ZAP Full Scan Report

[github-actions]

• Site: http://www.zaproxy.org
  New Alerts

  • HTTPS Content Available via HTTP [10047] total: 6:
    • https://www.zaproxy.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    • https://www.zaproxy.org/cdn-cgi/styles/cf.errors.css
    • https://www.zaproxy.org/cdn-cgi/scripts/zepto.min.js
    • https://www.zaproxy.org/cdn-cgi/scripts/cf.common.js
    • https://www.zaproxy.org/cdn-cgi/styles/cf.errors.ie.css
    • ..

• Site: https://www.zaproxy.org
  New Alerts

  • Strict-Transport-Security Header Not Set [10035] total: 20:
    • https://www.zaproxy.org/blog/2016-02-19-zap-newsletter-2016-february/images/image05.png
    • https://www.zaproxy.org/docs/desktop/addons/hud/index.xml
    • https://www.zaproxy.org/img/faq/installedAddonVersion.png
    • https://www.zaproxy.org/docs/desktop/images/10/137.png
    • https://www.zaproxy.org/docs/desktop/images/16/142.png
    • ..
  • Cross-Domain Misconfiguration [10098] total: 20:
    • https://www.zaproxy.org/img/faq/supportAddonVersion.png
    • https://www.zaproxy.org/blog/2020-03-04-dark-mode-in-the-weekly-release/images/zap-dark-desktop.png
    • https://www.zaproxy.org/getting-started/images/alert-icons.png
    • https://www.zaproxy.org/blog/2016-02-19-zap-newsletter-2016-february/images/Contexts1.png
    • https://www.zaproxy.org/blog/2015-12-15-zap-newsletter-2015-december/images/custom-http-breakpoint.png
    • ..
  • Cookie Slack Detector [90027] total: 20:
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/session/context-struct/
    • https://www.zaproxy.org/docs/desktop/addons/birt-reports/
    • https://www.zaproxy.org/docs/desktop/addons/token-generator
    • https://www.zaproxy.org/docs/desktop/addons/index.xml
    • https://www.zaproxy.org/blog/2016-02-19-zap-newsletter-2016-february/images/image02.png
    • ..
  • Proxy Disclosure [40025] total: 20:
    • https://www.zaproxy.org/docs/desktop/addons/ruby-scripting/
    • https://www.zaproxy.org/faq/why-is-an-api-key-required-by-default/
    • https://www.zaproxy.org/docs/desktop/addons/server-sent-events
    • https://www.zaproxy.org/blog
    • https://www.zaproxy.org/docs/desktop/start/features/alerts/
    • ..
  • Retrieved from Cache [10050] total: 20:
    • https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules-alpha/index.xml
    • https://www.zaproxy.org/docs/desktop/addons/ajax-spider/tab/
    • https://www.zaproxy.org/support/
    • https://www.zaproxy.org/docs/desktop/addons/plug-n-hack/clientstab/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/options/callback/
    • ..
  • Apache Range Header DoS (CVE-2011-3192) [10053] total: 20:
    • https://www.zaproxy.org/blog/2016-01-04-zap-newsletter-2016-january/images/shodan2.png
    • https://www.zaproxy.org/blog/2020-04-09-automate-security-testing-with-zap-and-github-actions/images/scan-job.png
    • https://www.zaproxy.org/img/authors/simon-bennetts_400x400.jpg
    • https://www.zaproxy.org/getting-started/images/zap-qstart-manualexplore.png
    • https://www.zaproxy.org/getting-started/images/hud-welcome.png
    • ..
  • User Agent Fuzzer [10104] total: 20:
    • https://www.zaproxy.org/blog/2016-02-19-zap-newsletter-2016-february/images/Contexts-users.png
    • https://www.zaproxy.org/docs/desktop/addons/access-control-testing/index.xml
    • https://www.zaproxy.org/blog/2020-03-09-zap-ssrf-setup/
    • https://www.zaproxy.org/docs/desktop/addons/dom-xss-active-scan-rule/index.xml
    • https://www.zaproxy.org/docs/desktop/addons/diff/index.xml
    • ..
  • Cross-Domain JavaScript Source File Inclusion [10017] total: 20:
    • https://www.zaproxy.org/docs/desktop/addons/openapi-support/
    • https://www.zaproxy.org/blog/2020-04-09-automate-security-testing-with-zap-and-github-actions/
    • https://www.zaproxy.org/docs/desktop/addons/save-xml-message/
    • https://www.zaproxy.org/docs/desktop/start/features/notes/
    • https://www.zaproxy.org/docs/desktop/start/features/modes/
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 20:
