diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 1d20fa7318..e7b98b04cb 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -590,8 +590,8 @@ jobs: kubectl -n securecodebox-system get pods echo "Operator Startup Logs" kubectl -n securecodebox-system logs deployment/securecodebox-controller-manager - - name: "Create 'demo-apps' namespace" - run: "kubectl create namespace demo-apps" + - name: "Create 'demo-targets' namespace" + run: "kubectl create namespace demo-targets" # ---- Install Test Dependencies ---- @@ -640,7 +640,7 @@ jobs: --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-test-scan" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" - helm -n integration-tests install http-webhook ./demo-apps/http-webhook + helm -n integration-tests install http-webhook ./demo-targets/http-webhook helm -n integration-tests install ro-hook ./hooks/generic-webhook/ \ --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-generic-webhook" \ --set="webhookUrl=http://http-webhook/hallo-welt" \ @@ -654,20 +654,20 @@ jobs: - name: "Install Demo Apps" run: | # Install dummy-ssh app - helm -n demo-apps install dummy-ssh ./demo-apps/dummy-ssh/ --set="fullnameOverride=dummy-ssh" --wait + helm -n demo-targets install dummy-ssh ./demo-targets/dummy-ssh/ --set="fullnameOverride=dummy-ssh" --wait # Install unsafe-https app - helm -n demo-apps install unsafe-https ./demo-apps/unsafe-https/ --set="fullnameOverride=unsafe-https" --wait + helm -n demo-targets install unsafe-https ./demo-targets/unsafe-https/ --set="fullnameOverride=unsafe-https" --wait # Install bodgeit app - helm -n demo-apps install bodgeit ./demo-apps/bodgeit/ --set="fullnameOverride=bodgeit" --wait + helm -n demo-targets install bodgeit ./demo-targets/bodgeit/ --set="fullnameOverride=bodgeit" --wait # Install bodgeit app - helm -n demo-apps install petstore ./demo-apps/swagger-petstore/ --set="fullnameOverride=petstore" --wait + helm -n demo-targets install petstore ./demo-targets/swagger-petstore/ --set="fullnameOverride=petstore" --wait # Install old-wordpress app - helm -n demo-apps install old-wordpress ./demo-apps/old-wordpress/ --set="fullnameOverride=old-wordpress" --wait + helm -n demo-targets install old-wordpress ./demo-targets/old-wordpress/ --set="fullnameOverride=old-wordpress" --wait # Install juiceshop app - helm -n demo-apps install juiceshop ./demo-apps/juice-shop/ --set="fullnameOverride=juiceshop" --wait + helm -n demo-targets install juiceshop ./demo-targets/juice-shop/ --set="fullnameOverride=juiceshop" --wait # Install plain nginx server - kubectl create deployment --image nginx:alpine nginx --namespace demo-apps - kubectl expose deployment nginx --port 80 --namespace demo-apps + kubectl create deployment --image nginx:alpine nginx --namespace demo-targets + kubectl expose deployment nginx --port 80 --namespace demo-targets # ---- OWASP Amass Integration Tests ---- @@ -710,7 +710,7 @@ jobs: - name: "kubeaudit Integration Tests" run: | kubectl create namespace kubeaudit-tests - helm -n kubeaudit-tests install juice-shop ./demo-apps/juice-shop/ --wait + helm -n kubeaudit-tests install juice-shop ./demo-targets/juice-shop/ --wait helm -n integration-tests install kubeaudit ./scanners/kubeaudit/ \ --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-kubeaudit" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ @@ -769,7 +769,7 @@ jobs: --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-test-scan" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" - helm -n integration-tests install http-webhook ./demo-apps/http-webhook --wait + helm -n integration-tests install http-webhook ./demo-targets/http-webhook --wait helm -n integration-tests install notification-hook ./hooks/notification --values tests/integration/hooks/__testFiles__/notification-values.yaml \ --set="hook.image.repository=docker.io/${{env.DOCKER_NAMESPACE }}/hook-notification" \ @@ -894,7 +894,7 @@ jobs: --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-cascading-scans" \ --set="hook.image.tag=sha-$(git rev-parse --short HEAD)" # Install unsafe-https - helm upgrade --install unsafe-https ./demo-apps/unsafe-https/ -n cascading-tests --wait + helm upgrade --install unsafe-https ./demo-targets/unsafe-https/ -n cascading-tests --wait # Install nmap helm -n cascading-tests install nmap ./scanners/nmap/ --wait \ --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nmap" \ diff --git a/bin/install.sh b/bin/install.sh index 5e867f7890..f598b4d28c 100755 --- a/bin/install.sh +++ b/bin/install.sh @@ -7,12 +7,12 @@ # Official installation script for the secureCodeBox # # Creates namespace, securecodebox-system, and installs the operator. -# Then installs all possible resources (scanners, demo-apps, hooks). +# Then installs all possible resources (scanners, demo-targets, hooks). # # There exist different modes: # Call without parameters to install interactively # Call with --all to install all available resources automatically -# Call with --scanners / --demo-apps / --hooks to only install the wanted resources +# Call with --scanners / --demo-targets / --hooks to only install the wanted resources # Call with --help for usage information # # For more information see https://docs.securecodebox.io/ @@ -20,7 +20,7 @@ set -euo pipefail shopt -s extglob -USAGE="Usage: $(basename "$0") [--all] [--scanners] [--hooks] [--demo-apps] [--help|-h]" +USAGE="Usage: $(basename "$0") [--all] [--scanners] [--hooks] [--demo-targets] [--help|-h]" COLOR_HIGHLIGHT="\e[35m" COLOR_OK="\e[32m" @@ -59,9 +59,9 @@ The installation is interactive if no arguments are provided. Options - --all Install scanners, demo-apps and hooks + --all Install scanners, demo-targets and hooks --scanners Install scanners - --demo-apps Install demo-apps + --demo-targets Install demo-targets --hooks Install hooks -h|--help Show help @@ -185,7 +185,7 @@ function interactiveInstall() { installResources "$BASE_DIR/scanners" "default" False print - print "Starting to install demo-apps..." + print "Starting to install demo-targets..." print "Do you want to install the demo apps in a separate namespace? Otherwise they will be installed into the [default] namespace [y/N]" read -r line NAMESPACE="default" @@ -195,7 +195,7 @@ function interactiveInstall() { kubectl create namespace "$NAMESPACE" || print "Namespace already exists or could not be created.. " fi - installResources "$BASE_DIR/demo-apps" "$NAMESPACE" False + installResources "$BASE_DIR/demo-targets" "$NAMESPACE" False print print "Starting to install hooks..." @@ -220,8 +220,8 @@ function unattendedInstall() { fi if [[ -n "${INSTALL_DEMO_APPS}" ]]; then - print "Starting to install demo-apps..." - installResources "$BASE_DIR/demo-apps" "default" True + print "Starting to install demo-targets..." + installResources "$BASE_DIR/demo-targets" "default" True fi if [[ -n "${INSTALL_HOOKS}" ]]; then @@ -244,7 +244,7 @@ function parseArguments() { INSTALL_SCANNERS='true' shift # Pop current argument from array ;; - --demo-apps) + --demo-targets) INSTALL_DEMO_APPS='true' shift ;; diff --git a/bin/uninstall.sh b/bin/uninstall.sh index 30e784ff90..f3a82c8211 100755 --- a/bin/uninstall.sh +++ b/bin/uninstall.sh @@ -6,7 +6,7 @@ # Official uninstall script for the secureCodeBox # -# Removes all available resources (scanners, demo-apps, hooks, operator) and namespaces +# Removes all available resources (scanners, demo-targets, hooks, operator) and namespaces # # For more information see https://docs.securecodebox.io/ @@ -39,7 +39,7 @@ function uninstallResources() { helm -n securecodebox-system uninstall securecodebox-operator || true uninstallResources "$BASE_DIR/scanners" -uninstallResources "$BASE_DIR/demo-apps" +uninstallResources "$BASE_DIR/demo-targets" uninstallResources "$BASE_DIR/hooks" kubectl delete namespaces securecodebox-system || true diff --git a/demo-apps/README.md b/demo-targets/README.md similarity index 100% rename from demo-apps/README.md rename to demo-targets/README.md diff --git a/demo-apps/bodgeit/.helmignore b/demo-targets/bodgeit/.helmignore similarity index 100% rename from demo-apps/bodgeit/.helmignore rename to demo-targets/bodgeit/.helmignore diff --git a/demo-apps/bodgeit/Chart.yaml b/demo-targets/bodgeit/Chart.yaml similarity index 100% rename from demo-apps/bodgeit/Chart.yaml rename to demo-targets/bodgeit/Chart.yaml diff --git a/demo-apps/bodgeit/README.md b/demo-targets/bodgeit/README.md similarity index 99% rename from demo-apps/bodgeit/README.md rename to demo-targets/bodgeit/README.md index 8837eb2689..e048c14309 100644 --- a/demo-apps/bodgeit/README.md +++ b/demo-targets/bodgeit/README.md @@ -18,7 +18,7 @@ BodgeIt Store is a serverside rendering based html website without any heavy jav ## Source Code -* +* * ## Chart Configuration diff --git a/demo-apps/bodgeit/README.md.gotmpl b/demo-targets/bodgeit/README.md.gotmpl similarity index 98% rename from demo-apps/bodgeit/README.md.gotmpl rename to demo-targets/bodgeit/README.md.gotmpl index 500961cfce..b90e9cf81f 100644 --- a/demo-apps/bodgeit/README.md.gotmpl +++ b/demo-targets/bodgeit/README.md.gotmpl @@ -23,7 +23,7 @@ BodgeIt Store is a serverside rendering based html website without any heavy jav ## Source Code -* +* * ## Chart Configuration diff --git a/demo-apps/bodgeit/questions.yml b/demo-targets/bodgeit/questions.yml similarity index 100% rename from demo-apps/bodgeit/questions.yml rename to demo-targets/bodgeit/questions.yml diff --git a/demo-apps/bodgeit/templates/NOTES.txt b/demo-targets/bodgeit/templates/NOTES.txt similarity index 100% rename from demo-apps/bodgeit/templates/NOTES.txt rename to demo-targets/bodgeit/templates/NOTES.txt diff --git a/demo-apps/bodgeit/templates/_helpers.tpl b/demo-targets/bodgeit/templates/_helpers.tpl similarity index 100% rename from demo-apps/bodgeit/templates/_helpers.tpl rename to demo-targets/bodgeit/templates/_helpers.tpl diff --git a/demo-apps/bodgeit/templates/deployment.yaml b/demo-targets/bodgeit/templates/deployment.yaml similarity index 100% rename from demo-apps/bodgeit/templates/deployment.yaml rename to demo-targets/bodgeit/templates/deployment.yaml diff --git a/demo-apps/bodgeit/templates/ingress.yaml b/demo-targets/bodgeit/templates/ingress.yaml similarity index 100% rename from demo-apps/bodgeit/templates/ingress.yaml rename to demo-targets/bodgeit/templates/ingress.yaml diff --git a/demo-apps/bodgeit/templates/service.yaml b/demo-targets/bodgeit/templates/service.yaml similarity index 100% rename from demo-apps/bodgeit/templates/service.yaml rename to demo-targets/bodgeit/templates/service.yaml diff --git a/demo-apps/bodgeit/templates/tests/test-connection.yaml b/demo-targets/bodgeit/templates/tests/test-connection.yaml similarity index 100% rename from demo-apps/bodgeit/templates/tests/test-connection.yaml rename to demo-targets/bodgeit/templates/tests/test-connection.yaml diff --git a/demo-apps/bodgeit/values.yaml b/demo-targets/bodgeit/values.yaml similarity index 100% rename from demo-apps/bodgeit/values.yaml rename to demo-targets/bodgeit/values.yaml diff --git a/demo-apps/dummy-ssh/.helmignore b/demo-targets/dummy-ssh/.helmignore similarity index 100% rename from demo-apps/dummy-ssh/.helmignore rename to demo-targets/dummy-ssh/.helmignore diff --git a/demo-apps/dummy-ssh/Chart.yaml b/demo-targets/dummy-ssh/Chart.yaml similarity index 95% rename from demo-apps/dummy-ssh/Chart.yaml rename to demo-targets/dummy-ssh/Chart.yaml index 9b5e520bda..5b3f1e670b 100644 --- a/demo-apps/dummy-ssh/Chart.yaml +++ b/demo-targets/dummy-ssh/Chart.yaml @@ -14,7 +14,7 @@ keywords: - vulnerable - ssh sources: - - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-apps/dummy-ssh + - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-targets/dummy-ssh maintainers: - name: iteratec GmbH email: securecodebox@iteratec.com diff --git a/demo-apps/dummy-ssh/README.md b/demo-targets/dummy-ssh/README.md similarity index 98% rename from demo-apps/dummy-ssh/README.md rename to demo-targets/dummy-ssh/README.md index bd073e22eb..fad6568eb9 100644 --- a/demo-apps/dummy-ssh/README.md +++ b/demo-targets/dummy-ssh/README.md @@ -15,7 +15,7 @@ Port 22: Username root, Password: THEPASSWORDYOUCREATED ## Source Code -* +* ## Chart Configuration diff --git a/demo-apps/dummy-ssh/README.md.gotmpl b/demo-targets/dummy-ssh/README.md.gotmpl similarity index 97% rename from demo-apps/dummy-ssh/README.md.gotmpl rename to demo-targets/dummy-ssh/README.md.gotmpl index bb1b0f7b35..a6a6ad3187 100644 --- a/demo-apps/dummy-ssh/README.md.gotmpl +++ b/demo-targets/dummy-ssh/README.md.gotmpl @@ -20,7 +20,7 @@ Port 22: Username root, Password: THEPASSWORDYOUCREATED ## Source Code -* +* ## Chart Configuration diff --git a/demo-apps/dummy-ssh/questions.yml b/demo-targets/dummy-ssh/questions.yml similarity index 100% rename from demo-apps/dummy-ssh/questions.yml rename to demo-targets/dummy-ssh/questions.yml diff --git a/demo-apps/dummy-ssh/templates/NOTES.txt b/demo-targets/dummy-ssh/templates/NOTES.txt similarity index 100% rename from demo-apps/dummy-ssh/templates/NOTES.txt rename to demo-targets/dummy-ssh/templates/NOTES.txt diff --git a/demo-apps/dummy-ssh/templates/_helpers.tpl b/demo-targets/dummy-ssh/templates/_helpers.tpl similarity index 100% rename from demo-apps/dummy-ssh/templates/_helpers.tpl rename to demo-targets/dummy-ssh/templates/_helpers.tpl diff --git a/demo-apps/dummy-ssh/templates/deployment.yaml b/demo-targets/dummy-ssh/templates/deployment.yaml similarity index 100% rename from demo-apps/dummy-ssh/templates/deployment.yaml rename to demo-targets/dummy-ssh/templates/deployment.yaml diff --git a/demo-apps/dummy-ssh/templates/service.yaml b/demo-targets/dummy-ssh/templates/service.yaml similarity index 100% rename from demo-apps/dummy-ssh/templates/service.yaml rename to