Skip to content

Commit 548b272

Browse files
psiinonpsiinon
authored
Merge pull request #3126 from zapbot/update-data
Update data
2 parents be079dd + e5a4904 commit 548b272

File tree

88 files changed

+1281
-723
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

88 files changed

+1281
-723
lines changed

‎site/content/docs/desktop/addons/active-scan-rules-alpha/_index.md‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,49 +6,57 @@ weight: 1
66
cascade:
77
addon:
88
id: ascanrulesAlpha
9-
version: 48.0.0
9+
version: 49.0.0
1010
---
1111

1212
# Active Scan Rules - Alpha
1313

1414
The following alpha status active scan rules are included in this add-on:
1515

16-
## An example active scan rule which loads data from a file
16+
## An example active scan rule which loads data from a file {#id-60101}
1717

1818
This implements an example active scan rule that loads strings from a file that the user can edit.
1919
For more details see: [Hacking ZAP Part 4: Active Scan Rules](/blog/2014-04-30-hacking-zap-4-active-scan-rules/).
2020

21+
2122
Latest code: [ExampleFileActiveScanRule.java](https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/ExampleFileActiveScanRule.java)
2223

23-
## Example Active Scan Rule: Denial of Service
24+
## Example Active Scan Rule: Denial of Service {#id-60100}
2425

2526
This implements a very simple example active scan rule.
2627
For more details see: [Hacking ZAP Part 4: Active Scan Rules](/blog/2014-04-30-hacking-zap-4-active-scan-rules/).
2728

29+
2830
Latest code: [ExampleSimpleActiveScanRule.java](https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/ExampleSimpleActiveScanRule.java)
2931

3032
## LDAP Injection {#id-40015}
3133

3234
LDAP Injection may be possible. It may be possible for an attacker to bypass authentication controls, and to view and modify arbitrary data in the LDAP directory. Skips messages which originally resulted in a client or server error response status code.
3335

36+
3437
Latest code: [LdapInjectionScanRule.java](https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/LdapInjectionScanRule.java)
3538

39+
3640
Alert ID: [40015](/docs/alerts/40015/).
3741

3842
## NoSQL Injection - MongoDB {#id-40033}
3943

4044
This rule attempts to identify MongoDB specific NoSQL Injection vulnerabilities. It attempts various types of attacks including: boolean based, error based, time based, and authentication bypass. It does not include time based attacks. It will also attempt JSON parameter specific payloads if the scan is configured to include JSON parameter variants.
4145

46+
4247
Latest code: [MongoDbInjectionScanRule.java](https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/MongoDbInjectionScanRule.java)
4348

49+
4450
Alert ID: [40033](/docs/alerts/40033/).
4551

4652
## NoSQL Injection - MongoDB (Time Based) {#id-90039}
4753

4854
This rule attempts to identify MongoDB specific NoSQL Injection vulnerabilities using only time based attacks.
4955

56+
5057
Latest code: [MongoDbInjectionTimingScanRule.java](https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/MongoDbInjectionTimingScanRule.java)
5158

59+
5260
Alert ID: [90039](/docs/alerts/90039/).
5361

5462
## Web Cache Deception {#id-40039}

‎site/content/docs/desktop/addons/active-scan-rules-beta/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ weight: 1
66
cascade:
77
addon:
88
id: ascanrulesBeta
9-
version: 58.0.0
9+
version: 59.0.0
1010
---
1111

1212
# Active Scan Rules - Beta

‎site/content/docs/desktop/addons/active-scan-rules/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ weight: 1
66
cascade:
77
addon:
88
id: ascanrules
9-
version: 71.0.0
9+
version: 72.0.0
1010
---
1111

1212
# Active Scan Rules

‎site/content/docs/desktop/addons/ajax-spider/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ weight: 1
66
cascade:
77
addon:
88
id: spiderAjax
9-
version: 23.23.0
9+
version: 23.24.0
1010
---
1111