    • https://www.zaproxy.org/docs/desktop/addons/browser-view/index.xml
    • https://www.zaproxy.org/docs/desktop/images/16/152.png
    • https://www.zaproxy.org/docs/desktop/images/fugue/application-blue-export.png
    • https://www.zaproxy.org/blog/2016-11-22-announcing-the-official-zap-jenkins-plugin/images/ZAP_CI_SMALLER.png
    • https://www.zaproxy.org/docs/desktop/addons/call-graph/index.xml
    • ..
  • Timestamp Disclosure - Unix [10096] total: 20:
    • https://www.zaproxy.org/blog/2014-03-10-hacking-zap-1-why-should-you/
    • https://www.zaproxy.org/docs/desktop/releases/2.3.0/
    • https://www.zaproxy.org/docs/desktop/addons/import-urls/
    • https://www.zaproxy.org/pdf/ZAPGettingStartedGuide-2.9.pdf
    • https://www.zaproxy.org/docs/desktop/addons/forced-browse/options/
    • ..
  • Content Security Policy (CSP) Header Not Set [10038] total: 20:
    • https://www.zaproxy.org/docs/desktop/start/features/alerts/
    • https://www.zaproxy.org/docs/desktop/addons/vulncheck/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/addalert/
    • https://www.zaproxy.org/docs/desktop/addons/log-file-importer/
    • https://www.zaproxy.org/docs/desktop/ui/tabs/response/
    • ..
  • Incomplete or No Cache-control and Pragma HTTP Header Set [10015] total: 20:
    • https://www.zaproxy.org/docs/desktop/start/features/users/
    • https://www.zaproxy.org/docs/desktop/addons/community-scripts/index.xml
    • https://www.zaproxy.org/docs/desktop/releases/1.3.1/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/options/breakpoints/
    • https://www.zaproxy.org/docs/desktop/addons/ajax-spider/index.xml
    • ..
  • Backup File Disclosure [10095] total: 20:
    • https://www.zaproxy.org/docs/desktop/addons/websockets/images/054.~bk
    • [https://www.zaproxy.org/docs/desktop/addons/openapi-support - Copy (3)/index.xml](https://www.zaproxy.org/docs/desktop/addons/openapi-support - Copy (3)/index.xml)
    • https://www.zaproxy.org/docs/desktop/addons/websockets/images/054.old
    • [https://www.zaproxy.org/docs/desktop/addons/websockets/images/Copy of 054.png](https://www.zaproxy.org/docs/desktop/addons/websockets/images/Copy of 054.png)
    • [https://www.zaproxy.org/blog/2016-02-19-zap-newsletter-2016-february/images/image03 - Copy.png](https://www.zaproxy.org/blog/2016-02-19-zap-newsletter-2016-february/images/image03 - Copy.png)
    • ..
  • Trace.axd Information Leak [40029] total: 1:
    • https://www.zaproxy.org/cdn-cgi/trace.axd
  • Application Error Disclosure [90022] total: 3:
    • https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/
    • https://www.zaproxy.org/docs/desktop/releases/2.7.0/
    • https://www.zaproxy.org/docs/desktop/addons/websockets/pscanrules/
  • Information Disclosure - Debug Error Messages [10023] total: 2:
    • https://www.zaproxy.org/docs/desktop/addons/websockets/pscanrules/
    • https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/
  • Directory Browsing [0] total: 1:
    • https://www.zaproxy.org/docs/desktop/addons/active-scan-rules/
  • Cookie Without Secure Flag [10011] total: 2:
    • https://www.zaproxy.org/robots.txt
    • https://www.zaproxy.org/
  • Information Disclosure - Suspicious Comments [10027] total: 4:
    • https://www.zaproxy.org/faq/
    • https://www.zaproxy.org/cdn-cgi/scripts/zepto.min.js
    • https://www.zaproxy.org/cdn-cgi/scripts/cf.common.js
    • https://www.zaproxy.org/main.7d9e3.js
  • PII Scanner [10062] total: 1:
    • https://www.zaproxy.org/docs/desktop/addons/websockets/pscanrules/
  • Private IP Disclosure [2] total: 4:
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/options/localproxy/
    • https://www.zaproxy.org/docs/docker/about/
    • https://www.zaproxy.org/docs/desktop/addons/websockets/pscanrules/
    • https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/
  • Loosely Scoped Cookie [90033] total: 3:
    • https://www.zaproxy.org/robots.txt
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/
  • Reverse Tabnabbing [10108] total: 1:
    • https://www.zaproxy.org/cdn-cgi/l/email-protection