demo-targets/dummy-ssh/templates/service.yaml diff --git a/demo-apps/dummy-ssh/values.yaml b/demo-targets/dummy-ssh/values.yaml similarity index 100% rename from demo-apps/dummy-ssh/values.yaml rename to demo-targets/dummy-ssh/values.yaml diff --git a/demo-apps/http-webhook/.helmignore b/demo-targets/http-webhook/.helmignore similarity index 100% rename from demo-apps/http-webhook/.helmignore rename to demo-targets/http-webhook/.helmignore diff --git a/demo-apps/http-webhook/Chart.yaml b/demo-targets/http-webhook/Chart.yaml similarity index 100% rename from demo-apps/http-webhook/Chart.yaml rename to demo-targets/http-webhook/Chart.yaml diff --git a/demo-apps/http-webhook/README.md b/demo-targets/http-webhook/README.md similarity index 98% rename from demo-apps/http-webhook/README.md rename to demo-targets/http-webhook/README.md index 41b6d1264e..dba7cc4a39 100644 --- a/demo-apps/http-webhook/README.md +++ b/demo-targets/http-webhook/README.md @@ -15,7 +15,7 @@ A Dummy webserver to echo HTTP requests in log ## Source Code * -* +* ## Chart Configuration diff --git a/demo-apps/http-webhook/README.md.gotmpl b/demo-targets/http-webhook/README.md.gotmpl similarity index 97% rename from demo-apps/http-webhook/README.md.gotmpl rename to demo-targets/http-webhook/README.md.gotmpl index 41f829e87b..19b304420e 100644 --- a/demo-apps/http-webhook/README.md.gotmpl +++ b/demo-targets/http-webhook/README.md.gotmpl @@ -20,7 +20,7 @@ A Dummy webserver to echo HTTP requests in log ## Source Code * -* +* ## Chart Configuration diff --git a/demo-apps/http-webhook/templates/NOTES.txt b/demo-targets/http-webhook/templates/NOTES.txt similarity index 100% rename from demo-apps/http-webhook/templates/NOTES.txt rename to demo-targets/http-webhook/templates/NOTES.txt diff --git a/demo-apps/http-webhook/templates/_helpers.tpl b/demo-targets/http-webhook/templates/_helpers.tpl similarity index 100% rename from demo-apps/http-webhook/templates/_helpers.tpl rename to demo-targets/http-webhook/templates/_helpers.tpl diff --git a/demo-apps/http-webhook/templates/deployment.yaml b/demo-targets/http-webhook/templates/deployment.yaml similarity index 100% rename from demo-apps/http-webhook/templates/deployment.yaml rename to demo-targets/http-webhook/templates/deployment.yaml diff --git a/demo-apps/http-webhook/templates/hpa.yaml b/demo-targets/http-webhook/templates/hpa.yaml similarity index 100% rename from demo-apps/http-webhook/templates/hpa.yaml rename to demo-targets/http-webhook/templates/hpa.yaml diff --git a/demo-apps/http-webhook/templates/ingress.yaml b/demo-targets/http-webhook/templates/ingress.yaml similarity index 100% rename from demo-apps/http-webhook/templates/ingress.yaml rename to demo-targets/http-webhook/templates/ingress.yaml diff --git a/demo-apps/http-webhook/templates/service.yaml b/demo-targets/http-webhook/templates/service.yaml similarity index 100% rename from demo-apps/http-webhook/templates/service.yaml rename to demo-targets/http-webhook/templates/service.yaml diff --git a/demo-apps/http-webhook/templates/serviceaccount.yaml b/demo-targets/http-webhook/templates/serviceaccount.yaml similarity index 100% rename from demo-apps/http-webhook/templates/serviceaccount.yaml rename to demo-targets/http-webhook/templates/serviceaccount.yaml diff --git a/demo-apps/http-webhook/templates/tests/test-connection.yaml b/demo-targets/http-webhook/templates/tests/test-connection.yaml similarity index 100% rename from demo-apps/http-webhook/templates/tests/test-connection.yaml rename to demo-targets/http-webhook/templates/tests/test-connection.yaml diff --git a/demo-apps/http-webhook/values.yaml b/demo-targets/http-webhook/values.yaml similarity index 100% rename from demo-apps/http-webhook/values.yaml rename to demo-targets/http-webhook/values.yaml diff --git a/demo-apps/juice-shop/.helmignore b/demo-targets/juice-shop/.helmignore similarity index 100% rename from demo-apps/juice-shop/.helmignore rename to demo-targets/juice-shop/.helmignore diff --git a/demo-apps/juice-shop/Chart.yaml b/demo-targets/juice-shop/Chart.yaml similarity index 97% rename from demo-apps/juice-shop/Chart.yaml rename to demo-targets/juice-shop/Chart.yaml index 26941951b2..655349b9b4 100644 --- a/demo-apps/juice-shop/Chart.yaml +++ b/demo-targets/juice-shop/Chart.yaml @@ -23,7 +23,7 @@ keywords: - appsec - ctf sources: - - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-apps/juice-shop + - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-targets/juice-shop - https://github.com/bkimminich/juice-shop maintainers: - name: iteratec GmbH diff --git a/demo-apps/juice-shop/README.md b/demo-targets/juice-shop/README.md similarity index 98% rename from demo-apps/juice-shop/README.md rename to demo-targets/juice-shop/README.md index b9caa98c32..60a1bd262f 100644 --- a/demo-apps/juice-shop/README.md +++ b/demo-targets/juice-shop/README.md @@ -14,7 +14,7 @@ OWASP Juice Shop: Probably the most modern and sophisticated insecure web applic ## Source Code -* +* * ## Chart Configuration diff --git a/demo-apps/juice-shop/README.md.gotmpl b/demo-targets/juice-shop/README.md.gotmpl similarity index 97% rename from demo-apps/juice-shop/README.md.gotmpl rename to demo-targets/juice-shop/README.md.gotmpl index 1b1d3102e4..5eff5b75ab 100644 --- a/demo-apps/juice-shop/README.md.gotmpl +++ b/demo-targets/juice-shop/README.md.gotmpl @@ -19,7 +19,7 @@ OWASP Juice Shop: Probably the most modern and sophisticated insecure web applic ## Source Code -* +* * ## Chart Configuration diff --git a/demo-apps/juice-shop/questions.yml b/demo-targets/juice-shop/questions.yml similarity index 100% rename from demo-apps/juice-shop/questions.yml rename to demo-targets/juice-shop/questions.yml diff --git a/demo-apps/juice-shop/templates/NOTES.txt b/demo-targets/juice-shop/templates/NOTES.txt similarity index 100% rename from demo-apps/juice-shop/templates/NOTES.txt rename to demo-targets/juice-shop/templates/NOTES.txt diff --git a/demo-apps/juice-shop/templates/_helpers.tpl b/demo-targets/juice-shop/templates/_helpers.tpl similarity index 100% rename from demo-apps/juice-shop/templates/_helpers.tpl rename to demo-targets/juice-shop/templates/_helpers.tpl diff --git a/demo-apps/juice-shop/templates/deployment.yaml b/demo-targets/juice-shop/templates/deployment.yaml similarity index 100% rename from demo-apps/juice-shop/templates/deployment.yaml rename to demo-targets/juice-shop/templates/deployment.yaml diff --git a/demo-apps/juice-shop/templates/ingress.yaml b/demo-targets/juice-shop/templates/ingress.yaml similarity index 100% rename from demo-apps/juice-shop/templates/ingress.yaml rename to demo-targets/juice-shop/templates/ingress.yaml diff --git a/demo-apps/juice-shop/templates/service.yaml b/demo-targets/juice-shop/templates/service.yaml similarity index 100% rename from demo-apps/juice-shop/templates/service.yaml rename to demo-targets/juice-shop/templates/service.yaml diff --git a/demo-apps/juice-shop/templates/tests/test-connection.yaml b/demo-targets/juice-shop/templates/tests/test-connection.yaml similarity index 100% rename from demo-apps/juice-shop/templates/tests/test-connection.yaml rename to demo-targets/juice-shop/templates/tests/test-connection.yaml diff --git a/demo-apps/juice-shop/values.yaml b/demo-targets/juice-shop/values.yaml similarity index 100% rename from demo-apps/juice-shop/values.yaml rename to demo-targets/juice-shop/values.yaml diff --git a/demo-apps/old-wordpress/.helmignore b/demo-targets/old-wordpress/.helmignore similarity index 100% rename from demo-apps/old-wordpress/.helmignore rename to demo-targets/old-wordpress/.helmignore diff --git a/demo-apps/old-wordpress/Chart.yaml b/demo-targets/old-wordpress/Chart.yaml similarity index 95% rename from demo-apps/old-wordpress/Chart.yaml rename to demo-targets/old-wordpress/Chart.yaml index ddfe70e6e8..78a1d0d7ca 100644 --- a/demo-apps/old-wordpress/Chart.yaml +++ b/demo-targets/old-wordpress/Chart.yaml @@ -14,7 +14,7 @@ keywords: - vulnerable - wordpress sources: - - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-apps/old-wordpress + - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-targets/old-wordpress maintainers: - name: iteratec GmbH email: securecodebox@iteratec.com diff --git a/demo-apps/old-wordpress/README.md b/demo-targets/old-wordpress/README.md similarity index 98% rename from demo-apps/old-wordpress/README.md rename to demo-targets/old-wordpress/README.md index 32bdab2f2d..9bdb919ad4 100644 --- a/demo-apps/old-wordpress/README.md +++ b/demo-targets/old-wordpress/README.md @@ -14,7 +14,7 @@ Insecure & Outdated WordPress Instance: Never expose it to the internet! ## Source Code -* +* ## Chart Configuration diff --git a/demo-apps/old-wordpress/README.md.gotmpl b/demo-targets/old-wordpress/README.md.gotmpl similarity index 96% rename from demo-apps/old-wordpress/README.md.gotmpl rename to demo-targets/old-wordpress/README.md.gotmpl index 8374324c4f..4734d9ed1e 100644 --- a/demo-apps/old-wordpress/README.md.gotmpl +++ b/demo-targets/old-wordpress/README.md.gotmpl @@ -19,7 +19,7 @@ Insecure & Outdated WordPress Instance: Never expose it to the internet! ## Source Code -* +* ## Chart Configuration diff --git a/demo-apps/old-wordpress/questions.yml b/demo-targets/old-wordpress/questions.yml similarity index 100% rename from demo-apps/old-wordpress/questions.yml rename to demo-targets/old-wordpress/questions.yml diff --git a/demo-apps/old-wordpress/templates/NOTES.txt b/demo-targets/old-wordpress/templates/NOTES.txt similarity index 100% rename from demo-apps/old-wordpress/templates/NOTES.txt rename to demo-targets/old-wordpress/templates/NOTES.txt diff --git a/demo-apps/old-wordpress/templates/_helpers.tpl b/demo-targets/old-wordpress/templates/_helpers.tpl similarity index 100% rename from demo-apps/old-wordpress/templates/_helpers.tpl rename to demo-targets/old-wordpress/templates/_helpers.tpl diff --git a/demo-apps/old-wordpress/templates/deployment.yaml b/demo-targets/old-wordpress/templates/deployment.yaml similarity index 100% rename from demo-apps/old-wordpress/templates/deployment.yaml rename to demo-targets/old-wordpress/templates/deployment.yaml diff --git a/demo-apps/old-wordpress/templates/service.yaml b/demo-targets/old-wordpress/templates/service.yaml similarity index 100% rename from demo-apps/old-wordpress/templates/service.yaml rename to demo-targets/old-wordpress/templates/service.yaml diff --git a/demo-apps/old-wordpress/templates/tests/test-connection.yaml b/demo-targets/old-wordpress/templates/tests/test-connection.yaml similarity index 100% rename from demo-apps/old-wordpress/templates/tests/test-connection.yaml rename to demo-targets/old-wordpress/templates/tests/test-connection.yaml diff --git a/demo-apps/old-wordpress/values.yaml b/demo-targets/old-wordpress/values.yaml similarity index 100% rename from demo-apps/old-wordpress/values.yaml rename to demo-targets/old-wordpress/values.yaml diff --git a/demo-apps/swagger-petstore/.helmignore b/demo-targets/swagger-petstore/.helmignore similarity index 100% rename from demo-apps/swagger-petstore/.helmignore rename to demo-targets/swagger-petstore/.helmignore diff --git a/demo-apps/swagger-petstore/Chart.yaml b/demo-targets/swagger-petstore/Chart.yaml similarity index 95% rename from demo-apps/swagger-petstore/Chart.yaml rename to demo-targets/swagger-petstore/Chart.yaml index e58d79f585..addcd08fb4 100644 --- a/demo-apps/swagger-petstore/Chart.yaml +++ b/demo-targets/swagger-petstore/Chart.yaml @@ -14,7 +14,7 @@ keywords: - swagger - openapi sources: - - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-apps/swagger-petstore + - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-targets/swagger-petstore - https://github.com/swagger-api/swagger-petstore maintainers: - name: iteratec GmbH diff --git a/demo-apps/swagger-petstore/README.md b/demo-targets/swagger-petstore/README.md similarity index 97% rename from demo-apps/swagger-petstore/README.md rename to demo-targets/swagger-petstore/README.md index c75ac9ea36..792a5c1a1a 100644 --- a/demo-apps/swagger-petstore/README.md +++ b/demo-targets/swagger-petstore/README.md @@ -14,7 +14,7 @@ This is the sample petstore application with a restful API. ## Source Code -* +* * ## Chart Configuration @@ -42,5 +42,5 @@ This is the sample petstore application with a restful API. | securityContext | object | `{}` | | | service.port | int | `80` | | | service.type | string | `"ClusterIP"` | | -| swaggerHostOverride | string | `"http://swagger-petstore.demo-apps.svc"` | | +| swaggerHostOverride | string | `"http://swagger-petstore.demo-targets.svc"` | | | tolerations | list | `[]` | | diff --git a/demo-apps/swagger-petstore/README.md.gotmpl b/demo-targets/swagger-petstore/README.md.gotmpl similarity index 96% rename from demo-apps/swagger-petstore/README.md.gotmpl rename to demo-targets/swagger-petstore/README.md.gotmpl index aedacbb035..48f0074d63 100644 --- a/demo-apps/swagger-petstore/README.md.gotmpl +++ b/demo-targets/swagger-petstore/README.md.gotmpl @@ -19,7 +19,7 @@ This is the sample petstore application with a restful API. ## Source Code -* +* * ## Chart Configuration diff --git a/demo-apps/swagger-petstore/questions.yml b/demo-targets/swagger-petstore/questions.yml similarity index 100% rename from demo-apps/swagger-petstore/questions.yml rename to demo-targets/swagger-petstore/questions.yml diff --git a/demo-apps/swagger-petstore/templates/NOTES.txt b/demo-targets/swagger-petstore/templates/NOTES.txt similarity index 100% rename from demo-apps/swagger-petstore/templates/NOTES.txt rename to demo-targets/swagger-petstore/templates/NOTES.txt diff --git a/demo-apps/swagger-petstore/templates/_helpers.tpl b/demo-targets/swagger-petstore/templates/_helpers.tpl similarity index 100% rename from