Found Java version 1.8.0_242 Available memory: 3950 MB Using JVM args: -Xmx987m 252 [main] INFO org.zaproxy.zap.DaemonBootstrap - OWASP ZAP 2.9.0 started 11/05/20 16:01:56 with home /home/zap/.ZAP/ 287 [main] INFO org.parosproxy.paros.common.AbstractParam - Setting config api.disablekey = true was null 287 [main] INFO org.parosproxy.paros.common.AbstractParam - Setting config api.addrs.addr.name = .* was null 287 [main] INFO org.parosproxy.paros.common.AbstractParam - Setting config api.addrs.addr.regex = true was null 287 [main] INFO org.parosproxy.paros.common.AbstractParam - Setting config database.recoverylog = false was null 294 [main] INFO org.parosproxy.paros.network.SSLConnector - Reading supported SSL/TLS protocols... 294 [main] INFO org.parosproxy.paros.network.SSLConnector - Using a SSLEngine... 374 [main] INFO org.parosproxy.paros.network.SSLConnector - Done reading supported SSL/TLS protocols: [SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2] 383 [main] INFO org.parosproxy.paros.extension.option.OptionsParamCertificate - Unsafe SSL renegotiation disabled. 978 [main] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache open start 987 [main] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache open end 1062 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory - Loading extensions 2441 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory - Installed add-ons: [[id=alertFilters, version=10.0.0], [id=ascanrules, version=34.0.0], [id=bruteforce, version=9.0.0], [id=diff, version=10.0.0], [id=directorylistv1, version=4.0.0], [id=fuzz, version=12.0.0], [id=gettingStarted, version=11.0.0], [id=help, version=10.0.0], [id=hud, version=0.9.0], [id=importurls, version=7.0.0], [id=invoke, version=10.0.0], [id=onlineMenu, version=7.0.0], [id=openapi, version=15.0.0], [id=pscanrules, version=26.0.0], [id=quickstart, version=27.0.0], [id=replacer, version=8.0.0], [id=reveal, version=3.0.0], [id=saverawmessage, version=5.0.0], [id=savexmlmessage, version=0.1.0], [id=scripts, version=26.0.0], [id=selenium, version=15.1.0], [id=spiderAjax, version=23.1.0], [id=tips, version=7.0.0], [id=webdriverlinux, version=16.0.0], [id=websocket, version=21.0.0], [id=zest, version=31.0.0]] 2956 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory - Extensions loaded 3179 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows ZAP to check for updates 3181 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Options Extension 3182 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Edit Menu Extension 3182 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Provides a rest based API for controlling and accessing ZAP 3190 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Session State Extension 3190 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Report Extension 3190 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing History Extension 3192 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Show hidden fields and enable disabled fields 3192 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Search messages for strings and regular expressions 3193 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Encode/Decode/Hash... 3194 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to intercept and modify requests and responses 3195 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Passive scanner 3291 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Script Passive Scan Rules 3297 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Stats Passive Scan Rule 3297 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Application Error Disclosure 3297 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Absence of Anti-CSRF Tokens 3297 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Incomplete or No Cache-control and Pragma HTTP Header Set 3298 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Charset Mismatch 3298 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: CSP Scanner 3298 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Content-Type Header Missing 3298 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie No HttpOnly Flag 3298 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Loosely Scoped Cookie 3298 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie Without SameSite Attribute 3298 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie Without Secure Flag 3299 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cross-Domain Misconfiguration 3299 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cross-Domain JavaScript Source File Inclusion 3299 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Web Browser XSS Protection Not Enabled 3299 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Debug Error Messages 3299 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Sensitive Information in URL 3299 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Sensitive Information in HTTP Referrer Header 3299 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Suspicious Comments 3300 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Weak Authentication Method 3300 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Insecure JSF ViewState 3300 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Secure Pages Include Mixed Content 3300 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Private IP Disclosure 3300 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Session ID in URL Rewrite 3300 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Timestamp Disclosure 3301 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Username Hash Found 3301 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Viewstate Scanner 3301 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-AspNet-Version Response Header Scanner 3301 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Content-Type-Options Header Missing 3301 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Debug-Token