View the following link to download the report.
RunnerID:91223515

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Trace.axd Information Leak [40029] total: 1:

View the following link to download the report.
RunnerID:94152167

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Trace.axd Information Leak [40029] total: 1:
    • https://www.zaproxy.org/cdn-cgi/trace.axd

View the following link to download the report.
RunnerID:100282309

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Modern Web Application [10109] total: 3:
    • https://www.zaproxy.org/docs/api/
    • https://www.zaproxy.org/evangelists/
    • https://www.zaproxy.org/download/

View the following link to download the report.
RunnerID:127280894

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Backup File Disclosure [10095] total: 20:

View the following link to download the report.
RunnerID:157896317

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Backup File Disclosure [10095] total: 20:
    • https://www.zaproxy.org/docs/desktop/images/16backup/105.png
    • https://www.zaproxy.org/docs/desktop/images/16/Copy%20of%20105r.png
    • https://www.zaproxy.org/docs/desktop/images/16/105r.png.zip
    • https://www.zaproxy.org/docs/desktop/addons/revisit/index%20-%20Copy%20(3).xml
    • https://www.zaproxy.org/blog/2016-02-19-zap-newsletter-2016-february/imagesbackup/Contexts-flag-auth.png
    • ..

View the following link to download the report.
RunnerID:166020896

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Backup File Disclosure [10095] total: 20:

View the following link to download the report.
RunnerID:182714416

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Reverse Tabnabbing [10108] total: 1:

View the following link to download the report.
RunnerID:326654272

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Absence of Anti-CSRF Tokens [10202] total: 20:
    • https://www.zaproxy.org/docs/alerts/10097/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/managetags/
    • https://www.zaproxy.org/blog/2017-04-03-exploring-apis-with-zap/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/options/dynsslcert/
    • https://www.zaproxy.org/docs/alerts/10107/
    • ..
  • Anti-CSRF Tokens Check [20012] total: 20:
    • https://www.zaproxy.org/docs/desktop/addons/save-xml-message/
    • https://www.zaproxy.org/blog/2015-05-27-zap-as-a-service-zaas/
    • https://www.zaproxy.org/blog/2020-04-09-automate-security-testing-with-zap-and-github-actions/
    • https://www.zaproxy.org/docs/alerts/40017/N/A
    • https://www.zaproxy.org/docs/desktop/credits/
    • ..