demo-apps/swagger-petstore/templates/_helpers.tpl rename to demo-targets/swagger-petstore/templates/_helpers.tpl diff --git a/demo-apps/swagger-petstore/templates/deployment.yaml b/demo-targets/swagger-petstore/templates/deployment.yaml similarity index 100% rename from demo-apps/swagger-petstore/templates/deployment.yaml rename to demo-targets/swagger-petstore/templates/deployment.yaml diff --git a/demo-apps/swagger-petstore/templates/ingress.yaml b/demo-targets/swagger-petstore/templates/ingress.yaml similarity index 100% rename from demo-apps/swagger-petstore/templates/ingress.yaml rename to demo-targets/swagger-petstore/templates/ingress.yaml diff --git a/demo-apps/swagger-petstore/templates/service.yaml b/demo-targets/swagger-petstore/templates/service.yaml similarity index 100% rename from demo-apps/swagger-petstore/templates/service.yaml rename to demo-targets/swagger-petstore/templates/service.yaml diff --git a/demo-apps/swagger-petstore/templates/tests/test-connection.yaml b/demo-targets/swagger-petstore/templates/tests/test-connection.yaml similarity index 100% rename from demo-apps/swagger-petstore/templates/tests/test-connection.yaml rename to demo-targets/swagger-petstore/templates/tests/test-connection.yaml diff --git a/demo-apps/swagger-petstore/values.yaml b/demo-targets/swagger-petstore/values.yaml similarity index 96% rename from demo-apps/swagger-petstore/values.yaml rename to demo-targets/swagger-petstore/values.yaml index 8cf18f3bca..d651c5fc52 100644 --- a/demo-apps/swagger-petstore/values.yaml +++ b/demo-targets/swagger-petstore/values.yaml @@ -18,7 +18,7 @@ image: # If you want to expose the petstore under a url different to the default service name address use the override to specify a the full host with protocol #swaggerHostOverride: "https://petstore.example.com" -swaggerHostOverride: "http://swagger-petstore.demo-apps.svc" +swaggerHostOverride: "http://swagger-petstore.demo-targets.svc" imagePullSecrets: [] nameOverride: "" diff --git a/demo-apps/unsafe-https/.helmignore b/demo-targets/unsafe-https/.helmignore similarity index 100% rename from demo-apps/unsafe-https/.helmignore rename to demo-targets/unsafe-https/.helmignore diff --git a/demo-apps/unsafe-https/Chart.yaml b/demo-targets/unsafe-https/Chart.yaml similarity index 95% rename from demo-apps/unsafe-https/Chart.yaml rename to demo-targets/unsafe-https/Chart.yaml index 6682892cfa..766b90761e 100644 --- a/demo-apps/unsafe-https/Chart.yaml +++ b/demo-targets/unsafe-https/Chart.yaml @@ -14,7 +14,7 @@ keywords: - unsafe - https sources: - - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-apps/unsafe-https + - https://github.com/secureCodeBox/secureCodeBox/tree/master/demo-targets/unsafe-https maintainers: - name: iteratec GmbH email: securecodebox@iteratec.com diff --git a/demo-apps/unsafe-https/README.md b/demo-targets/unsafe-https/README.md similarity index 98% rename from demo-apps/unsafe-https/README.md rename to demo-targets/unsafe-https/README.md index 56baf2dc13..d258e5785d 100644 --- a/demo-apps/unsafe-https/README.md +++ b/demo-targets/unsafe-https/README.md @@ -16,7 +16,7 @@ which contains both private and public key and is not authorized by a third part ## Source Code -* +* ## Chart Configuration diff --git a/demo-apps/unsafe-https/README.md.gotmpl b/demo-targets/unsafe-https/README.md.gotmpl similarity index 97% rename from demo-apps/unsafe-https/README.md.gotmpl rename to demo-targets/unsafe-https/README.md.gotmpl index 66dd557940..8b6e26bee7 100644 --- a/demo-apps/unsafe-https/README.md.gotmpl +++ b/demo-targets/unsafe-https/README.md.gotmpl @@ -21,7 +21,7 @@ which contains both private and public key and is not authorized by a third part ## Source Code -* +* ## Chart Configuration diff --git a/demo-apps/unsafe-https/questions.yml b/demo-targets/unsafe-https/questions.yml similarity index 100% rename from demo-apps/unsafe-https/questions.yml rename to demo-targets/unsafe-https/questions.yml diff --git a/demo-apps/unsafe-https/templates/NOTES.txt b/demo-targets/unsafe-https/templates/NOTES.txt similarity index 100% rename from demo-apps/unsafe-https/templates/NOTES.txt rename to demo-targets/unsafe-https/templates/NOTES.txt diff --git a/demo-apps/unsafe-https/templates/_helpers.tpl b/demo-targets/unsafe-https/templates/_helpers.tpl similarity index 100% rename from demo-apps/unsafe-https/templates/_helpers.tpl rename to demo-targets/unsafe-https/templates/_helpers.tpl diff --git a/demo-apps/unsafe-https/templates/deployment.yaml b/demo-targets/unsafe-https/templates/deployment.yaml similarity index 100% rename from demo-apps/unsafe-https/templates/deployment.yaml rename to demo-targets/unsafe-https/templates/deployment.yaml diff --git a/demo-apps/unsafe-https/templates/service.yaml b/demo-targets/unsafe-https/templates/service.yaml similarity index 100% rename from demo-apps/unsafe-https/templates/service.yaml rename to demo-targets/unsafe-https/templates/service.yaml diff --git a/demo-apps/unsafe-https/values.yaml b/demo-targets/unsafe-https/values.yaml similarity index 100% rename from demo-apps/unsafe-https/values.yaml rename to demo-targets/unsafe-https/values.yaml diff --git a/hooks/persistence-defectdojo/README.md b/hooks/persistence-defectdojo/README.md index d61b22903c..02ff03c6e3 100644 --- a/hooks/persistence-defectdojo/README.md +++ b/hooks/persistence-defectdojo/README.md @@ -78,7 +78,7 @@ spec: scanType: "zap-full-scan" parameters: - "-t" - - "http://juice-shop.demo-apps.svc:3000" + - "http://juice-shop.demo-targets.svc:3000" ``` ### Complete Example Scan @@ -110,7 +110,7 @@ spec: scanType: "zap-full-scan" parameters: - "-t" - - "http://juice-shop.demo-apps.svc:3000" + - "http://juice-shop.demo-targets.svc:3000" ``` ## Deployment diff --git a/hooks/persistence-defectdojo/README.md.gotmpl b/hooks/persistence-defectdojo/README.md.gotmpl index 5950110dde..800f2ba0f6 100644 --- a/hooks/persistence-defectdojo/README.md.gotmpl +++ b/hooks/persistence-defectdojo/README.md.gotmpl @@ -83,7 +83,7 @@ spec: scanType: "zap-full-scan" parameters: - "-t" - - "http://juice-shop.demo-apps.svc:3000" + - "http://juice-shop.demo-targets.svc:3000" ``` ### Complete Example Scan @@ -115,7 +115,7 @@ spec: scanType: "zap-full-scan" parameters: - "-t" - - "http://juice-shop.demo-apps.svc:3000" + - "http://juice-shop.demo-targets.svc:3000" ``` ## Deployment diff --git a/hooks/persistence-defectdojo/src/test/java/io/securecodebox/persistence/strategies/VersionedEngagementsStrategyTest.java b/hooks/persistence-defectdojo/src/test/java/io/securecodebox/persistence/strategies/VersionedEngagementsStrategyTest.java index 1299ca9278..446920f442 100644 --- a/hooks/persistence-defectdojo/src/test/java/io/securecodebox/persistence/strategies/VersionedEngagementsStrategyTest.java +++ b/hooks/persistence-defectdojo/src/test/java/io/securecodebox/persistence/strategies/VersionedEngagementsStrategyTest.java @@ -64,7 +64,7 @@ public void setup() throws Exception { scan.getMetadata().setNamespace("default"); scan.setSpec(new V1ScanSpec()); scan.getSpec().setScanType("zap-baseline-scan"); - scan.getSpec().setParameters(List.of("-t","http://juice-shop.demo-apps.svc:3000", "-j")); + scan.getSpec().setParameters(List.of("-t","http://juice-shop.demo-targets.svc:3000", "-j")); scan.setStatus(new V1ScanStatus()); } diff --git a/hooks/teams-webhook/hook.test.js b/hooks/teams-webhook/hook.test.js index 703f1b4a3b..f85942d144 100644 --- a/hooks/teams-webhook/hook.test.js +++ b/hooks/teams-webhook/hook.test.js @@ -59,9 +59,9 @@ const findings = [ severity: "INFORMATIONAL", reference: {}, hint: "", - location: "dummy-ssh.demo-apps.svc", + location: "dummy-ssh.demo-targets.svc", attributes: { - hostname: "dummy-ssh.demo-apps.svc", + hostname: "dummy-ssh.demo-targets.svc", ip_address: "10.102.131.102", server_banner: "SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8", ssh_version: 2, @@ -112,9 +112,9 @@ const findings = [ severity: "MEDIUM", reference: {}, hint: "Remove these key exchange algorithms: diffie-hellman-group14-sha1", - location: "dummy-ssh.demo-apps.svc", + location: "dummy-ssh.demo-targets.svc", attributes: { - hostname: "dummy-ssh.demo-apps.svc", + hostname: "dummy-ssh.demo-targets.svc", ip_address: "10.102.131.102", payload: ["diffie-hellman-group14-sha1"], }, @@ -129,9 +129,9 @@ const findings = [ reference: {}, hint: "Remove these MAC algorithms: umac-64-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, hmac-sha1", - location: "dummy-ssh.demo-apps.svc", + location: "dummy-ssh.demo-targets.svc", attributes: { - hostname: "dummy-ssh.demo-apps.svc", + hostname: "dummy-ssh.demo-targets.svc", ip_address: "10.102.131.102", payload: [ "umac-64-etm@openssh.com", @@ -150,9 +150,9 @@ const findings = [ severity: "MEDIUM", reference: {}, hint: "Remove these authentication methods: password", - location: "dummy-ssh.demo-apps.svc", + location: "dummy-ssh.demo-targets.svc", attributes: { - hostname: "dummy-ssh.demo-apps.svc", + hostname: "dummy-ssh.demo-targets.svc", ip_address: "10.102.131.102", payload: ["password"], }, diff --git a/scanners/ncrack/examples/dummy-ssh/README.md b/scanners/ncrack/examples/dummy-ssh/README.md index dce10a668d..933848b301 100644 --- a/scanners/ncrack/examples/dummy-ssh/README.md +++ b/scanners/ncrack/examples/dummy-ssh/README.md @@ -19,7 +19,7 @@ printf "THEPASSWORDYOUCREATED\n123456\npassword\n" > passwords.txt kubectl create secret generic --from-file users.txt --from-file passwords.txt ncrack-lists # Install dummy-ssh app. We'll use ncrack to enumerate its ssh username and password -helm install dummy-ssh ./demo-apps/dummy-ssh/ --wait +helm install dummy-ssh ./demo-targets/dummy-ssh/ --wait # Install the ncrack scanType and set mount the files from the ncrack-lists Kubernetes secret cat < - - + + @@ -16,8 +16,8 @@ SPDX-License-Identifier: Apache-2.0
- - + + diff --git a/scanners/nmap/examples/demo-app-ssh/scan.yaml b/scanners/nmap/examples/demo-app-ssh/scan.yaml index 9383e35f08..e747fb28d9 100644 --- a/scanners/nmap/examples/demo-app-ssh/scan.yaml +++ b/scanners/nmap/examples/demo-app-ssh/scan.yaml @@ -14,4 +14,4 @@ spec: # Service Detection enabled - "-sV" # Actual Service Address will depend on you cluster and namespace configuration. 🤷‍ - - "dummy-ssh.demo-apps.svc" + - "dummy-ssh.demo-targets.svc" diff --git a/scanners/nmap/examples/demo-juice-shop/findings.yaml b/scanners/nmap/examples/demo-juice-shop/findings.yaml index 16f2de84ac..82fe8bfb44 100644 --- a/scanners/nmap/examples/demo-juice-shop/findings.yaml +++ b/scanners/nmap/examples/demo-juice-shop/findings.yaml @@ -16,7 +16,7 @@ "ip_address": "10.111.199.4", "mac_address": null, "protocol": "tcp", - "hostname": "juice-shop.demo-apps.svc.cluster.local", + "hostname": "juice-shop.demo-targets.svc.cluster.local", "method": "probed", "operating_system": null, "service": "http", @@ -27,17 +27,17 @@ "id": "a9ec9f11-4cfa-461b-85c0-57ea31162112" }, { - "name": "Host: juice-shop.demo-apps.svc.cluster.local", + "name": "Host: juice-shop.demo-targets.svc.cluster.local", "category": "Host", "description": "Found a host", - "location": "juice-shop.demo-apps.svc.cluster.local", + "location": "juice-shop.demo-targets.svc.cluster.local", "severity": "INFORMATIONAL", "osi_layer": "NETWORK", "attributes": { "ip_address": "10.111.199.4", - "hostname": "juice-shop.demo-apps.svc.cluster.local", + "hostname": "juice-shop.demo-targets.svc.cluster.local", "operating_system": null }, "id": "080d888a-a9bc-4c74-8d03-c4c6cc40238d" } -] \ No newline at end of file +] diff --git a/scanners/nmap/examples/demo-juice-shop/nmap-results.xml b/scanners/nmap/examples/demo-juice-shop/nmap-results.xml index 2aa0d4fc67..3606cd42f1 100644 --- a/scanners/nmap/examples/demo-juice-shop/nmap-results.xml +++ b/scanners/nmap/examples/demo-juice-shop/nmap-results.xml @@ -7,8 +7,8 @@ SPDX-License-Identifier: Apache-2.0 - - + + @@ -16,8 +16,8 @@ SPDX-License-Identifier: Apache-2.0