1212
# AJAX Spider

‎site/content/docs/desktop/addons/ajax-spider/automation.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ This job supports monitor tests.
3737
maxCrawlStates: # Int: The maximum number of crawl states the crawler should crawl, default: 0 unlimited
3838
randomInputs: # Bool: When enabled random values will be entered into input element, default: true
3939
reloadWait: # Int: The time in milliseconds to wait after the URL is loaded, default: 1000
40+
scopeCheck: # String: The scope check, either Flexible or Strict, default: Strict
4041
elements: # A list of HTML elements to click - will be ignored unless clickDefaultElems is false
4142
- "a"
4243
- "button"

‎site/content/docs/desktop/addons/ajax-spider/options.md‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,21 +12,23 @@ This screen allows you to configure the [AJAX Spider](/docs/desktop/addons/ajax-
1212
## Configuration Options
1313

1414

15-
| Field | Details | Default |
16-
|-----------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
17-
| Browser | AJAX Spider relies on an external browser to crawl the targeted site. You can specify which one you want to use. For more details on supported browsers refer to "Selenium" add-on help pages. | Firefox Headless |
18-
| Number of Browser Windows to Open | You can configure the number of windows to be used by AJAX Spider. The more windows, the faster the process will be. | Num cores |
19-
| Maximum Crawl Depth | The maximum depth that the crawler can reach. Zero means unlimited depth. | 10 |
20-
| Maximum Crawl States | The maximum number of states that the crawler should crawl. Zero means unlimited crawl states. | 0 (unlimited) |
21-
| Maximum Duration | The maximum time that the crawler is allowed to run. Zero means unlimited running time. | 60 minutes |
22-
| Event Wait Time | The time to wait after a client side event is fired. | 1000 ms |
23-
| Reload Wait Time | The time to wait after URL is loaded. | 1000 ms |
24-
| Enable Browser Extensions | When enabled, any browser extensions added by other add-ons will be enabled in the browsers used for crawling. | False |
25-
| Click Elements Once | When enabled, the crawler attempts to interact with each element (e.g., by clicking) only once. If this is not set, the crawler will attempt to click multiple times. Unsetting this option is more rigorous but may take considerably more time. | True |
26-
| Use Random Values in Form Fields | When enabled, inserts random values into form fields. Otherwise, it uses empty values. | True |
27-
| Click Default Elements Only | When enabled, only elements "a", "button" and "input" will be clicked during crawl. Otherwise, it uses the table below to determine which elements will be clicked. For more in depth analysis, disable this and configure the clickable elements in the table. | True |
28-
| Select elements to click during crawl (table) | The list of elements to crawl. This table only applies when "click default elements only" is not enabled. Use "enable all" for a more in depth analysis, though it may take somewhat longer. | All enabled |
29-
| Allowed Resources (table) | The list of allowed resources. The allowed resources are always fetched even if out of scope, allowing to include necessary resources (e.g. scripts) from 3rd-parties. | |
15+
| Field | Details | Default |
16+
|-----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|
17+
| Browser | AJAX Spider relies on an external browser to crawl the targeted site. You can specify which one you want to use. For more details on supported browsers refer to "Selenium" add-on help pages. | Firefox Headless |
18+
| Number of Browser Windows to Open | You can configure the number of windows to be used by AJAX Spider. The more windows, the faster the process will be. | Num cores |
19+
| Maximum Crawl Depth | The maximum depth that the crawler can reach. Zero means unlimited depth. | 10 |
20+
| Maximum Crawl States | The maximum number of states that the crawler should crawl. Zero means unlimited crawl states. | 0 (unlimited) |
21+
| Maximum Duration | The maximum time that the crawler is allowed to run. Zero means unlimited running time. | 60 minutes |
22+
| Event Wait Time | The time to wait after a client side event is fired. | 1000 ms |
23+
| Reload Wait Time | The time to wait after URL is loaded. | 1000 ms |
24+
| Enable Browser Extensions | When enabled, any browser extensions added by other add-ons will be enabled in the browsers used for crawling. | False |
25+
| Click Elements Once | When enabled, the crawler attempts to interact with each element (e.g., by clicking) only once. If this is not set, the crawler will attempt to click multiple times. Unsetting this option is more rigorous but may take considerably more time. | True |
26+
| Use Random Values in Form Fields | When enabled, inserts random values into form fields. Otherwise, it uses empty values. | True |
27+
| Click Default Elements Only | When enabled, only elements "a", "button" and "input" will be clicked during crawl. Otherwise, it uses the table below to determine which elements will be clicked. For more in depth analysis, disable this and configure the clickable elements in the table. | True |
28+
| Select elements to click during crawl (table) | The list of elements to crawl. This table only applies when "click default elements only" is not enabled. Use "enable all" for a more in depth analysis, though it may take somewhat longer. | All enabled |
29+
| Scope Check | How the scope is checked: * `Strict` - enforces that all requests need to be in scope to be accessed, with the exception of the Allowed Resources. * `Flexible` - allows all requests to be accessed. This scope check does not use nor require configuring the Allowed Resources for targets that need domains out of scope to work. This scope check has the side effect of allowing out of scope domains to be accessed, but not crawled. | Strict |
30+
| Logout Avoidance | When enabled, the spider will avoid clicking common logout elements, which does not require manually excluding them. | False |
31+
| Allowed Resources (table) | The list of allowed resources. The allowed resources are always fetched even if out of scope, allowing to include necessary resources (e.g. scripts) from 3rd-parties. | |
3032