View the following link to download the report.
RunnerID:351686078

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 20:

View the following link to download the report.
RunnerID:376704405

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Anti-CSRF Tokens Check [20012] total: 20:
    • https://www.zaproxy.org/docs/desktop/addons/save-xml-message/
    • https://www.zaproxy.org/blog/2015-05-27-zap-as-a-service-zaas/
    • https://www.zaproxy.org/blog/2020-04-09-automate-security-testing-with-zap-and-github-actions/
    • https://www.zaproxy.org/docs/alerts/40017/N/A
    • https://www.zaproxy.org/docs/desktop/credits/
    • ..

View the following link to download the report.
RunnerID:389273337

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Content-Type Header Missing [10019] total: 2:
    • https://www.zaproxy.org/docs/desktop/addons/graphql-support/index.xml
    • https://www.zaproxy.org/blog/2020-08-28-introducing-the-graphql-add-on-for-zap/

View the following link to download the report.
RunnerID:433181999

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 20:

View the following link to download the report.
RunnerID:506617337

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Anti-CSRF Tokens Check [20012] total: 20:
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/scanpolicymgr/
    • https://www.zaproxy.org/docs/desktop/start/features/custompages/
    • https://www.zaproxy.org/blog/2017-04-03-exploring-apis-with-zap/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/options/dynsslcert/
    • https://www.zaproxy.org/student-hall-of-fame/
    • ..

View the following link to download the report.
RunnerID:524345173

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 4:
    • https://www.zaproxy.org/search/?q=ZAP
    • https://www.zaproxy.org/search/?q=ZAP
    • https://www.zaproxy.org/search/?q=ZAP
    • https://www.zaproxy.org/search/?q=ZAP

View the following link to download the report.
RunnerID:544224951

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 20:

View the following link to download the report.
RunnerID:564839166

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Anti-CSRF Tokens Check [20012] total: 20:
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/scanpolicymgr/
    • https://www.zaproxy.org/docs/desktop/start/features/custompages/
    • https://www.zaproxy.org/blog/2017-04-03-exploring-apis-with-zap/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/options/dynsslcert/
    • https://www.zaproxy.org/student-hall-of-fame/
    • ..

View the following link to download the report.
RunnerID:585348040

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 4:

View the following link to download the report.
RunnerID:650237922

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Cookie Slack Detector [90027] total: 20:
  • Loosely Scoped Cookie [90033] total: 5:
  • Cookie Without Secure Flag [10011] total: 4:

View the following link to download the report.
RunnerID:846038787

[github-actions]

• Site: https://www.zaproxy.org
  Resolved Alerts
  • User Agent Fuzzer [10104] total: 20:
  • Proxy Disclosure [40025] total: 20:
  • Anti-CSRF Tokens Check [20012] total: 20:
  • Apache Range Header DoS (CVE-2011-3192) [10053] total: 20:
  • Trace.axd Information Leak [40029] total: 1:

View the following link to download the report.
RunnerID:953496523

[github-actions]

• Site: http://www.zaproxy.org
  New Alerts

  • HTTPS Content Available via HTTP [10047] total: 4:
    • https://www.zaproxy.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    • https://www.zaproxy.org/cdn-cgi/styles/cf.errors.ie.css
    • https://www.zaproxy.org/cdn-cgi/l/email-protection
    • https://www.zaproxy.org/cdn-cgi/styles/cf.errors.css