- - + + diff --git a/scanners/nmap/examples/demo-juice-shop/scan.yaml b/scanners/nmap/examples/demo-juice-shop/scan.yaml index 28137626e7..b0ef42c93e 100644 --- a/scanners/nmap/examples/demo-juice-shop/scan.yaml +++ b/scanners/nmap/examples/demo-juice-shop/scan.yaml @@ -14,4 +14,4 @@ spec: # Service Detection enabled - "-sV" # Actual Service Address will depend on you cluster and namespace configuration. 🤷‍ - - juice-shop.demo-apps.svc.cluster.local + - juice-shop.demo-targets.svc.cluster.local diff --git a/scanners/nmap/examples/dummy-ssh-cascade/scan.yaml b/scanners/nmap/examples/dummy-ssh-cascade/scan.yaml index bcc2e71817..3028f9ca9a 100644 --- a/scanners/nmap/examples/dummy-ssh-cascade/scan.yaml +++ b/scanners/nmap/examples/dummy-ssh-cascade/scan.yaml @@ -14,9 +14,8 @@ spec: # Service Detection enabled - "-sV" # Actual Service Address will depend on you cluster and namespace configuration. 🤷‍ - - "dummy-ssh.demo-apps.svc" + - "dummy-ssh.demo-targets.svc" cascades: matchLabels: securecodebox.io/invasive: invasive securecodebox.io/intensive: high - \ No newline at end of file diff --git a/scanners/ssh-scan/examples/demo-app-ssh/findings.yaml b/scanners/ssh-scan/examples/demo-app-ssh/findings.yaml index 7186e09149..3e88f275a1 100644 --- a/scanners/ssh-scan/examples/demo-app-ssh/findings.yaml +++ b/scanners/ssh-scan/examples/demo-app-ssh/findings.yaml @@ -11,9 +11,9 @@ "severity": "INFORMATIONAL", "reference": {}, "hint": "", - "location": "dummy-ssh.demo-apps.svc", + "location": "dummy-ssh.demo-targets.svc", "attributes": { - "hostname": "dummy-ssh.demo-apps.svc", + "hostname": "dummy-ssh.demo-targets.svc", "ip_address": "10.102.131.102", "server_banner": "SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8", "ssh_version": 2, @@ -72,9 +72,9 @@ "severity": "MEDIUM", "reference": {}, "hint": "Remove these key exchange algorithms: diffie-hellman-group14-sha1", - "location": "dummy-ssh.demo-apps.svc", + "location": "dummy-ssh.demo-targets.svc", "attributes": { - "hostname": "dummy-ssh.demo-apps.svc", + "hostname": "dummy-ssh.demo-targets.svc", "ip_address": "10.102.131.102", "payload": [ "diffie-hellman-group14-sha1" @@ -90,9 +90,9 @@ "severity": "MEDIUM", "reference": {}, "hint": "Remove these MAC algorithms: umac-64-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, hmac-sha1", - "location": "dummy-ssh.demo-apps.svc", + "location": "dummy-ssh.demo-targets.svc", "attributes": { - "hostname": "dummy-ssh.demo-apps.svc", + "hostname": "dummy-ssh.demo-targets.svc", "ip_address": "10.102.131.102", "payload": [ "umac-64-etm@openssh.com", @@ -111,9 +111,9 @@ "severity": "MEDIUM", "reference": {}, "hint": "Remove these authentication methods: password", - "location": "dummy-ssh.demo-apps.svc", + "location": "dummy-ssh.demo-targets.svc", "attributes": { - "hostname": "dummy-ssh.demo-apps.svc", + "hostname": "dummy-ssh.demo-targets.svc", "ip_address": "10.102.131.102", "payload": [ "password" @@ -121,4 +121,4 @@ }, "id": "4485916d-3747-4c16-a730-a9b1146dd9a2" } -] \ No newline at end of file +] diff --git a/scanners/ssh-scan/examples/demo-app-ssh/scan.yaml b/scanners/ssh-scan/examples/demo-app-ssh/scan.yaml index 3679c0cded..a41fb4a1a7 100644 --- a/scanners/ssh-scan/examples/demo-app-ssh/scan.yaml +++ b/scanners/ssh-scan/examples/demo-app-ssh/scan.yaml @@ -10,4 +10,4 @@ spec: scanType: "ssh-scan" parameters: - "-t" - - "dummy-ssh.demo-apps.svc" + - "dummy-ssh.demo-targets.svc" diff --git a/scanners/ssh-scan/examples/demo-app-ssh/ssh-scan-results.json b/scanners/ssh-scan/examples/demo-app-ssh/ssh-scan-results.json index 32c90287de..3b08c2b700 100644 --- a/scanners/ssh-scan/examples/demo-app-ssh/ssh-scan-results.json +++ b/scanners/ssh-scan/examples/demo-app-ssh/ssh-scan-results.json @@ -2,7 +2,7 @@ { "ssh_scan_version": "0.0.43", "ip": "10.102.131.102", - "hostname": "dummy-ssh.demo-apps.svc", + "hostname": "dummy-ssh.demo-targets.svc", "port": 22, "server_banner": "SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8", "ssh_version": 2.0, diff --git a/scanners/wpscan/examples/old-wordpress/README.md b/scanners/wpscan/examples/old-wordpress/README.md index 7be3208815..0064a02fd2 100644 --- a/scanners/wpscan/examples/old-wordpress/README.md +++ b/scanners/wpscan/examples/old-wordpress/README.md @@ -6,6 +6,6 @@ SPDX-License-Identifier: Apache-2.0 :::note This example scan uses a demo wordpress 4.0 instance. -You can deploy it as a demo target into you cluster. The scan assumes that it is installed in the `demo-apps` namespace. +You can deploy it as a demo target into you cluster. The scan assumes that it is installed in the `demo-targets` namespace. See the [installation guide](/docs/getting-started/installation#install-some-demo-targets). ::: diff --git a/scanners/wpscan/examples/old-wordpress/findings.yaml b/scanners/wpscan/examples/old-wordpress/findings.yaml index 30775b3857..fcb8f21367 100644 --- a/scanners/wpscan/examples/old-wordpress/findings.yaml +++ b/scanners/wpscan/examples/old-wordpress/findings.yaml @@ -7,7 +7,7 @@ "name": "WordPress Service", "description": "WordPress Service Information", "category": "WordPress Service", - "location": "http://old-wordpress.demo-apps.svc.cluster.local/", + "location": "http://old-wordpress.demo-targets.svc.cluster.local/", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "reference": {}, @@ -20,14 +20,14 @@ "wp_release_date": "2020-06-10", "wp_release_status": "latest", "wp_interesting_entries": [ - "http://old-wordpress.demo-apps.svc.cluster.local/, Match: 'WordPress 4.0.31'" + "http://old-wordpress.demo-targets.svc.cluster.local/, Match: 'WordPress 4.0.31'" ], "wp_found_by": "Meta Generator (Passive Detection)", "wp_confirmed_by": { "Atom Generator (Aggressive Detection)": { "confidence": 80, "interesting_entries": [ - "http://old-wordpress.demo-apps.svc.cluster.local/?feed=atom, WordPress" + "http://old-wordpress.demo-targets.svc.cluster.local/?feed=atom, WordPress" ] } }, @@ -39,7 +39,7 @@ "name": "WordPress finding 'headers'", "description": "Headers", "category": "WordPress headers", - "location": "http://old-wordpress.demo-apps.svc.cluster.local/", + "location": "http://old-wordpress.demo-targets.svc.cluster.local/", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "confidence": 100, @@ -56,9 +56,9 @@ }, { "name": "WordPress finding 'xmlrpc'", - "description": "XML-RPC seems to be enabled: http://old-wordpress.demo-apps.svc.cluster.local/xmlrpc.php", + "description": "XML-RPC seems to be enabled: http://old-wordpress.demo-targets.svc.cluster.local/xmlrpc.php", "category": "WordPress xmlrpc", - "location": "http://old-wordpress.demo-apps.svc.cluster.local/xmlrpc.php", + "location": "http://old-wordpress.demo-targets.svc.cluster.local/xmlrpc.php", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "confidence": 100, @@ -72,9 +72,9 @@ }, { "name": "WordPress finding 'readme'", - "description": "WordPress readme found: http://old-wordpress.demo-apps.svc.cluster.local/readme.html", + "description": "WordPress readme found: http://old-wordpress.demo-targets.svc.cluster.local/readme.html", "category": "WordPress readme", - "location": "http://old-wordpress.demo-apps.svc.cluster.local/readme.html", + "location": "http://old-wordpress.demo-targets.svc.cluster.local/readme.html", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "confidence": 100, @@ -88,9 +88,9 @@ }, { "name": "WordPress finding 'wp_cron'", - "description": "The external WP-Cron seems to be enabled: http://old-wordpress.demo-apps.svc.cluster.local/wp-cron.php", + "description": "The external WP-Cron seems to be enabled: http://old-wordpress.demo-targets.svc.cluster.local/wp-cron.php", "category": "WordPress wp_cron", - "location": "http://old-wordpress.demo-apps.svc.cluster.local/wp-cron.php", + "location": "http://old-wordpress.demo-targets.svc.cluster.local/wp-cron.php", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "confidence": 60, diff --git a/scanners/wpscan/examples/old-wordpress/scan.yaml b/scanners/wpscan/examples/old-wordpress/scan.yaml index df4a1c192a..c58fe72593 100644 --- a/scanners/wpscan/examples/old-wordpress/scan.yaml +++ b/scanners/wpscan/examples/old-wordpress/scan.yaml @@ -10,7 +10,7 @@ spec: scanType: "wpscan" parameters: - "--url" - - old-wordpress.demo-apps.svc.cluster.local + - old-wordpress.demo-targets.svc.cluster.local - "-e" - "vp" - "--plugins-detection" diff --git a/scanners/wpscan/examples/old-wordpress/wpscan-results.json b/scanners/wpscan/examples/old-wordpress/wpscan-results.json index c4ac50b6d6..49c5427c23 100644 --- a/scanners/wpscan/examples/old-wordpress/wpscan-results.json +++ b/scanners/wpscan/examples/old-wordpress/wpscan-results.json @@ -12,12 +12,12 @@ }, "start_time": 1600682567, "start_memory": 42774528, - "target_url": "http://old-wordpress.demo-apps.svc.cluster.local/", + "target_url": "http://old-wordpress.demo-targets.svc.cluster.local/", "target_ip": "10.99.82.140", - "effective_url": "http://old-wordpress.demo-apps.svc.cluster.local/", + "effective_url": "http://old-wordpress.demo-targets.svc.cluster.local/", "interesting_findings": [ { - "url": "http://old-wordpress.demo-apps.svc.cluster.local/", + "url": "http://old-wordpress.demo-targets.svc.cluster.local/", "to_s": "Headers", "type": "headers", "found_by": "Headers (Passive Detection)", @@ -34,8 +34,8 @@ ] }, { - "url": "http://old-wordpress.demo-apps.svc.cluster.local/xmlrpc.php", - "to_s": "XML-RPC seems to be enabled: http://old-wordpress.demo-apps.svc.cluster.local/xmlrpc.php", + "url": "http://old-wordpress.demo-targets.svc.cluster.local/xmlrpc.php", + "to_s": "XML-RPC seems to be enabled: http://old-wordpress.demo-targets.svc.cluster.local/xmlrpc.php", "type": "xmlrpc", "found_by": "Direct Access (Aggressive Detection)", "confidence": 100, @@ -58,8 +58,8 @@ ] }, { - "url": "http://old-wordpress.demo-apps.svc.cluster.local/readme.html", - "to_s": "WordPress readme found: http://old-wordpress.demo-apps.svc.cluster.local/readme.html", + "url": "http://old-wordpress.demo-targets.svc.cluster.local/readme.html", + "to_s": "WordPress readme found: http://old-wordpress.demo-targets.svc.cluster.local/readme.html", "type": "readme", "found_by": "Direct Access (Aggressive Detection)", "confidence": 100, @@ -74,8 +74,8 @@ ] }, { - "url": "http://old-wordpress.demo-apps.svc.cluster.local/wp-cron.php", - "to_s": "The external WP-Cron seems to be enabled: http://old-wordpress.demo-apps.svc.cluster.local/wp-cron.php", + "url": "http://old-wordpress.demo-targets.svc.cluster.local/wp-cron.php", + "to_s": "The external WP-Cron seems to be enabled: http://old-wordpress.demo-targets.svc.cluster.local/wp-cron.php", "type": "wp_cron", "found_by": "Direct Access (Aggressive Detection)", "confidence": 60, @@ -100,13 +100,13 @@ "found_by": "Meta Generator (Passive Detection)", "confidence": 100, "interesting_entries": [ - "http://old-wordpress.demo-apps.svc.cluster.local/, Match: 'WordPress 4.0.31'" + "http://old-wordpress.demo-targets.svc.cluster.local/, Match: 'WordPress 4.0.31'" ], "confirmed_by": { "Atom Generator (Aggressive Detection)": { "confidence": 80, "interesting_entries": [ - "http://old-wordpress.demo-apps.svc.cluster.local/?feed=atom, WordPress" + "http://old-wordpress.demo-targets.svc.cluster.local/?feed=atom, WordPress" ] } }, diff --git a/scanners/zap-advanced/README.md b/scanners/zap-advanced/README.md index 6d0169b258..23df89d901 100644 --- a/scanners/zap-advanced/README.md +++ b/scanners/zap-advanced/README.md @@ -113,7 +113,7 @@ If you want to configure the `api` scan, `spider` or active 'scan` section it is ``` ## ZAP Configuration -The following YAMl gives you an overview about all the different configuration options you have to configure the ZAP advanced scan. Please have a look into our `./examples/...` to find some working examples. We provide a list of working examples to scan our `demo-apps` with the `zap-advanced-scan`. +The following YAMl gives you an overview about all the different configuration options you have to configure the ZAP advanced scan. Please have a look into our `./examples/...` to find some working examples. We provide a list of working examples to scan our `demo-targets` with the `zap-advanced-scan`. :::note diff --git a/scanners/zap-advanced/README.md.gotmpl b/scanners/zap-advanced/README.md.gotmpl index 4dc13d83f8..39134f3b26 100644 --- a/scanners/zap-advanced/README.md.gotmpl +++ b/scanners/zap-advanced/README.md.gotmpl @@ -118,7 +118,7 @@ If you want to configure the `api` scan, `spider` or active 'scan` section it is ``` ## ZAP Configuration -The following YAMl gives you an overview about all the different configuration options you have to configure the ZAP advanced scan. Please have a look into our `./examples/...` to find some working examples. We provide a list of working examples to scan our `demo-apps` with the `zap-advanced-scan`. +The following YAMl gives you an overview about all the different configuration options you have to configure the ZAP advanced scan. Please have a look into our `./examples/...` to find some working examples. We provide a list of working examples to scan our `demo-targets` with the `zap-advanced-scan`. :::note diff --git a/scanners/zap-advanced/examples/demo-petstoreapi-scan/zap-advanced-baseline-scan.yaml b/scanners/zap-advanced/examples/demo-petstoreapi-scan/zap-advanced-baseline-scan.yaml index 91c5c8a40e..309d05ad3e 100644 --- a/scanners/zap-advanced/examples/demo-petstoreapi-scan/zap-advanced-baseline-scan.yaml +++ b/scanners/zap-advanced/examples/demo-petstoreapi-scan/zap-advanced-baseline-scan.yaml @@ -33,10 +33,10 @@ data: # Name to be used to refer to this context in other jobs, mandatory - name: scb-petstore-context # The top level url, mandatory, everything under this will be included. IMPORTANT: must be the hostname without any subpath! - url: http://petstore.demo-apps.svc/ + url: http://petstore.demo-targets.svc/ # An optional list of regexes to include includePaths: - - "http://petstore.demo-apps.svc/v2.*" + - "http://petstore.demo-targets.svc/v2.*" # An optional list of regexes to exclude excludePaths: - ".*\\.css" @@ -50,9 +50,9 @@ data: # -- format of the API ('openapi', 'grapql', 'soap') format: openapi # -- Url to start spidering from, default: first context URL - url: http://petstore.demo-apps.svc/v2/swagger.json + url: http://petstore.demo-targets.svc/v2/swagger.json # -- Override host setting in swagger.json - hostOverride: http://petstore.demo-apps.svc + hostOverride: http://petstore.demo-targets.svc # ZAP Spiders Configuration spiders: @@ -60,7 +60,7 @@ data: # String: Name of the context to spider, default: first context context: scb-petstore-context # String: Url to start spidering from, default: first context URL - url: http://petstore.demo-apps.svc/v2/ + url: http://petstore.demo-targets.svc/v2/ # Int: Fail if spider finds less than the specified number of URLs, default: 0 failIfFoundUrlsLessThan: 0 # Int: Warn if spider finds less than the specified number of URLs, default: 0 @@ -112,7 +112,7 @@ spec: parameters: # target URL including the protocol - "-t" - - "http://petstore.demo-apps.svc/" + - "http://petstore.demo-targets.svc/" volumeMounts: - name: zap-advanced-scan-config mountPath: /home/securecodebox/configs/2-zap-advanced-scan.yaml diff --git a/scanners/zap-advanced/examples/demo-petstoreapi-scan/zap-advanced-full-scan.yaml b/scanners/zap-advanced/examples/demo-petstoreapi-scan/zap-advanced-full-scan.yaml index a2c1490dd5..2b68474894 100644 --- a/scanners/zap-advanced/examples/demo-petstoreapi-scan/zap-advanced-full-scan.yaml +++ b/scanners/zap-advanced/examples/demo-petstoreapi-scan/zap-advanced-full-scan.yaml @@ -33,10 +33,10 @@ data: # Name to be used to refer to this context in other jobs, mandatory - name: scb-petstore-context # The top level url, mandatory, everything under this will be included. IMPORTANT: must be the hostname without any subpath! - url: http://petstore.demo-apps.svc/ + url: http://petstore.demo-targets.svc/ # An optional list of regexes to include includePaths: - - "http://petstore.demo-apps.svc/v2.