Found Java version 11.0.7 Available memory: 3950 MB Using JVM args: -Xmx987m 375 [main] INFO org.zaproxy.zap.DaemonBootstrap - OWASP ZAP D-2020-04-27 started 11/05/2020, 22:02:15 with home /home/zap/.ZAP_D/ 424 [main] INFO org.parosproxy.paros.common.AbstractParam - Setting config api.disablekey = true was null 429 [main] INFO org.parosproxy.paros.common.AbstractParam - Setting config api.addrs.addr.name = .* was null 430 [main] INFO org.parosproxy.paros.common.AbstractParam - Setting config api.addrs.addr.regex = true was null 430 [main] INFO org.parosproxy.paros.common.AbstractParam - Setting config database.recoverylog = false was null 439 [main] INFO org.parosproxy.paros.network.SSLConnector - Reading supported SSL/TLS protocols... 439 [main] INFO org.parosproxy.paros.network.SSLConnector - Using a SSLEngine... 537 [main] INFO org.parosproxy.paros.network.SSLConnector - Done reading supported SSL/TLS protocols: [SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3] 548 [main] INFO org.parosproxy.paros.extension.option.OptionsParamCertificate - Unsafe SSL renegotiation disabled. 1026 [main] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache open start 1034 [main] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE - dataFileCache open end 1143 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory - Loading extensions 2915 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory - Installed add-ons: [[id=accessControl, version=6.0.0], [id=alertFilters, version=11.0.0], [id=ascanrules, version=35.0.0], [id=ascanrulesBeta, version=28.0.0], [id=bruteforce, version=10.0.0], [id=coreLang, version=14.0.0], [id=diff, version=11.0.0], [id=directorylistv1, version=5.0.0], [id=formhandler, version=3.0.0], [id=fuzz, version=13.0.0], [id=gettingStarted, version=12.0.0], [id=help, version=11.0.0], [id=hud, version=0.11.0], [id=importurls, version=8.0.0], [id=invoke, version=11.0.0], [id=onlineMenu, version=8.0.0], [id=openapi, version=16.0.0], [id=plugnhack, version=12.0.0], [id=portscan, version=9.0.0], [id=pscanrules, version=29.0.0], [id=pscanrulesBeta, version=22.0.0], [id=quickstart, version=29.0.0], [id=replacer, version=9.0.0], [id=reveal, version=4.0.0], [id=saverawmessage, version=6.0.0], [id=savexmlmessage, version=0.2.0], [id=scripts, version=27.0.0], [id=selenium, version=15.3.0], [id=sequence, version=6.0.0], [id=spiderAjax, version=23.2.0], [id=tips, version=8.0.0], [id=webdriverlinux, version=18.0.0], [id=webdrivermacos, version=17.0.0], [id=webdriverwindows, version=18.0.0], [id=websocket, version=22.0.0], [id=zest, version=33.0.0]] 3393 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory - Extensions loaded 3530 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows ZAP to check for updates 3534 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Options Extension 3534 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Edit Menu Extension 3534 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Provides a rest based API for controlling and accessing ZAP 3542 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Session State Extension 3542 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Report Extension 3543 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing History Extension 3544 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Show hidden fields and enable disabled fields 3545 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Search messages for strings and regular expressions 3546 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Encode/Decode/Hash... 3546 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to intercept and modify requests and responses 3547 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Passive scanner 3612 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Script Passive Scan Rules 3613 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Stats Passive Scan Rule 3613 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Application Error Disclosure 3613 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Absence of Anti-CSRF Tokens 3614 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Incomplete or No Cache-control and Pragma HTTP Header Set 3614 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Charset Mismatch 3614 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: CSP Scanner 3614 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Content-Type Header Missing 3614 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie No HttpOnly Flag 3614 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Loosely Scoped Cookie 3615 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie Without SameSite Attribute 3615 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie Without Secure Flag 3615 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cross-Domain Misconfiguration 3615 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cross-Domain JavaScript Source File Inclusion 3615 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Debug Error Messages 3616 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Sensitive Information in URL 3616 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Sensitive Information in HTTP Referrer Header 3616 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Information Disclosure - Suspicious Comments 3616 