时间】:2021-09-01 23:03:24 【问题描述】:我正在使用 ZAP docker 映像来执行 API 扫描。我在 zap_started hook python 脚本中禁用了一些被动扫描规则。尽管如此,这些都被列为最终报告的一部分。
禁用被动扫描规则的脚本:
pscan_id_list = [10003, 10015, 10017, 10020, 10021, 10028, 10029, 10031, 10032, 10039, 10040, 10041, 10041, 10043, 10052, 10050, 10056, 10061, 10108, 10109, 90001, 90026, 90029, 90030]
for pscan_id in pscan_id_list:
zap.pscan.set_scanner_alert_threshold(id=pscan_id, alertthreshold='OFF')
日志确认规则被禁用:
2021-06-17 06:44:10,269 Starting new HTTP connection (1): localhost:51008
2021-06-17 06:44:10,281 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10003&alertThreshold=OFF&apikey= HTTP/1.1" 200 15
2021-06-17 06:44:10,288 Starting new HTTP connection (1): localhost:51008
2021-06-17 06:44:10,298 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10015&alertThreshold=OFF&apikey= HTTP/1.1" 200 15
2021-06-17 06:44:10,304 Starting new HTTP connection (1): localhost:51008
2021-06-17 06:44:10,313 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10017&alertThreshold=OFF&apikey= HTTP/1.1" 200 15
2021-06-17 06:44:10,320 Starting new HTTP connection (1): localhost:51008
2021-06-17 06:44:10,327 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10020&alertThreshold=OFF&apikey= HTTP/1.1" 200 15
2021-06-17 06:44:10,333 Starting new HTTP connection (1): localhost:51008
2021-06-17 06:44:10,343 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10021&alertThreshold=OFF&apikey= HTTP/1.1" 200 15
2021-06-17 06:44:10,350 Starting new HTTP connection (1): localhost:51008
2021-06-17 06:44:10,361 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10028&alertThreshold=OFF&apikey= HTTP/1.1" 200 15
被动扫描规则仍列在最终报告中:
PASS: Vulnerable JS Library [10003]
PASS: Cookie No HttpOnly Flag [10010]
PASS: Cookie Without Secure Flag [10011]
PASS: Incomplete or No Cache-control and Pragma HTTP Header Set [10015]
PASS: Cross-Domain javascript Source File Inclusion [10017]
PASS: Content-Type Header Missing [10019]
PASS: X-Frame-Options Header [10020]
PASS: X-Content-Type-Options Header Missing [10021]
PASS: Information Disclosure - Sensitive Information in URL [10024]
PASS: Information Disclosure - Sensitive Information in HTTP Referrer Header [10025]
PASS: HTTP Parameter Override [10026]
PASS: Information Disclosure - Suspicious Comments [10027]
PASS: Open Redirect [10028]
PASS: Cookie Poisoning [10029]
PASS: User Controllable Charset [10030]
PASS: User Controllable html Element Attribute (Potential XSS) [10031]
【问题讨论】:
【参考方案1】:按照https://www.zaproxy.org/docs/api/#pscanactionsetscanneralertthreshold尝试使用alertThreshold='OFF'
(大写T)
【讨论】:
感谢您的回复。脚本使用大写 T 失败:zap.pscan.set_scanner_alert_threshold(id=pscan_id, alertThreshold='OFF') TypeError: set_scanner_alert_threshold() got an unexpected keyword argument 'alertThreshold' 呃,这个想法就这么多:(我会尝试重新创建这个......以上是关于ZAP 被动扫描规则是扫描的一部分,即使在禁用它们之后也是如此的主要内容,如果未能解决你的问题,请参考以下文章