*" + - "http://petstore.demo-targets.svc/v2.*" # An optional list of regexes to exclude excludePaths: - ".*\\.css" @@ -50,9 +50,9 @@ data: # -- format of the API ('openapi', 'grapql', 'soap') format: openapi # -- Url to start spidering from, default: first context URL - url: http://petstore.demo-apps.svc/v2/swagger.json + url: http://petstore.demo-targets.svc/v2/swagger.json # -- Override host setting in swagger.json - hostOverride: http://petstore.demo-apps.svc + hostOverride: http://petstore.demo-targets.svc # ZAP Spiders Configuration spiders: @@ -60,7 +60,7 @@ data: # String: Name of the context to spider, default: first context context: scb-petstore-context # String: Url to start spidering from, default: first context URL - url: http://petstore.demo-apps.svc/v2/ + url: http://petstore.demo-targets.svc/v2/ # Int: Fail if spider finds less than the specified number of URLs, default: 0 failIfFoundUrlsLessThan: 0 # Int: Warn if spider finds less than the specified number of URLs, default: 0 @@ -102,7 +102,7 @@ data: # String: Name of the context to attack, default: first context context: scb-petstore-context # String: Url to start scaning from, default: first context URL - url: http://petstore.demo-apps.svc/v2/ + url: http://petstore.demo-targets.svc/v2/ # String: Name of the scan policy to be used, default: Default Policy policy: "API-Minimal" # Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited @@ -134,7 +134,7 @@ spec: parameters: # target URL including the protocol - "-t" - - "http://petstore.demo-apps.svc/" + - "http://petstore.demo-targets.svc/" volumeMounts: - name: zap-advanced-scan-config mountPath: /home/securecodebox/configs/2-zap-advanced-scan.yaml @@ -143,4 +143,4 @@ spec: volumes: - name: zap-advanced-scan-config configMap: - name: zap-advanced-scan-config \ No newline at end of file + name: zap-advanced-scan-config diff --git a/scanners/zap-advanced/examples/integration-tests/scantype-configMap.yaml b/scanners/zap-advanced/examples/integration-tests/scantype-configMap.yaml index 6d3c69b88d..6283139837 100644 --- a/scanners/zap-advanced/examples/integration-tests/scantype-configMap.yaml +++ b/scanners/zap-advanced/examples/integration-tests/scantype-configMap.yaml @@ -26,10 +26,10 @@ data: contexts: - name: scb-bodgeit-context # The top level url, mandatory, everything under this will be included. IMPORTANT: must be the hostname without any subpath! - url: http://bodgeit.demo-apps.svc:8080/ + url: http://bodgeit.demo-targets.svc:8080/ # An optional list of regexes to include includePaths: - - "http://bodgeit.demo-apps.svc:8080/bodgeit.*" + - "http://bodgeit.demo-targets.svc:8080/bodgeit.*" # An optional list of regexes to exclude excludePaths: - ".*\\.js" @@ -45,7 +45,7 @@ data: type: "form-based" # basic-auth requires no further configuration form-based: - loginUrl: "http://bodgeit.demo-apps.svc:8080/bodgeit/login.jsp" + loginUrl: "http://bodgeit.demo-targets.svc:8080/bodgeit/login.jsp" # must be escaped already to prevent yaml parser colidations 'username={%username%}&password={%password%}'' loginRequestData: "username%3D%7B%25username%25%7D%26password%3D%7B%25password%25%7D" # Indicates if the current Zap User Session is based on a valid authentication (loggedIn) or not (loggedOut) @@ -62,10 +62,10 @@ data: type: "cookieBasedSessionManagement" - name: scb-juiceshop-context # The top level url, mandatory, everything under this will be included - url: http://juiceshop.demo-apps.svc:3000/ + url: http://juiceshop.demo-targets.svc:3000/ # An optional list of regexes to include includePaths: - - "http://juiceshop.demo-apps.svc:3000.*" + - "http://juiceshop.demo-targets.svc:3000.*" # An optional list of regexes to exclude excludePaths: - ".*socket\\.io.*" @@ -85,7 +85,7 @@ data: # json-based requires no further configuration # zapConfiguration.contexts[0].authentication.json-based -- Configure `type: json-based` authentication (more: https://www.zaproxy.org/docs/api/#json-based-authentication). json-based: - loginUrl: "http://juiceshop.demo-apps.svc:3000/rest/user/login" + loginUrl: "http://juiceshop.demo-targets.svc:3000/rest/user/login" # must be escaped already to prevent yaml parser colidations '{"user":{"id":1,"email":"test@test.com"}}'' loginRequestData: '{"email":"admin@juice-sh.op","password":"admin123"}' # Indicates if the current Zap User Session is based on a valid authentication (loggedIn) or not (loggedOut) @@ -111,10 +111,10 @@ data: # description: "This is a JuiceShop specific SessionManagement Script used to handle JWT." - name: scb-petstore-context # The top level url, mandatory, everything under this will be included. IMPORTANT: must be the hostname without any subpath! - url: http://petstore.demo-apps.svc/ + url: http://petstore.demo-targets.svc/ # An optional list of regexes to include includePaths: - - "http://petstore.demo-apps.svc/v2.*" + - "http://petstore.demo-targets.svc/v2.*" # An optional list of regexes to exclude excludePaths: - ".*\\.css" @@ -128,9 +128,9 @@ data: # -- format of the API ('openapi', 'grapql', 'soap') format: openapi # -- Url to start spidering from, default: first context URL - url: http://petstore.demo-apps.svc/v2/swagger.json + url: http://petstore.demo-targets.svc/v2/swagger.json # -- Override host setting in swagger.json - hostOverride: http://petstore.demo-apps.svc + hostOverride: http://petstore.demo-targets.svc # Configures existings ZAP Scripts or add new ZAP Scripts. scripts: - name: "Alert_on_HTTP_Response_Code_Errors.js" @@ -154,7 +154,7 @@ data: # String: Name of the user to authenticate with and used to spider user: bodgeit-user-1 # String: Url to start spidering from, default: first context URL - url: http://bodgeit.demo-apps.svc:8080/bodgeit/ + url: http://bodgeit.demo-targets.svc:8080/bodgeit/ # Int: Fail if spider finds less than the specified number of URLs, default: 0 failIfFoundUrlsLessThan: 0 # Int: Warn if spider finds less than the specified number of URLs, default: 0 @@ -201,7 +201,7 @@ data: # String: Name of the user to authenticate with and used to spider user: juiceshop-user-1 # String: Url to start spidering from, default: first context URL - url: http://juiceshop.demo-apps.svc:3000/ + url: http://juiceshop.demo-targets.svc:3000/ # zapConfiguration.spiders[0].ajax -- Bool: Whether to use the ZAP ajax spider, default: false ajax: true # Int: Fail if spider finds less than the specified number of URLs, default: 0 @@ -216,7 +216,7 @@ data: # String: Name of the context to spider, default: first context context: scb-petstore-context # String: Url to start spidering from, default: first context URL - url: http://petstore.demo-apps.svc/v2/ + url: http://petstore.demo-targets.svc/v2/ # Int: Fail if spider finds less than the specified number of URLs, default: 0 failIfFoundUrlsLessThan: 0 # Int: Warn if spider finds less than the specified number of URLs, default: 0 @@ -266,7 +266,7 @@ data: # String: Name of the user to authenticate with and used to spider user: bodgeit-user-1 # String: Url to start scaning from, default: first context URL - url: http://bodgeit.demo-apps.svc:8080/bodgeit/ + url: http://bodgeit.demo-targets.svc:8080/bodgeit/ # Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited maxRuleDurationInMins: 1 # Int: The max time in minutes the active scanner will be allowed to run for, default: 0 unlimited @@ -289,7 +289,7 @@ data: # String: Name of the user to authenticate with and used to spider user: juiceshop-user-1 # String: Url to start scaning from, default: first context URL - url: http://juiceshop.demo-apps.svc:3000/ + url: http://juiceshop.demo-targets.svc:3000/ # Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited maxRuleDurationInMins: 1 # Int: The max time in minutes the active scanner will be allowed to run for, default: 0 unlimited @@ -310,7 +310,7 @@ data: # String: Name of the context to attack, default: first context context: scb-petstore-context # String: Url to start scaning from, default: first context URL - url: http://petstore.demo-apps.svc/v2/ + url: http://petstore.demo-targets.svc/v2/ # String: Name of the scan policy to be used, default: Default Policy policy: "API-Minimal" # Int: The max time in minutes any individual rule will be allowed to run for, default: 0 unlimited diff --git a/scanners/zap/examples/demo-bodgeit-baseline-scan/findings.yaml b/scanners/zap/examples/demo-bodgeit-baseline-scan/findings.yaml index b7441bcb9f..fef3cc343a 100644 --- a/scanners/zap/examples/demo-bodgeit-baseline-scan/findings.yaml +++ b/scanners/zap/examples/demo-bodgeit-baseline-scan/findings.yaml @@ -7,11 +7,11 @@ "name": "Content Security Policy (CSP) Header Not Set", "description": "Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.", "category": "Content Security Policy (CSP) Header Not Set", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "298", "zap_solution": "Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: \"Content-Security-Policy\" for Chrome 25+, Firefox 23+ and Safari 7+, \"X-Content-Security-Policy\" for Firefox 4.0+ and Internet Explorer 10+, and \"X-WebKit-CSP\" for Chrome 14+ and Safari 6+.", @@ -23,83 +23,83 @@ "zap_pluginid": "10038", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/tagplugin/choose.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/choose.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/valve.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/valve.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/tagfiles/panel.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/tagfiles/panel.jsp.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/loader.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/loader.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/connectors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/connectors.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/simpletag/HelloWorldSimpleTag.java.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/HelloWorldSimpleTag.java.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/apr.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/apr.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/introduction.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/introduction.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/listeners.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/listeners.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample", "method": "POST" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/class-loader-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/class-loader-howto.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/RequestParamExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestParamExample", "method": "POST" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/jspx/textRotate.jspx.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspx/textRotate.jspx.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/helloworld.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/helloworld.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/security-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/security-howto.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/jasper-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/jasper-howto.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/misc/config.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/misc/config.jsp.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-interceptor.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-interceptor.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/index.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/index.html", "method": "GET" } ] @@ -110,11 +110,11 @@ "name": "X-Frame-Options Header Not Set", "description": "X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks.", "category": "X-Frame-Options Header Not Set", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "MEDIUM", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "280", "zap_solution": "Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. ALLOW-FROM allows specific websites to frame the web page in supported web browsers).", @@ -126,102 +126,102 @@ "zap_pluginid": "10020", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/rewrite.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/rewrite.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/mbean-names.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/mbean-names.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/faq.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/faq.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/include/include.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/include/include.jsp.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/automatic-deployment.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/automatic-deployment.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colors.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/tagfiles/hello.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/tagfiles/hello.jsp", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/index.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/index.xhtml", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/cluster-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/cluster-howto.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/echo.