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Weak Authentication Method 3616 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Insecure JSF ViewState 3616 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Secure Pages Include Mixed Content 3617 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Private IP Disclosure 3617 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Session ID in URL Rewrite 3617 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Timestamp Disclosure 3617 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Username Hash Found 3617 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Viewstate Scanner 3618 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-AspNet-Version Response Header Scanner 3618 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Content-Type-Options Header Missing 3618 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Debug-Token Information Leak 3618 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Frame-Options Header Scanner 3618 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) 3619 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Big Redirect Detected (Potential Sensitive Information Leak) 3619 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Content Security Policy (CSP) Header Not Set 3619 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Directory Browsing 3619 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Hash Disclosure 3620 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Heartbleed OpenSSL Vulnerability (Indicative) 3620 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: HTTP to HTTPS Insecure Transition in Form Post 3620 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: HTTPS to HTTP Insecure Transition in Form Post 3620 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Reverse Tabnabbing 3620 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: PII Disclosure 3621 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Retrieved from Cache 3621 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: HTTP Server Response Header Scanner 3621 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: HTTP Parameter Override 3621 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Strict-Transport-Security Header Scanner 3621 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: User Controllable Charset 3621 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Cookie Poisoning 3622 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: User Controllable HTML Element Attribute (Potential XSS) 3622 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: User Controllable JavaScript Event (XSS) 3622 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: Open Redirect 3622 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-Backend-Server Header Information Leak 3622 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan - loaded passive scan rule: X-ChromeLogger-Data (XCOLD) Header Information Leak 3677 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to view and manage alerts 3679 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Active scanner, heavily based on the original Paros active scanner, but with additional tests added 3686 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionSequence 3697 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Spider used for automatically finding URIs on a site 3707 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing A set of common popup menus for miscellaneous tasks 3707 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Forced browsing of files and directories using code from the OWASP DirBuster tool 3708 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Simple but effective port scanner 3711 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Manual Request Editor Extension 3711 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Compares 2 sessions and generates an HTML file showing the differences 3711 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Invoke external applications passing context related information such as URLs and parameters 3711 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Handles anti cross site request forgery (CSRF) tokens 3716 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Authentication Extension 3737 [ZAP-daemon] INFO org.zaproxy.zap.extension.authentication.ExtensionAuthentication - Loaded authentication method types: [Form-based Authentication, HTTP/NTLM Authentication, Manual Authentication, Script-based Authentication, JSON-based Authentication] 3739 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Creates a dynamic SSL certificate to allow SSL communications to be intercepted without warnings being generated by the browser 3740 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Logs errors to the Output tab in development mode only 3740 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Users Extension 3744 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Summarise and analyse FORM and URL parameters as well as cookies 3745 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Script integration 3764 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Scripting console, supports all JSR 223 scripting languages 3913 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Forced User Extension 3914 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Extension