Information Leak 3301 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Frame-Options Header Scanner 3301 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) 3333 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to view and manage alerts 3339 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Active scanner, heavily based on the original Paros active scanner, but with additional tests added 3351 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Spider used for automatically finding URIs on a site 3356 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing A set of common popup menus for miscellaneous tasks 3357 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Forced browsing of files and directories using code from the OWASP DirBuster tool 3358 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Manual Request Editor Extension 3358 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Compares 2 sessions and generates an HTML file showing the differences 3358 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Invoke external applications passing context related information such as URLs and parameters 3358 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Handles anti cross site request forgery (CSRF) tokens 3365 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Authentication Extension 3392 [ZAP-daemon] INFO org.zaproxy.zap.extension.authentication.ExtensionAuthentication - Loaded authentication method types: [Form-based Authentication, HTTP/NTLM Authentication, Manual Authentication, Script-based Authentication, JSON-based Authentication] 3394 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Creates a dynamic SSL certificate to allow SSL communications to be intercepted without warnings being generated by the browser 3394 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Logs errors to the Output tab in development mode only 3395 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Users Extension 3397 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Summarise and analyse FORM and URL parameters as well as cookies 3397 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Script integration 3420 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Scripting console, supports all JSR 223 scripting languages 3635 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Forced User Extension 3637 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Extension handling HTTP sessions 3640 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Zest is a specialized scripting language from Mozilla specifically designed to be used in security tools 3906 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionDiff 3906 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Post Table View Extension 3907 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Session Management Extension 3914 [ZAP-daemon] INFO org.zaproxy.zap.extension.sessions.ExtensionSessionManagement - Loaded session management method types: [Cookie-based Session Management, HTTP Authentication Session Management, Script-based Session Management] 3915 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Form Table View Extension 3915 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Capture messages from WebSockets with the ability to set breakpoints. 3925 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to import a file containing URLs which ZAP will access, adding them to the Sites tree 3926 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Core UI related functionality. 3926 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Authorization Extension 3927 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing AJAX Spider, uses Crawljax 3928 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Provides WebDrivers to control several browsers using Selenium and includes HtmlUnit browser. 3933 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Manages the local proxy configurations 3934 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Handles adding Global Excluded URLs 3934 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Adds menu item to refresh the Sites tree 3934 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing OWASP ZAP User Guide 3934 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Provides a URL suitable for calling from target sites 3936 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to configure which extensions are loaded when ZAP starts 3936 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Combined HTTP Panels Extension 3937 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Hex View Extension 3937 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Image View Extension 3937 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Large Request View Extension 3937 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Large Response View Extension 3937 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Query Table View Extension 3937 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Syntax Highlighter View Extension 3937 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Adds support for configurable keyboard shortcuts for all of the ZAP menus. 3937 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Active and passive rule configuration 3940 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Statistics 3941 [ZAP-daemon] INFO org.zaproxy.zap.extension.stats.ExtensionStats - Start recording in memory stats 3942 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows to fuzz WebSocket messages. 3942 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionSaveRawHttpMessage 3942 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Context alert rules filter 3944 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Provides the foundation for concrete message types (for example, HTTP, WebSockets) expose fuzzer implementations. 