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/echo.xhtml", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsptoserv/jts.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsptoserv/jts.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/simpletag/foo.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/simpletag/foo.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/Functions.java.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/Functions.java.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/tagplugin/choose.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/choose.jsp", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/interceptors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/interceptors.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-jndi-realm.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-jndi-realm.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/dates/date.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/dates/date.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/RequestHeaderExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestHeaderExample", "method": "GET", "param": "X-Frame-Options" } @@ -233,11 +233,11 @@ "name": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", "description": "The web/application server is leaking version information via the \"Server\" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.", "category": "Server Leaks Version Information via \"Server\" HTTP Response Header Field", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "3", "zap_count": "337", "zap_solution": "Ensure that your web server, application server, load balancer, etc. is configured to suppress the \"Server\" header or provide generic details.", @@ -249,102 +249,102 @@ "zap_pluginid": "10036", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/filter.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/filter.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/num/numguess.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/num/numguess.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/implicit-objects.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/implicit-objects.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/cal/cal2.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/cal/cal2.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/index.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/index.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/simpletag/hello.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/hello.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/simpletag/book.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/book.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/basic-comparisons.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/basic-comparisons.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/http.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/http.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/developers.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/developers.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/maven-jars.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/maven-jars.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/service.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/service.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/mbeans-descriptors-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/mbeans-descriptors-howto.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/chat.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/chat.xhtml", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/api/org/apache/catalina/Host.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/api/org/apache/catalina/Host.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/snp/snoop.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/snp/snoop.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/functions.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/functions.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/tagplugin/foreach.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/foreach.jsp", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-admin-objects.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-objects.html", "method": "GET", "evidence": "Apache-Coyote/1.1" } @@ -356,11 +356,11 @@ "name": "Timestamp Disclosure - Unix", "description": "A timestamp was disclosed by the application/web server - Unix", "category": "Timestamp Disclosure - Unix", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "1", "zap_count": "51", "zap_solution": "Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.", @@ -372,102 +372,102 @@ "zap_pluginid": "10096", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000039" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000008" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000014963" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000018373" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/snp/snoop.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/snp/snoop.jsp", "method": "GET", "evidence": "20100101" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000018" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000005503" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000026" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000015294" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000016347" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000002280" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000043589" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000015448" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000007734" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000010013" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/manager-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/manager-howto.html", "method": "GET", "evidence": "46800300" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000005214" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000043442" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000005368" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000301" } @@ -479,11 +479,11 @@ "name": "Reverse Tabnabbing", "description": "At least one link on this page is vulnerable to Reverse tabnabbing as it uses a target attribute without using both of the \"noopener\" and \"noreferrer\" keywords in the \"rel\" attribute, which allows the target page to take control of this page.", "category": "Reverse Tabnabbing", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "MEDIUM", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "102", "zap_solution": "Do not use a target attribute, or if you have to then also add the attribute: rel=\"noopener noreferrer\".", @@ -495,102 +495,102 @@ "zap_pluginid": "10108", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/class-loader-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/class-loader-howto.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/virtual-hosting-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/virtual-hosting-howto.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-valve.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-valve.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/windows-service-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/windows-service-howto.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-manager.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-manager.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/apr.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/apr.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/connectors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/connectors.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/security-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/security-howto.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-channel.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-channel.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/jasper-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/jasper-howto.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/transport.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/transport.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/status.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/status.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/processes.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/processes.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/realm.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/realm.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/index.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/index.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/building.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/building.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/introduction.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/introduction.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/systemprops.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/systemprops.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/membership.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/membership.html", "method": "GET", "evidence": "\"The" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-deployer.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-deployer.html", "method": "GET", "evidence": "\"The" } @@ -602,11 +602,11 @@ "name": "X-Content-Type-Options Header Missing", "description": "The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.", "category": "X-Content-Type-Options Header Missing", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "316", "zap_solution": "Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.", @@ -618,102 +618,102 @@ "zap_pluginid": "10021", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsptoserv/jts.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsptoserv/jts.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/automatic-deployment.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/automatic-deployment.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/mbean-names.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/mbean-names.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/include/include.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/include/include.jsp.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/rewrite.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/rewrite.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/basic-arithmetic.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/basic-arithmetic.jsp", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/tomcat.png", + "uri": "http://bodgeit.demo-targets.svc:8080/tomcat.png", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colors.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/images/asf-feather.png", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/images/asf-feather.png", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-admin-apps.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-apps.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/introduction.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/introduction.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/faq.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/faq.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/servletapi/index.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/servletapi/index.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/misc/dynamicattrs.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/misc/dynamicattrs.jsp.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/building.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/building.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/images/code.gif", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/images/code.gif", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-receiver.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-receiver.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/deployer-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/deployer-howto.html", "method": "GET", "param": "X-Content-Type-Options" } @@ -725,11 +725,11 @@ "name": "Absence of Anti-CSRF Tokens", "description": "No Anti-CSRF tokens were found in a HTML submission form.A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.CSRF attacks are effective in a number of situations, including: * The victim has an active session on the target site. * The victim is authenticated via HTTP auth on the target site. * The victim is on the same local network as the target site.CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.", "category": "Absence of Anti-CSRF Tokens", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "29", "zap_solution": "Phase: Architecture and DesignUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.For example, use anti-CSRF packages such as the OWASP CSRFGuard.Phase: ImplementationEnsure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.Phase: Architecture and DesignGenerate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).Note that this can be bypassed using XSS.Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.Note that this can be bypassed using XSS.Use the ESAPI Session Management control.This control includes a component for CSRF.Do not use the GET method for any request that triggers a state change.Phase: ImplementationCheck the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.", @@ -741,102 +741,102 @@ "zap_pluginid": "10202", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/num/numguess.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/num/numguess.jsp", "method": "GET", "evidence": "
" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample?dataname=foo&datavalue=bar", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample?dataname=foo&datavalue=bar", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/cal/cal1.jsp?action=Submit&email=ZAP&name=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/cal/cal1.jsp?action=Submit&email=ZAP&name=ZAP", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/CookieExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/CookieExample", "method": "POST", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample?dataname=ZAP&datavalue=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample?dataname=ZAP&datavalue=ZAP", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/checkbox/check.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/checkbox/check.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/error/error.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/error/error.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=add", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=add", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/implicit-objects.jsp?foo=bar", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/implicit-objects.jsp?foo=bar", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/security/protected/index.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/security/protected/index.jsp", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/RequestParamExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestParamExample", "method": "POST", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/functions.jsp?foo=JSP+2.0", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/functions.jsp?foo=JSP+2.0", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/nonblocking/bytecounter.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/nonblocking/bytecounter.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colors.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/cal/login.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/cal/login.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/num/numguess.jsp?guess=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/num/numguess.jsp?guess=ZAP", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=remove", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=remove", "method": "GET", "evidence": "" } @@ -848,15 +848,15 @@ "name": "User Controllable HTML Element Attribute (Potential XSS)", "description": "This check looks at user-supplied input in query string parameters and POST data to identify where certain HTML attribute values might be controlled. This provides hot-spot detection for XSS (cross-site scripting) that will require further review by a security analyst to determine exploitability.", "category": "User Controllable HTML Element Attribute (Potential XSS)", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "1", "zap_count": "7", "zap_solution": "Validate all input and sanitize output it before writing to any HTML attributes.", - "zap_otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colrs.jsp?action=Hint&color1=ZAP&color2=ZAPappears to include user input in: a(n) [input] tag [value] attribute The user input found was:action=HintThe user-controlled value was:hint", + "zap_otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colrs.jsp?action=Hint&color1=ZAP&color2=ZAPappears to include user input in: a(n) [input] tag [value] attribute The user input found was:action=HintThe user-controlled value was:hint", "zap_reference": "http://websecuritytool.codeplex.com/wikipage?title=Checks#user-controlled-html-attribute", "zap_cweid": "20", "zap_wascid": "20", @@ -864,37 +864,37 @@ "zap_pluginid": "10031", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colrs.jsp?action=Hint&color1=ZAP&color2=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colrs.jsp?action=Hint&color1=ZAP&color2=ZAP", "method": "GET", "param": "action" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colrs.jsp?action=Submit&color1=ZAP&color2=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colrs.jsp?action=Submit&color1=ZAP&color2=ZAP", "method": "GET", "param": "action" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/functions.jsp?foo=JSP+2.0", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/functions.jsp?foo=JSP+2.0", "method": "GET", "param": "foo" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/implicit-objects.jsp?foo=bar", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/implicit-objects.jsp?foo=bar", "method": "GET", "param": "foo" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=remove", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=remove", "method": "GET", "param": "submit" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colrs.jsp?action=Submit&color1=ZAP&color2=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colrs.jsp?action=Submit&color1=ZAP&color2=ZAP", "method": "GET", "param": "action" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=add", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=add", "method": "GET", "param": "submit" } @@ -906,11 +906,11 @@ "name": "Private IP Disclosure", "description": "A private IP (such as 10.x.x.x, 172.x.x.x, 192.168.x.x) or an Amazon EC2 private hostname (for example, ip-10-0-56-78) has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.", "category": "Private IP Disclosure", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "4", "zap_solution": "Remove the private IP address from the HTTP response body. For comments, use JSP/ASP/PHP comment instead of HTML/JavaScript comment which can be seen by client browsers.", @@ -922,22 +922,22 @@ "zap_pluginid": "2", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/RequestInfoExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestInfoExample", "method": "GET", "evidence": "10.1.20.26" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/snp/snoop.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/snp/snoop.jsp", "method": "GET", "evidence": "10.1.20.26" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/filter.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/filter.html", "method": "GET", "evidence": "192.168.0.10" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/monitoring.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/monitoring.html", "method": "GET", "evidence": "192.168.1.75" } @@ -949,11 +949,11 @@ "name": "Application Error Disclosure", "description": "This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.", "category": "Application Error Disclosure", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "MEDIUM", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "5", "zap_solution": "Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.", @@ -965,27 +965,27 @@ "zap_pluginid": "90022", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/jndi-resources-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/jndi-resources-howto.html", "method": "GET", "evidence": "JDBC Driver" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/manager-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/manager-howto.html", "method": "GET", "evidence": "java.lang.NumberFormatException: For input string:" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/jndi-datasource-examples-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/jndi-datasource-examples-howto.html", "method": "GET", "evidence": "JDBC Driver" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/listeners.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/listeners.html", "method": "GET", "evidence": "JDBC Driver" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/valve.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/valve.html", "method": "GET", "evidence": "Error Report" } @@ -997,11 +997,11 @@ "name": "Modern Web Application", "description": "The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.", "category": "Modern Web Application", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "4", "zap_solution": "This is an informational alert and so no changes are required.", @@ -1013,22 +1013,22 @@ "zap_pluginid": "10109", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/echo.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/echo.xhtml", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/drawboard.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/drawboard.xhtml", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/snake.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/snake.xhtml", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/chat.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/chat.xhtml", "method": "GET", "evidence": "" } @@ -1040,11 +1040,11 @@ "name": "Weak Authentication Method", "description": "HTTP basic or digest authentication has been used over an unsecured connection. The credentials can be read and then reused by someone with access to the network.", "category": "Weak Authentication Method", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "MEDIUM", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "3", "zap_solution": "Protect the connection using HTTPS or use a stronger authentication mechanism", @@ -1056,17 +1056,17 @@ "zap_pluginid": "10105", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/manager/html", + "uri": "http://bodgeit.demo-targets.svc:8080/manager/html", "method": "GET", "evidence": "WWW-Authenticate: Basic realm=\"Tomcat Manager Application\"" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/manager/status", + "uri": "http://bodgeit.demo-targets.svc:8080/manager/status", "method": "GET", "evidence": "WWW-Authenticate: Basic realm=\"Tomcat Manager Application\"" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/host-manager/html", + "uri": "http://bodgeit.demo-targets.svc:8080/host-manager/html", "method": "GET", "evidence": "WWW-Authenticate: Basic realm=\"Tomcat Host Manager Application\"" } @@ -1078,11 +1078,11 @@ "name": "Content-Type Header Missing", "description": "The Content-Type header was either missing or empty.", "category": "Content-Type Header Missing", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "2", "zap_solution": "Ensure each page is setting the specific and appropriate content-type value for the content being delivered.", @@ -1094,11 +1094,11 @@ "zap_pluginid": "10019", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/sample/sample.war", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/sample/sample.war", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/async/async2", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/async/async2", "method": "GET" } ] @@ -1109,11 +1109,11 @@ "name": "Cookie Without SameSite Attribute", "description": "A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.", "category": "Cookie Without SameSite Attribute", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "4", "zap_solution": "Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.", @@ -1125,25 +1125,25 @@ "zap_pluginid": "10054", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/security/protected/index.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/security/protected/index.jsp", "method": "GET", "param": "JSESSIONID", "evidence": "Set-Cookie: JSESSIONID" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/basic-arithmetic.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/basic-arithmetic.jsp", "method": "GET", "param": "JSESSIONID", "evidence": "Set-Cookie: JSESSIONID" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/basic-comparisons.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/basic-comparisons.jsp", "method": "GET", "param": "JSESSIONID", "evidence": "Set-Cookie: JSESSIONID" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/CookieExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/CookieExample", "method": "POST", "param": "ZAP", "evidence": "Set-Cookie: ZAP" @@ -1156,15 +1156,15 @@ "name": "Cookie Poisoning", "description": "This check looks at user-supplied input in query string parameters and POST data to identify where cookie parameters might be controlled. This is called a cookie poisoning attack, and becomes exploitable when an attacker can manipulate the cookie in various ways. In some cases this will not be exploitable, however, allowing URL parameters to set cookie values is generally considered a bug.", "category": "Cookie Poisoning", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "1", "zap_count": "2", "zap_solution": "Do not allow user input to control cookie names and values. If some query string parameters must be set in cookie values, be sure to filter out semicolon's that can serve as name/value pair delimiters.", - "zap_otherinfo": "An attacker may be able to poison cookie values through POST parameters. To test if this is a more serious issue, you should try resending that request as a GET, with the POST parameter included as a query string parameter. For example: http://nottrusted.com/page?value=maliciousInput.This was identified at:http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/CookieExampleUser-input was found in the following cookie:ZAP=ZAP; Path=/examples/The user input was:cookievalue=ZAP", + "zap_otherinfo": "An attacker may be able to poison cookie values through POST parameters. To test if this is a more serious issue, you should try resending that request as a GET, with the POST parameter included as a query string parameter. For example: http://nottrusted.com/page?value=maliciousInput.This was identified at:http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/CookieExampleUser-input was found in the following cookie:ZAP=ZAP; Path=/examples/The user input was:cookievalue=ZAP", "zap_reference": "http://websecuritytool.codeplex.com/wikipage?title=Checks#user-controlled-cookie", "zap_cweid": "20", "zap_wascid": "20", @@ -1172,12 +1172,12 @@ "zap_pluginid": "10029", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/CookieExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/CookieExample", "method": "POST", "param": "cookievalue" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/CookieExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/CookieExample", "method": "POST", "param": "cookiename" } @@ -1189,11 +1189,11 @@ "name": "Information Disclosure - Suspicious Comments", "description": "The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.", "category": "Information Disclosure - Suspicious Comments", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "1", "zap_count": "5", "zap_solution": "Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.", @@ -1205,23 +1205,23 @@ "zap_pluginid": "10027", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-admin-opers.