handling HTTP sessions 3916 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Zest is a specialized scripting language from Mozilla specifically designed to be used in security tools 4115 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionDiff 4115 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Post Table View Extension 4115 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Simple browser configuration 4115 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Session Management Extension 4122 [ZAP-daemon] INFO org.zaproxy.zap.extension.sessions.ExtensionSessionManagement - Loaded session management method types: [Cookie-based Session Management, HTTP Authentication Session Management, Script-based Session Management] 4123 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Form Table View Extension 4123 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Capture messages from WebSockets with the ability to set breakpoints. 4162 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to import a file containing URLs which ZAP will access, adding them to the Sites tree 4163 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Core UI related functionality. 4163 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Authorization Extension 4164 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing AJAX Spider, uses Crawljax 4174 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Provides WebDrivers to control several browsers using Selenium and includes HtmlUnit browser. 4184 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Manages the local proxy configurations 4185 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Add-on that adds a set of tools for testing access control in web applications. 4187 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Handles adding Global Excluded URLs 4187 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Adds menu item to refresh the Sites tree 4187 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing OWASP ZAP User Guide 4187 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Provides a URL suitable for calling from target sites 4189 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to configure which extensions are loaded when ZAP starts 4189 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Combined HTTP Panels Extension 4189 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Hex View Extension 4189 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Image View Extension 4189 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Large Request View Extension 4191 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Large Response View Extension 4192 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Query Table View Extension 4193 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing HTTP Panel Syntax Highlighter View Extension 4193 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Adds support for configurable keyboard shortcuts for all of the ZAP menus. 4195 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Active and passive rule configuration 4198 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Statistics 4199 [ZAP-daemon] INFO org.zaproxy.zap.extension.stats.ExtensionStats - Start recording in memory stats 4200 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing The ZAP Getting Started Guide 4200 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows to fuzz WebSocket messages. 4200 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Passive Scan Rules 4201 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to spider and import OpenAPI (Swagger) definitions 4219 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Adds the Quick Start panel for scanning and exploring applications 4222 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Add the option to use the Ajax Spider in the Quick Start scan 4223 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Launch browsers proxying through ZAP 4223 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Launch browsers proxying through ZAP 4224 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing The Online menu links 4224 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Active Scan Rules - beta 4224 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionSaveRawHttpMessage 4225 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Tips and Tricks 4225 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Provides the foundation for concrete message types (for example, HTTP, WebSockets) expose fuzzer implementations. 4228 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows to fuzz HTTP messages. 4229 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Context alert rules filter 4231 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionSaveXMLHttpMessage 4231 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing This extension allows a user to change the default values used by ZAP Spiders. 