• Site: https://www.zaproxy.org
  New Alerts

  • User Agent Fuzzer [10104] total: 20:
    • https://www.zaproxy.org/docs/alerts/10019
    • https://www.zaproxy.org/blog/2012-12-10-zap-2-0-0-and-the-google-summer-of-code-2012-projects/images
    • https://www.zaproxy.org/blog/2017-04-03-exploring-apis-with-zap/images
    • https://www.zaproxy.org/docs/desktop/addons/python-scripting/index.xml
    • https://www.zaproxy.org/docs/desktop/addons/report-alert-generator/
    • ..
  • Proxy Disclosure [40025] total: 20:
    • https://www.zaproxy.org/docs/alerts/40028
    • https://www.zaproxy.org/docs/desktop/addons/openapi-support/
    • https://www.zaproxy.org/blog/2020-04-09-automate-security-testing-with-zap-and-github-actions/images/scan-job.png
    • https://www.zaproxy.org/docs/alerts/40017/N
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/options/pscanner
    • ..
  • Anti-CSRF Tokens Check [20012] total: 20:
    • https://www.zaproxy.org/docs/desktop/addons/soap-support/automation/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/scanpolicymgr/
    • https://www.zaproxy.org/docs/desktop/start/features/custompages/
    • https://www.zaproxy.org/blog/2017-04-03-exploring-apis-with-zap/
    • https://www.zaproxy.org/docs/desktop/ui/dialogs/options/dynsslcert/
    • ..
  • Apache Range Header DoS (CVE-2011-3192) [10053] total: 20:
    • https://www.zaproxy.org/blog/2016-02-19-zap-newsletter-2016-february/images/image01.png
    • https://www.zaproxy.org/docs/desktop/images/16/073.png
    • https://www.zaproxy.org/blog/2020-06-04-zap-2-9-0-highlights/images/startup_conflict.gif
    • https://www.zaproxy.org/img/success/motorolasolutions.png
    • https://www.zaproxy.org/docs/desktop/images/16/131.png
    • ..

View the following link to download the report.
RunnerID:975205261

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Hash Disclosure - Mac OSX salted SHA-1 [10097] total: 1:
    • https://www.zaproxy.org/search/index.json

View the following link to download the report.
RunnerID:1202057814

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Apache Range Header DoS (CVE-2011-3192) [10053] total: 20:

View the following link to download the report.
RunnerID:1249698049

[github-actions]

• Site: http://www.zaproxy.org
  Resolved Alerts

  • HTTPS Content Available via HTTP [10047] total: 4:

• Site: https://www.zaproxy.org
  New Alerts

  • HTTPS Content Available via HTTP [10047] total: 4:
    • https://www.zaproxy.org/cdn-cgi/l/email-protection
    • https://www.zaproxy.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    • https://www.zaproxy.org/cdn-cgi/styles/cf.errors.css
    • https://www.zaproxy.org/cdn-cgi/styles/cf.errors.ie.css

View the following link to download the report.
RunnerID:1324729668

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Hash Disclosure - Mac OSX salted SHA-1 [10097] total: 2:

View the following link to download the report.
RunnerID:1430371915

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 8:
    • https://www.zaproxy.org/search/?q=ZAP
    • https://www.zaproxy.org/search/?q=ZAP
    • https://www.zaproxy.org/search/?q=ZAP
    • https://www.zaproxy.org/search/?q=ZAP
    • https://www.zaproxy.org/search/?q=ZAP
    • ..

  Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 667:

View the following link to download the report.
RunnerID:1622969991

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Anti-CSRF Tokens Check [20012] total: 753:
    • https://www.zaproxy.org
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/3rd-party-package-maintenance/
    • https://www.zaproxy.org/addo-auth-workshop/
    • https://www.zaproxy.org/addons/
    • ..

View the following link to download the report.
RunnerID:1644936678

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  Resolved Alerts

  • Anti-CSRF Tokens Check [20012] total: 753:
  • User Controllable HTML Element Attribute (Potential XSS) [10031] total: 8:

View the following link to download the report.
RunnerID:2046330243

[github-actions]

• Site: http://www.zaproxy.org

• Site: https://www.zaproxy.org
  New Alerts

  • Anti-CSRF Tokens Check [20012] total: 800:
    • https://www.zaproxy.org
    • https://www.zaproxy.org/
    • https://www.zaproxy.org/3rd-party-package-maintenance/
    • https://www.zaproxy.org/addo-auth-workshop/
    • https://www.zaproxy.org/addons/
    • ..

View the following link to download the report.
RunnerID:2083848907