-
-
Notifications
You must be signed in to change notification settings - Fork 240
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #446 from ricekot/passive-scripts-metadata
Implement `getMetadata` for some Passive scripts
- Loading branch information
Showing
8 changed files
with
154 additions
and
171 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,37 +1,32 @@ | ||
| // Cookie HttpOnly Check by freakyclown@gmail.com | ||
|
|
||
| function scan(ps, msg, src) { | ||
| var alertRisk = 1; | ||
| var alertConfidence = 2; | ||
| var alertTitle = "Cookie set without HTTPOnly Flag(script)"; | ||
| var alertDesc = | ||
| "A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible."; | ||
| var alertSolution = "Ensure that the HttpOnly flag is set for all cookies."; | ||
| var ScanRuleMetadata = Java.type( | ||
| "org.zaproxy.addon.commonlib.scanrules.ScanRuleMetadata" | ||
| ); | ||
|
|
||
| var cweId = 0; | ||
| var wascId = 13; | ||
|
|
||
| var url = msg.getRequestHeader().getURI().toString(); | ||
| var headers = msg.getResponseHeader().getHeaders("Set-Cookie"); | ||
| function getMetadata() { | ||
| return ScanRuleMetadata.fromYaml(` | ||
| id: 100003 | ||
| name: Cookie Set Without HttpOnly Flag | ||
| description: > | ||
| A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. | ||
| If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. | ||
| If this is a session cookie then session hijacking may be possible. | ||
| solution: Ensure that the HttpOnly flag is set for all cookies. | ||
| risk: low | ||
| confidence: medium | ||
| cweId: 0 | ||
| wascId: 13 # WASC-13: Information Leakage | ||
| status: alpha | ||
| `); | ||
| } | ||
|
|
||
| if (headers != null) { | ||
| function scan(helper, msg, src) { | ||
| var cookies = msg.getResponseHeader().getHeaders("Set-Cookie"); | ||
| if (cookies != null) { | ||
| var re_noflag = /([Hh][Tt][Tt][Pp][Oo][Nn][Ll][Yy])/g; | ||
| if (!re_noflag.test(headers)) { | ||
| ps.raiseAlert( | ||
| alertRisk, | ||
| alertConfidence, | ||
| alertTitle, | ||
| alertDesc, | ||
| url, | ||
| "", | ||
| "", | ||
| "", | ||
| alertSolution, | ||
| headers, | ||
| cweId, | ||
| wascId, | ||
| msg | ||
| ); | ||
| if (!re_noflag.test(cookies)) { | ||
| helper.newAlert().setMessage(msg).setEvidence(cookies).raise(); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,30 @@ | ||
| // Clacks Header Check by freakyclown@gmail.com | ||
|
|
||
| function scan(ps, msg, src) { | ||
| var alertRisk = 0; | ||
| var alertConfidence = 3; | ||
| var alertTitle = "Server is running on CLACKS - GNU Terry Pratchett"; | ||
| var alertDesc = | ||
| "The web/application server is running over the CLACKS network, some say its turtles/IP, some says its turtles all the way down the layer stack."; | ||
| var alertSolution = | ||
| "Give the sys admin a high five and rejoice in the disc world."; | ||
| var ScanRuleMetadata = Java.type( | ||
| "org.zaproxy.addon.commonlib.scanrules.ScanRuleMetadata" | ||
| ); | ||
|
|
||
| var cweId = 200; | ||
| var wascId = 13; | ||
| function getMetadata() { | ||
| return ScanRuleMetadata.fromYaml(` | ||
| id: 100002 | ||
| name: Server is running on Clacks - GNU Terry Pratchett | ||
| description: > | ||
| The web/application server is running over the Clacks network, some say it's turtles/IP, | ||
| some say it's turtles all the way down the layer stack. | ||
| solution: Give the sysadmin a high five and rejoice in the disc world. | ||
| references: | ||
| - https://xclacksoverhead.org/home/about | ||
| risk: info | ||
| confidence: high | ||
| cweId: 200 # CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | ||
| wascId: 13 # WASC-13: Information Leakage | ||
| status: alpha | ||
| `); | ||
| } | ||
|
|
||
| var url = msg.getRequestHeader().getURI().toString(); | ||
| function scan(helper, msg, src) { | ||
| var headers = msg.getResponseHeader().getHeaders("X-Clacks-Overhead"); | ||
|
|
||
| if (headers != null) { | ||
| ps.raiseAlert( | ||
| alertRisk, | ||
| alertConfidence, | ||
| alertTitle, | ||
| alertDesc, | ||
| url, | ||
| "", | ||
| "", | ||
| "", | ||
| alertSolution, | ||
| headers, | ||
| cweId, | ||
| wascId, | ||
| msg | ||
| ); | ||
| helper.newAlert().setMessage(msg).setEvidence(headers).raise(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.