4242 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Translations of the core language files 4242 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Heads Up Display 4406 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionHUDlaunch 4407 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Passive Scan Rules - beta 4408 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Easy way to replace strings in requests and responses 4412 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader - Initializing Active Scan Rules 4677 [ZAP-daemon] INFO org.zaproxy.zap.extension.callback.ExtensionCallback - Started callback server on 0.0.0.0:36812 4678 [ZAP-daemon] INFO org.zaproxy.zap.extension.dynssl.ExtensionDynSSL - Creating new root CA certificate 5735 [ZAP-daemon] INFO org.zaproxy.zap.extension.dynssl.ExtensionDynSSL - New root CA certificate created 5740 [ZAP-daemon] INFO org.zaproxy.zap.DaemonBootstrap - ZAP is now listening on 0.0.0.0:8090 27139 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread - Starting spidering scan on http://172.17...dex-active.jsp at Mon May 11 22:02:42 UTC 2020 27142 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider - Spider initializing... 27163 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider - Starting spider... 99233 [ZAP-SpiderThreadPool-0-thread-2] WARN org.zaproxy.zap.spider.URLCanonicalizer - Error while Processing URL [httk://google.com] in the spidering process (on base http://172.17.0.2:8080/wavsep/active/Unvalidated-Redirect/Redirect-Detection-Evaluation-GET-302Redirect/Case03-Redirect-RedirectMethod-FilenameContext-Unrestricted-HttpURL-DefaultInvalidInput-AnyPathReq-Read.jsp?target=httk://google.com): unknown protocol: httk 99389 [ZAP-SpiderThreadPool-0-thread-1] WARN org.zaproxy.zap.spider.URLCanonicalizer - Error while Processing URL [http://] in the spidering process (on base http://172.17.0.2:8080/wavsep/active/Unvalidated-Redirect/Redirect-Detection-Evaluation-GET-302Redirect/Case07-Redirect-RedirectMethod-FilenameContext-Unrestricted-HttpURL-DefaultEmptyInput-PartialPathReq-Read.jsp?target): Expected authority at index 7: http:// 106415 [ZAP-SpiderThreadPool-0-thread-2] INFO org.zaproxy.zap.spider.Spider - Spidering process is complete. Shutting down... 106423 [ZAP-SpiderShutdownThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread - Spider scanning complete: true 112559 [ZAP-ProxyThread-42] INFO org.parosproxy.paros.core.scanner.Scanner - scanner started 112594 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - Scanning 1946 node(s) from http://172.17.0.2:8080 112599 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestPathTraversal strength MEDIUM threshold MEDIUM 296235 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestPathTraversal in 183.637s with 17479 message(s) sent and 405 alert(s) raised. 296236 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestRemoteFileInclude strength MEDIUM threshold MEDIUM 481179 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestRemoteFileInclude in 184.944s with 11380 message(s) sent and 98 alert(s) raised. 481179 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureWEBINF strength MEDIUM threshold MEDIUM 481180 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestExternalRedirect strength MEDIUM threshold MEDIUM 481184 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - skipped plugin [not supported on Java 9+] http://172.17.0.2:8080 | SourceCodeDisclosureWEBINF in 0.002s with 0 message(s) sent and 0 alert(s) raised. 663773 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestExternalRedirect in 182.593s with 10475 message(s) sent and 64 alert(s) raised. 663774 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestServerSideInclude strength MEDIUM threshold MEDIUM 846131 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestServerSideInclude in 182.357s with 4736 message(s) sent and 0 alert(s) raised. 846132 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestCrossSiteScriptV2 strength MEDIUM threshold MEDIUM 1028555 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestCrossSiteScriptV2 in 182.423s with 4762 message(s) sent and 199 alert(s) raised. 1028555 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestPersistentXSSPrime strength MEDIUM threshold MEDIUM 1208588 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestPersistentXSSPrime in 180.033s with 1217 message(s) sent and 0 alert(s) raised. 1208588 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestPersistentXSSSpider strength MEDIUM threshold MEDIUM 1400329 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestPersistentXSSSpider in 191.741s with 1946 message(s) sent and 0 alert(s) raised. 1400329 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestPersistentXSSAttack strength MEDIUM threshold MEDIUM 1457767 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestPersistentXSSAttack in 57.438s with 4 message(s) sent and 1 alert(s) raised. 1457767 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestSQLInjection strength MEDIUM threshold MEDIUM 1640954 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestSQLInjection in 183.187s with 27280 message(s) sent and 116 alert(s) raised. 1640955 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | CodeInjectionPlugin strength MEDIUM threshold MEDIUM 1823198 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | CodeInjectionPlugin in 182.243s with 9736 message(s) sent and 0 alert(s) raised. 1823198 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | CommandInjectionPlugin strength MEDIUM threshold MEDIUM 2007521 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | CommandInjectionPlugin in 184.323s with 38942 message(s) sent and 0 alert(s) raised. 