3946 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows to fuzz HTTP messages. 3947 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Heads Up Display 4062 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionHUDlaunch 4068 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Active Scan Rules 4069 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Adds the Quick Start panel for scanning and exploring applications 4077 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Add the option to use the Ajax Spider in the Quick Start scan 4078 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Launch browsers proxying through ZAP 4079 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Launch browsers proxying through ZAP 4079 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionSaveXMLHttpMessage 4080 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Passive Scan Rules 4080 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing The Online menu links 4080 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to spider and import OpenAPI (Swagger) definitions 4098 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Easy way to replace strings in requests and responses 4108 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Tips and Tricks 4108 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing The ZAP Getting Started Guide 4287 [ZAP-daemon] INFO org.zaproxy.zap.extension.callback.ExtensionCallback - Started callback server on 0.0.0.0:40653 4287 [ZAP-daemon] INFO org.zaproxy.zap.extension.dynssl.ExtensionDynSSL - Creating new root CA certificate 5373 [ZAP-daemon] INFO org.zaproxy.zap.extension.dynssl.ExtensionDynSSL - New root CA certificate created 6381 [ZAP-daemon] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - There is/are 6 newer addons 11086 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Installing new addon selenium v15.2.0 11368 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Finished installing new addon selenium v15.2.0 11390 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Installing new addon pscanrules v28.0.0 11429 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Application Error Disclosure 11429 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Absence of Anti-CSRF Tokens 11430 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Incomplete or No Cache-control and Pragma HTTP Header Set 11430 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Charset Mismatch 11430 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: CSP Scanner 11430 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Content-Type Header Missing 11430 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie No HttpOnly Flag 11431 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Loosely Scoped Cookie 11431 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie Without SameSite Attribute 11431 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie Without Secure Flag 11432 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cross-Domain Misconfiguration 11432 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cross-Domain JavaScript Source File Inclusion 11432 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Debug Error Messages 11432 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Sensitive Information in URL 11432 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Sensitive Information in HTTP Referrer Header 11432 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Suspicious Comments 11432 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Weak Authentication Method 11433 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Insecure JSF ViewState 11433 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Secure Pages Include Mixed Content 11433 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Private IP Disclosure 11433 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Session ID in URL Rewrite 11433 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Timestamp Disclosure 11435 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Username Hash Found 11436 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Viewstate Scanner 11436 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-AspNet-Version Response Header Scanner 11436 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Content-Type-Options Header Missing 11436 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Debug-Token Information Leak 11437 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Frame-Options Header Scanner 11438 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) 11448 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Finished installing new addon pscanrules v28.0.0 11461 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Installing new addon quickstart v28.0.0 11540 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Finished installing new addon quickstart v28.0.0 11556 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Installing new addon webdriverlinux v17.0.0 11810 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Finished installing new addon webdriverlinux v17.0.0 11902 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Installing new addon zest v32.0.0 12060 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Finished installing new addon zest v32.0.0 12261 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Installing new addon hud v0.10.0 12362 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Finished installing new addon hud v0.10.0 12403 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/pscanrules-release-28.zap 12404 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/quickstart-release-28.zap 12404 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/hud-beta-0.10.0.zap 12404 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/webdriverlinux-release-17.zap 12404 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/zest-beta-32.zap 