3133
## See also
3234

‎site/content/docs/desktop/addons/ajax-spider/scandialog.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,10 @@ The time to wait after a client side event is fired.
7575

7676
The time to wait after URL is loaded.
7777

78+
### Scope Check
79+
80+
How the scope is checked, for more information refer to the Options AJAX Spider screen.
81+
7882
### Allowed Resources
7983

8084
The list of allowed resources. The allowed resources are always fetched even if out of scope, allowing to include necessary resources (e.g. scripts) from 3rd-parties.

‎site/content/docs/desktop/addons/alert-filters/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ weight: 1
66
cascade:
77
addon:
88
id: alertFilters
9-
version: 23.0.0
9+
version: 24.0.0
1010
---
1111

1212
# Alert Filters

‎site/content/docs/desktop/addons/authentication-helper/_index.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,20 @@ weight: 1
66
cascade:
77
addon:
88
id: authhelper
9-
version: 0.25.0
9+
version: 0.26.0
1010
---
1111

1212
# Authentication Helper
1313

1414
This add-on helps identify and set up authentication handling in ZAP.
1515

1616

17-
The add-on can be used in 2 ways:
17+
The add-on can be used in various ways:
1818

1919
* To passively detect authentication features.
20+
* To support newer browser based authentication mechanisms.
2021
* To automatically configure ZAP to handle the authentication features discovered.
22+
* To generate a detailed authentication report.
2123

2224
The features currently supported are:
2325

@@ -31,6 +33,7 @@ The features currently supported are:
3133
* [Auto-Detect Session Management](/docs/desktop/addons/authentication-helper/autodetect-session/)
3234
* [Header Based Session Management](/docs/desktop/addons/authentication-helper/session-header/)
3335
* [Verification Identification](/docs/desktop/addons/authentication-helper/verification-id/)
36+
* [Authentication Report (JSON)](/docs/desktop/addons/authentication-helper/auth-report-json/)
3437

3538

3639
This add-on does not currently perform any exploring on its own - it relies upon requests being proxied through ZAP

‎site/content/docs/desktop/addons/authentication-helper/auth-report-json.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ The following failure detail items are used:
6060
| auth.failure.login_failures | One or more failed logins. |
6161
| auth.failure.no_successful_logins | No successful browser logins. |
6262
| auth.failure.verif_ident | Failed to identify verification URL. |
63+
| auth.failure.af_plan_errors | There were Automation Framework plan errors. |
6364

6465
### Automation Framework Environment
6566

0 commit comments

Comments
 (0)