2007523 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestDirectoryBrowsing strength MEDIUM threshold MEDIUM 2198071 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestDirectoryBrowsing in 190.548s with 1946 message(s) sent and 0 alert(s) raised. 2198071 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | BufferOverflow strength MEDIUM threshold MEDIUM 2371339 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | BufferOverflow in 173.268s with 1121 message(s) sent and 81 alert(s) raised. 2371339 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | FormatString strength MEDIUM threshold MEDIUM 2545178 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | FormatString in 173.839s with 3159 message(s) sent and 2 alert(s) raised. 2545179 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestInjectionCRLF strength MEDIUM threshold MEDIUM 2725931 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestInjectionCRLF in 180.752s with 8519 message(s) sent and 0 alert(s) raised. 2725932 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestParameterTamper strength MEDIUM threshold MEDIUM 2908130 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestParameterTamper in 182.199s with 7379 message(s) sent and 0 alert(s) raised. 2908130 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ScriptsActiveScanner strength MEDIUM threshold MEDIUM 2908131 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - skipped plugin [no scripts enabled] http://172.17.0.2:8080 | ScriptsActiveScanner in 0.001s with 0 message(s) sent and 0 alert(s) raised. 2908131 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureGit strength MEDIUM threshold MEDIUM 2923449 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureGit in 15.318s with 0 message(s) sent and 0 alert(s) raised. 2923449 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureFileInclusion strength MEDIUM threshold MEDIUM 3115937 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureFileInclusion in 192.488s with 5048 message(s) sent and 256 alert(s) raised. 3115937 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ShellShockScanner strength MEDIUM threshold MEDIUM 3295976 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ShellShockScanner in 180.039s with 2434 message(s) sent and 0 alert(s) raised. 3295976 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HttpoxyScanner strength MEDIUM threshold MEDIUM 3491968 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HttpoxyScanner in 195.992s with 7784 message(s) sent and 0 alert(s) raised. 3491969 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | Csrftokenscan strength MEDIUM threshold MEDIUM 3571337 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | Csrftokenscan in 79.368s with 608 message(s) sent and 606 alert(s) raised. 3571337 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HeartBleedActiveScanner strength MEDIUM threshold MEDIUM 3571338 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | CrossDomainScanner strength MEDIUM threshold MEDIUM 3571340 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureCVE20121823 strength MEDIUM threshold MEDIUM 3571355 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HeartBleedActiveScanner in 0.018s with 3 message(s) sent and 0 alert(s) raised. 3571356 [ZAP-ActiveScanner-1] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | CrossDomainScanner in 0.018s with 2 message(s) sent and 0 alert(s) raised. 3736694 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureCVE20121823 in 165.354s with 1598 message(s) sent and 0 alert(s) raised. 3736695 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | RemoteCodeExecutionCVE20121823 strength MEDIUM threshold MEDIUM 3932000 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | RemoteCodeExecutionCVE20121823 in 195.306s with 3892 message(s) sent and 0 alert(s) raised. 3932000 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SessionFixation strength MEDIUM threshold MEDIUM 3933409 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SessionFixation in 1.409s with 0 message(s) sent and 0 alert(s) raised. 3933409 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionMySQL strength MEDIUM threshold MEDIUM 5276041 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionMySQL in 1342.632s with 7921 message(s) sent and 104 alert(s) raised. 5276042 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionHypersonic strength MEDIUM threshold MEDIUM 5458297 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionHypersonic in 182.255s with 7302 message(s) sent and 0 alert(s) raised. 5458297 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionOracle strength MEDIUM threshold MEDIUM 5640175 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionOracle in 181.878s with 7302 message(s) sent and 0 alert(s) raised. 5640175 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionPostgresql strength MEDIUM threshold MEDIUM 5821588 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionPostgresql in 181.413s with 7297 message(s) sent and 0 alert(s) raised. 