12404 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/selenium-release-15.2.0.zap 12404 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on update check complete 12405 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Downloading add-on from: https://github.com/zaproxy/zap-extensions/releases/download/ascanrulesBeta-v27/ascanrulesBeta-beta-27.zap 13611 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Installing new addon ascanrulesBeta v27.0.0 13689 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - Finished installing new addon ascanrulesBeta v27.0.0 13807 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/pscanrules-release-28.zap 13807 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/quickstart-release-28.zap 13808 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/hud-beta-0.10.0.zap 13808 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/webdriverlinux-release-17.zap 13808 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/zest-beta-32.zap 13808 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/selenium-release-15.2.0.zap 13808 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine - Add-on downloaded to: /home/zap/.ZAP/plugin/ascanrulesBeta-beta-27.zap 13808 [ZAP-daemon] INFO org.zaproxy.zap.DaemonBootstrap - ZAP is now listening on 0.0.0.0:8090 28190 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread - Starting spidering scan on http://172.17...dex-active.jsp at Mon May 11 16:02:24 UTC 2020 28192 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider - Spider initializing... 28212 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider - Starting spider... 89643 [ZAP-SpiderThreadPool-0-thread-2] WARN org.zaproxy.zap.spider.URLCanonicalizer - Error while Processing URL [httk://google.com] in the spidering process (on base http://172.17.0.2:8080/wavsep/active/Unvalidated-Redirect/Redirect-Detection-Evaluation-GET-302Redirect/Case03-Redirect-RedirectMethod-FilenameContext-Unrestricted-HttpURL-DefaultInvalidInput-AnyPathReq-Read.jsp?target=httk://google.com): unknown protocol: httk 89777 [ZAP-SpiderThreadPool-0-thread-2] WARN org.zaproxy.zap.spider.URLCanonicalizer - Error while Processing URL [http://] in the spidering process (on base http://172.17.0.2:8080/wavsep/active/Unvalidated-Redirect/Redirect-Detection-Evaluation-GET-302Redirect/Case07-Redirect-RedirectMethod-FilenameContext-Unrestricted-HttpURL-DefaultEmptyInput-PartialPathReq-Read.jsp?target): Expected authority at index 7: http:// 104027 [ZAP-SpiderThreadPool-0-thread-1] INFO org.zaproxy.zap.spider.Spider - Spidering process is complete. Shutting down... 104035 [ZAP-SpiderShutdownThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread - Spider scanning complete: true 113551 [ZAP-ProxyThread-42] INFO org.parosproxy.paros.core.scanner.Scanner - scanner started 113593 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - Scanning 1952 node(s) from http://172.17.0.2:8080 113593 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestPathTraversal strength MEDIUM threshold MEDIUM 297857 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestPathTraversal in 184.264s with 17582 message(s) sent and 411 alert(s) raised. 297857 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestRemoteFileInclude strength MEDIUM threshold MEDIUM 483700 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestRemoteFileInclude in 185.843s with 11452 message(s) sent and 100 alert(s) raised. 483701 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureWEBINF strength MEDIUM threshold MEDIUM 483701 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestServerSideInclude strength MEDIUM threshold MEDIUM 483712 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureWEBINF in 0.01s with 4 message(s) sent and 0 alert(s) raised. 666877 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestServerSideInclude in 183.176s with 4768 message(s) sent and 0 alert(s) raised. 666877 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestCrossSiteScriptV2 strength MEDIUM threshold MEDIUM 849847 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestCrossSiteScriptV2 in 182.97s with 3694 message(s) sent and 199 alert(s) raised. 849847 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestPersistentXSSPrime strength MEDIUM threshold MEDIUM 1031201 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestPersistentXSSPrime in 181.354s with 1224 message(s) sent and 0 alert(s) raised. 1031201 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestPersistentXSSSpider strength MEDIUM threshold MEDIUM 1224930 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestPersistentXSSSpider in 193.729s with 1952 message(s) sent and 0 alert(s) raised. 1224930 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestPersistentXSSAttack strength MEDIUM threshold MEDIUM 1263259 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestPersistentXSSAttack in 38.329s with 0 message(s) sent and 0 alert(s) raised. 1263260 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestSQLInjection strength MEDIUM threshold MEDIUM 1447051 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestSQLInjection in 183.791s with 27445 message(s) sent and 115 alert(s) raised. 1447051 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | CodeInjectionPlugin strength MEDIUM threshold MEDIUM 1630161 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | CodeInjectionPlugin in 183.11s with 9792 message(s) sent and 0 alert(s) raised. 1630162 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | CommandInjectionPlugin strength MEDIUM threshold MEDIUM 1816143 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | CommandInjectionPlugin in 185.982s with 39168 message(s) sent and 0 alert(s) raised. 1816143 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestDirectoryBrowsing strength MEDIUM threshold MEDIUM 2008484 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestDirectoryBrowsing in 192.341s with 1952 message(s) sent and 0 alert(s) raised. 