5821588 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionSQLite strength MEDIUM threshold MEDIUM 5856168 [ZAP-ActiveScanner-0] ERROR org.zaproxy.zap.extension.ascanrulesBeta.SQLInjectionSQLite - An error occurred checking a url for SQLite SQL Injection vulnerabilities java.net.SocketException: Connection reset at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186) at java.base/java.net.SocketInputStream.read(SocketInputStream.java:140) at java.base/java.io.BufferedInputStream.fill(BufferedInputStream.java:252) at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:271) at org.apache.commons.httpclient.HttpParser.readRawLine(HttpParser.java:78) at org.apache.commons.httpclient.HttpParser.readLine(HttpParser.java:106) at org.apache.commons.httpclient.HttpConnection.readLine(HttpConnection.java:1153) at org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.readLine(MultiThreadedHttpConnectionManager.java:1413) at org.apache.commons.httpclient.HttpMethodBase.readStatusLine(HttpMethodBase.java:2108) at org.zaproxy.zap.ZapGetMethod.readResponse(ZapGetMethod.java:112) at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1156) at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:470) at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:207) at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397) at org.parosproxy.paros.network.HttpSender.executeMethod(HttpSender.java:424) at org.parosproxy.paros.network.HttpSender.runMethod(HttpSender.java:659) at org.parosproxy.paros.network.HttpSender.send(HttpSender.java:615) at org.parosproxy.paros.network.HttpSender.sendAuthenticated(HttpSender.java:591) at org.parosproxy.paros.network.HttpSender.sendAndReceiveImpl(HttpSender.java:1021) at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:981) at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:306) at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:238) at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:210) at org.zaproxy.zap.extension.ascanrulesBeta.SQLInjectionSQLite.scan(SQLInjectionSQLite.java:430) at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:285) at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scanVariant(AbstractAppParamPlugin.java:209) at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:180) at org.parosproxy.paros.core.scanner.AbstractPlugin.run(AbstractPlugin.java:326) at java.base/java.lang.Thread.run(Thread.java:834) 5957735 [ZAP-ActiveScanner-1] ERROR org.zaproxy.zap.extension.ascanrulesBeta.SQLInjectionSQLite - An error occurred checking a url for SQLite SQL Injection vulnerabilities java.net.SocketException: Connection reset at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186) at java.base/java.net.SocketInputStream.read(SocketInputStream.java:140) at java.base/java.io.BufferedInputStream.fill(BufferedInputStream.java:252) at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:271) at org.apache.commons.httpclient.HttpParser.readRawLine(HttpParser.java:78) at org.apache.commons.httpclient.HttpParser.readLine(HttpParser.java:106) at org.apache.commons.httpclient.HttpConnection.readLine(HttpConnection.java:1153) at org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.readLine(MultiThreadedHttpConnectionManager.java:1413) at org.apache.commons.httpclient.HttpMethodBase.readStatusLine(HttpMethodBase.java:2108) at org.zaproxy.zap.ZapGetMethod.readResponse(ZapGetMethod.java:112) at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1156) at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:470) at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:207) at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397) at org.parosproxy.paros.network.HttpSender.executeMethod(HttpSender.java:424) at org.parosproxy.paros.network.HttpSender.runMethod(HttpSender.java:659) at org.parosproxy.paros.network.HttpSender.send(HttpSender.java:615) at org.parosproxy.paros.network.HttpSender.sendAuthenticated(HttpSender.java:591) at org.parosproxy.paros.network.HttpSender.sendAndReceiveImpl(HttpSender.java:1021) at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:981) at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:306) at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:238) at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:210) at org.zaproxy.zap.extension.ascanrulesBeta.SQLInjectionSQLite.scan(SQLInjectionSQLite.java:430) at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:285) at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scanVariant(AbstractAppParamPlugin.java:209) at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:180) at org.parosproxy.paros.core.scanner.AbstractPlugin.run(AbstractPlugin.java:326) at java.base/java.lang.Thread.run(Thread.java:834) 6006486 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionSQLite in 184.898s with 46858 message(s) sent and 0 alert(s) raised. 6006486 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SQLInjectionMsSQL strength MEDIUM threshold MEDIUM 6189093 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SQLInjectionMsSQL in 182.607s with 7187 message(s) sent and 0 alert(s) raised. 6189093 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | XpathInjectionPlugin strength MEDIUM threshold MEDIUM 6370122 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | XpathInjectionPlugin in 181.029s with 3651 message(s) sent and 0 alert(s) raised. 6370123 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | XXEPlugin strength MEDIUM threshold MEDIUM 6371932 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | XXEPlugin in 1.809s with 0 message(s) sent and 0 alert(s) raised. 