2008485 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestExternalRedirect strength MEDIUM threshold MEDIUM 2191704 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestExternalRedirect in 183.219s with 10545 message(s) sent and 63 alert(s) raised. 2191704 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | BufferOverflow strength MEDIUM threshold MEDIUM 2366127 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | BufferOverflow in 174.423s with 1127 message(s) sent and 83 alert(s) raised. 2366127 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | FormatString strength MEDIUM threshold MEDIUM 2542737 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | FormatString in 176.61s with 3175 message(s) sent and 2 alert(s) raised. 2542737 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestInjectionCRLF strength MEDIUM threshold MEDIUM 2725405 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestInjectionCRLF in 182.668s with 8568 message(s) sent and 0 alert(s) raised. 2725405 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestParameterTamper strength MEDIUM threshold MEDIUM 2907615 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestParameterTamper in 182.21s with 7428 message(s) sent and 0 alert(s) raised. 2907616 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ScriptsActiveScanner strength MEDIUM threshold MEDIUM 2907631 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - skipped plugin [no scripts enabled] http://172.17.0.2:8080 | ScriptsActiveScanner in 0.016s with 0 message(s) sent and 0 alert(s) raised. 2907636 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureGit strength MEDIUM threshold MEDIUM 2924567 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureGit in 16.931s with 0 message(s) sent and 0 alert(s) raised. 2924567 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureFileInclusion strength MEDIUM threshold MEDIUM 3118332 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureFileInclusion in 193.765s with 5063 message(s) sent and 260 alert(s) raised. 3118333 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ShellShockScanner strength MEDIUM threshold MEDIUM 3300978 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ShellShockScanner in 182.645s with 2448 message(s) sent and 0 alert(s) raised. 3300979 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HttpoxyScanner strength MEDIUM threshold MEDIUM 3497891 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HttpoxyScanner in 196.912s with 7808 message(s) sent and 0 alert(s) raised. 3497892 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | Csrftokenscan strength MEDIUM threshold MEDIUM 3580354 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | Csrftokenscan in 82.463s with 609 message(s) sent and 607 alert(s) raised. 3580355 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HeartBleedActiveScanner strength MEDIUM threshold MEDIUM 3580356 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | CrossDomainScanner strength MEDIUM threshold MEDIUM 3580360 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HeartBleedActiveScanner in 0.006s with 3 message(s) sent and 0 alert(s) raised. 3580371 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureCVE20121823 strength MEDIUM threshold MEDIUM 3580393 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | CrossDomainScanner in 0.037s with 2 message(s) sent and 0 alert(s) raised. 3746700 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureCVE20121823 in 166.329s with 1606 message(s) sent and 0 alert(s) raised. 3746700 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | RemoteCodeExecutionCVE20121823 strength MEDIUM threshold MEDIUM 3942689 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | RemoteCodeExecutionCVE20121823 in 195.989s with 3904 message(s) sent and 0 alert(s) raised. 3942690 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SessionFixation strength MEDIUM threshold MEDIUM 3944299 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SessionFixation in 1.609s with 0 message(s) sent and 0 alert(s) raised. 3944299 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionMySQL strength MEDIUM threshold MEDIUM 5287853 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionMySQL in 1343.554s with 7970 message(s) sent and 104 alert(s) raised. 5287853 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionHypersonic strength MEDIUM threshold MEDIUM 5470862 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionHypersonic in 183.009s with 7334 message(s) sent and 0 alert(s) raised. 5470862 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionOracle strength MEDIUM threshold MEDIUM 5654079 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionOracle in 183.217s with 7344 message(s) sent and 0 alert(s) raised. 5654079 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionPostgresql strength MEDIUM threshold MEDIUM 5837068 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionPostgresql in 182.989s with 7344 message(s) sent and 0 alert(s) raised. 5837068 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionSQLite strength MEDIUM threshold MEDIUM 6023468 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionSQLite in 186.4s with 47403 message(s) sent and 0 alert(s) raised. 6023468 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionMsSQL strength MEDIUM threshold MEDIUM 6206469 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionMsSQL in 183.001s with 7224 message(s) sent and 0 alert(s) raised. 6206470 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | XpathInjectionPlugin strength MEDIUM threshold MEDIUM 6389340 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | XpathInjectionPlugin in 182.87s with 3672 message(s) sent and 0 alert(s) raised. 6389340 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | XXEPlugin strength MEDIUM threshold MEDIUM 6390551 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | XXEPlugin in 1.211s with 0 message(s) sent and 0 alert(s) raised. 6390551 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | PaddingOraclePlugin strength MEDIUM threshold MEDIUM 6434206 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | PaddingOraclePlugin in 43.655s with 2 message(s) sent and 1 alert(s) raised. 6434206 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ExpressionLanguageInjectionPlugin strength MEDIUM threshold MEDIUM 6615566 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ExpressionLanguageInjectionPlugin in 181.36s with 1192 message(s) sent and 0 alert(s) raised. 6615566 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureSVN strength MEDIUM threshold MEDIUM 6798334 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureSVN in 182.768s with 1863 message(s) sent and 0 alert(s) raised. 6798334 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | RelativePathConfusionScanner strength MEDIUM threshold MEDIUM 6983510 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | RelativePathConfusionScanner in 185.176s with 1879 message(s) sent and 0 alert(s) raised. 6983510 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ApacheRangeHeaderDos strength MEDIUM threshold MEDIUM 7173799 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ApacheRangeHeaderDos in 190.289s with 1959 message(s) sent and 0 alert(s) raised. 7173800 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | BackupFileDisclosure strength MEDIUM threshold MEDIUM 7363112 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | BackupFileDisclosure in 189.312s with 66112 message(s) sent and 0 alert(s) raised. 7363112 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestUserAgent strength MEDIUM threshold MEDIUM 7559859 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestUserAgent in 196.747s with 13629 message(s) sent and 1518 alert(s) raised. 7559859 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HttpOnlySite strength MEDIUM threshold MEDIUM 7559860 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | IntegerOverflow strength MEDIUM threshold MEDIUM 7559882 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HttpOnlySite in 0.022s with 0 message(s) sent and 1 alert(s) raised. 7735481 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | IntegerOverflow in 175.622s with 4323 message(s) sent and 63 alert(s) raised. 7735481 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ProxyDisclosureScanner strength MEDIUM threshold MEDIUM 7931963 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ProxyDisclosureScanner in 196.482s with 15616 message(s) sent and 0 alert(s) raised. 7931964 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ElmahScanner strength MEDIUM threshold MEDIUM 7931965 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TraceAxdScanner strength MEDIUM threshold MEDIUM 7931967 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ElmahScanner in 0.004s with 1 message(s) sent and 0 alert(s) raised. 7945053 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TraceAxdScanner in 13.088s with 70 message(s) sent and 3 alert(s) raised. 7945053 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HtAccessScanner strength MEDIUM threshold MEDIUM 7956438 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HtAccessScanner in 11.385s with 70 message(s) sent and 2 alert(s) raised. 7956438 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | InsecureHTTPMethod strength MEDIUM threshold MEDIUM 8147064 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | InsecureHTTPMethod in 190.626s with 1968 message(s) sent and 16 alert(s) raised. 8147064 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HttpsAsHttpScanner strength MEDIUM threshold MEDIUM 8148002 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HttpsAsHttpScanner in 0.938s with 0 message(s) sent and 0 alert(s) raised. 8148002 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | GetForPostScanner strength MEDIUM threshold MEDIUM 8232178 [ZAP-ActiveScanner-0] WARN org.zaproxy.zap.extension.ascanrulesBeta.GetForPostScanner - An error occurred while checking [GET] [http://172.17.0.2:8080/wavsep/active/Unvalidated-Redirect/Redirect-Detection-Evaluation-POST-302Redirect/Case07-Redirect-RedirectMethod-FilenameContext-Unrestricted-HttpURL-DefaultEmptyInput-PartialPathReq-Read.jsp?target=ZAP] for GET for POST Caught java.net.UnknownHostException ZAP 8235452 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | GetForPostScanner in 87.45s with 589 message(s) sent and 371 alert(s) raised. 8235452 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HPP strength MEDIUM threshold MEDIUM 8316854 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HPP in 81.402s with 560 message(s) sent and 0 alert(s) raised. 8316854 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | UsernameEnumeration strength MEDIUM threshold MEDIUM 8316854 [Thread-24] INFO org.zaproxy.zap.extension.ascanrulesBeta.UsernameEnumeration - There does not appear to be any configured contexts using Form-based Authentication. Further attempts during the current scan will be skipped. 8316854 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - skipped plugin http://172.17.0.2:8080 | UsernameEnumeration in 0s with 0 message(s) sent and 0 alert(s) raised. 8316854 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SlackerCookieDetector strength MEDIUM threshold MEDIUM 8512763 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SlackerCookieDetector in 195.909s with 3902 message(s) sent and 1946 alert(s) raised. 8512763 [Thread-24] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host http://172.17.0.2:8080 in 8399.198s with 5865 alert(s) raised. 8512764 [Thread-23] INFO org.parosproxy.paros.core.scanner.Scanner - scanner completed in 8399.213s