6371933 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | PaddingOraclePlugin strength MEDIUM threshold MEDIUM 6418393 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | PaddingOraclePlugin in 46.461s with 2 message(s) sent and 1 alert(s) raised. 6418394 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ExpressionLanguageInjectionPlugin strength MEDIUM threshold MEDIUM 6597548 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ExpressionLanguageInjectionPlugin in 179.154s with 1184 message(s) sent and 0 alert(s) raised. 6597548 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SourceCodeDisclosureSVN strength MEDIUM threshold MEDIUM 6778373 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SourceCodeDisclosureSVN in 180.825s with 1854 message(s) sent and 0 alert(s) raised. 6778373 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | RelativePathConfusionScanner strength MEDIUM threshold MEDIUM 6964395 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | RelativePathConfusionScanner in 186.022s with 1873 message(s) sent and 0 alert(s) raised. 6964395 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ApacheRangeHeaderDos strength MEDIUM threshold MEDIUM 7150945 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ApacheRangeHeaderDos in 186.55s with 1953 message(s) sent and 0 alert(s) raised. 7150946 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | BackupFileDisclosure strength MEDIUM threshold MEDIUM 7338994 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | BackupFileDisclosure in 188.048s with 65860 message(s) sent and 0 alert(s) raised. 7338994 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HttpOnlySite strength MEDIUM threshold MEDIUM 7338996 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | IntegerOverflow strength MEDIUM threshold MEDIUM 7339019 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HttpOnlySite in 0.025s with 0 message(s) sent and 1 alert(s) raised. 7511860 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | IntegerOverflow in 172.864s with 4305 message(s) sent and 61 alert(s) raised. 7511860 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ProxyDisclosureScanner strength MEDIUM threshold MEDIUM 7707754 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ProxyDisclosureScanner in 195.894s with 15568 message(s) sent and 0 alert(s) raised. 7707754 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | ElmahScanner strength MEDIUM threshold MEDIUM 7707758 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | InsecureHTTPMethod strength MEDIUM threshold MEDIUM 7707760 [ZAP-ActiveScanner-0] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | ElmahScanner in 0.006s with 1 message(s) sent and 0 alert(s) raised. 7898231 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | InsecureHTTPMethod in 190.473s with 1962 message(s) sent and 16 alert(s) raised. 7898231 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HttpsAsHttpScanner strength MEDIUM threshold MEDIUM 7899253 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HttpsAsHttpScanner in 1.022s with 0 message(s) sent and 0 alert(s) raised. 7899253 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | GetForPostScanner strength MEDIUM threshold MEDIUM 7979304 [ZAP-ActiveScanner-0] WARN org.zaproxy.zap.extension.ascanrulesBeta.GetForPostScanner - An error occurred while checking [GET] [http://172.17.0.2:8080/wavsep/active/Unvalidated-Redirect/Redirect-Detection-Evaluation-POST-302Redirect/Case07-Redirect-RedirectMethod-FilenameContext-Unrestricted-HttpURL-DefaultEmptyInput-PartialPathReq-Read.jsp?target=ZAP] for GET for POST Caught java.net.UnknownHostException ZAP 7982344 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | GetForPostScanner in 83.091s with 590 message(s) sent and 370 alert(s) raised. 7982345 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | TestUserAgent strength MEDIUM threshold MEDIUM 8178220 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | TestUserAgent in 195.875s with 13587 message(s) sent and 1525 alert(s) raised. 8178220 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | HPP strength MEDIUM threshold MEDIUM 8254140 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | HPP in 75.92s with 560 message(s) sent and 0 alert(s) raised. 8254141 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | UsernameEnumeration strength MEDIUM threshold MEDIUM 8254141 [Thread-15] INFO org.zaproxy.zap.extension.ascanrulesBeta.UsernameEnumeration - There does not appear to be any configured contexts using Form-based Authentication. Further attempts during the current scan will be skipped. 8254141 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - skipped plugin http://172.17.0.2:8080 | UsernameEnumeration in 0.001s with 0 message(s) sent and 0 alert(s) raised. 8254141 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - start host http://172.17.0.2:8080 | SlackerCookieDetector strength MEDIUM threshold MEDIUM 8449468 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host/plugin http://172.17.0.2:8080 | SlackerCookieDetector in 195.327s with 3890 message(s) sent and 1939 alert(s) raised. 8449468 [Thread-15] INFO org.parosproxy.paros.core.scanner.HostProcess - completed host http://172.17.0.2:8080 in 8336.897s with 5845 alert(s) raised. 8449469 [Thread-14] INFO org.parosproxy.paros.core.scanner.Scanner - scanner completed in 8336.91s