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-opers.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/drawboard.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/drawboard.xhtml", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-admin-objects.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-objects.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/echo.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/echo.xhtml", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-admin-apps.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-apps.html", "method": "GET" } ] @@ -1232,11 +1232,11 @@ "name": "Cookie No HttpOnly Flag", "description": "A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.", "category": "Cookie No HttpOnly Flag", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "1", "zap_solution": "Ensure that the HttpOnly flag is set for all cookies.", @@ -1248,7 +1248,7 @@ "zap_pluginid": "10010", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/CookieExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/CookieExample", "method": "POST", "param": "ZAP", "evidence": "Set-Cookie: ZAP" @@ -1261,11 +1261,11 @@ "name": "Information Disclosure - Suspicious Comments", "description": "The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.", "category": "Information Disclosure - Suspicious Comments", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "INFORMATIONAL", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "2", "zap_solution": "Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.", @@ -1277,11 +1277,11 @@ "zap_pluginid": "10027", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/web.xml.txt", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/web.xml.txt", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/build.xml.txt", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/build.xml.txt", "method": "GET" } ] @@ -1292,11 +1292,11 @@ "name": "Application Error Disclosure", "description": "This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.", "category": "Application Error Disclosure", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "1", "zap_solution": "Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.", @@ -1308,7 +1308,7 @@ "zap_pluginid": "90022", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/error/err.jsp?name=bmw328i&submit=Submit", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/error/err.jsp?name=bmw328i&submit=Submit", "method": "GET", "evidence": "HTTP/1.1 500 Internal Server Error" } @@ -1320,11 +1320,11 @@ "name": "Information Disclosure - Debug Error Messages", "description": "The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.", "category": "Information Disclosure - Debug Error Messages", - "location": "http://bodgeit.demo-apps.svc:8080", + "location": "http://bodgeit.demo-targets.svc:8080", "osi_layer": "APPLICATION", "severity": "LOW", "attributes": { - "host": "bodgeit.demo-apps.svc", + "host": "bodgeit.demo-targets.svc", "zap_confidence": "2", "zap_count": "1", "zap_solution": "Disable debugging messages before pushing to production.", @@ -1336,7 +1336,7 @@ "zap_pluginid": "10023", "zap_finding_urls": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/changelog.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/changelog.html", "method": "GET", "evidence": "internal server error" } @@ -1344,4 +1344,4 @@ }, "id": "325de9a9-63f3-4ec1-a6aa-fd0e1eeae7c4" } -] \ No newline at end of file +] diff --git a/scanners/zap/examples/demo-bodgeit-baseline-scan/scan.yaml b/scanners/zap/examples/demo-bodgeit-baseline-scan/scan.yaml index 8b58dac34b..1dc41335a5 100644 --- a/scanners/zap/examples/demo-bodgeit-baseline-scan/scan.yaml +++ b/scanners/zap/examples/demo-bodgeit-baseline-scan/scan.yaml @@ -13,7 +13,7 @@ spec: parameters: # target URL including the protocol - "-t" - - "http://bodgeit.demo-apps.svc:8080" + - "http://bodgeit.demo-targets.svc:8080" # show debug messages - "-d" # the number of minutes to spider for (default 1) diff --git a/scanners/zap/examples/demo-bodgeit-baseline-scan/zap-results.json b/scanners/zap/examples/demo-bodgeit-baseline-scan/zap-results.json index 981e9a2a00..8b870b1a47 100644 --- a/scanners/zap/examples/demo-bodgeit-baseline-scan/zap-results.json +++ b/scanners/zap/examples/demo-bodgeit-baseline-scan/zap-results.json @@ -3,8 +3,8 @@ "@generated": "Sun, 28 Jun 2020 18:22:42", "site": [ { - "@name": "http://bodgeit.demo-apps.svc:8080", - "@host": "bodgeit.demo-apps.svc", + "@name": "http://bodgeit.demo-targets.svc:8080", + "@host": "bodgeit.demo-targets.svc", "@port": "8080", "@ssl": "false", "alerts": [ @@ -18,83 +18,83 @@ "desc": "

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/tagplugin/choose.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/choose.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/valve.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/valve.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/tagfiles/panel.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/tagfiles/panel.jsp.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/loader.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/loader.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/connectors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/connectors.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/simpletag/HelloWorldSimpleTag.java.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/HelloWorldSimpleTag.java.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/apr.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/apr.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/introduction.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/introduction.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/listeners.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/listeners.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample", "method": "POST" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/class-loader-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/class-loader-howto.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/RequestParamExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestParamExample", "method": "POST" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/jspx/textRotate.jspx.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspx/textRotate.jspx.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/helloworld.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/helloworld.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/security-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/security-howto.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/jasper-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/jasper-howto.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/misc/config.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/misc/config.jsp.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-interceptor.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-interceptor.html", "method": "GET" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/index.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/index.html", "method": "GET" } ], @@ -115,102 +115,102 @@ "desc": "

X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/rewrite.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/rewrite.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/mbean-names.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/mbean-names.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/faq.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/faq.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/include/include.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/include/include.jsp.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/automatic-deployment.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/automatic-deployment.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colors.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/tagfiles/hello.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/tagfiles/hello.jsp", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/index.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/index.xhtml", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/cluster-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/cluster-howto.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/echo.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/echo.xhtml", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsptoserv/jts.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsptoserv/jts.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/simpletag/foo.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/simpletag/foo.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/Functions.java.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/Functions.java.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/tagplugin/choose.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/choose.jsp", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/interceptors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/interceptors.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-jndi-realm.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-jndi-realm.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/dates/date.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/dates/date.html", "method": "GET", "param": "X-Frame-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/RequestHeaderExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestHeaderExample", "method": "GET", "param": "X-Frame-Options" } @@ -232,102 +232,102 @@ "desc": "

The web/application server is leaking version information via the \"Server\" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/filter.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/filter.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/num/numguess.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/num/numguess.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/implicit-objects.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/implicit-objects.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/cal/cal2.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/cal/cal2.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/index.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/index.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/simpletag/hello.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/hello.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/simpletag/book.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/simpletag/book.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/basic-comparisons.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/basic-comparisons.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/http.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/http.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/developers.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/developers.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/maven-jars.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/maven-jars.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/service.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/service.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/mbeans-descriptors-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/mbeans-descriptors-howto.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/chat.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/chat.xhtml", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/api/org/apache/catalina/Host.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/api/org/apache/catalina/Host.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/snp/snoop.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/snp/snoop.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/functions.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/functions.jsp.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.html", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/tagplugin/foreach.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/tagplugin/foreach.jsp", "method": "GET", "evidence": "Apache-Coyote/1.1" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-admin-objects.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-objects.html", "method": "GET", "evidence": "Apache-Coyote/1.1" } @@ -349,102 +349,102 @@ "desc": "

A timestamp was disclosed by the application/web server - Unix<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000039" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000008" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000014963" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000018373" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/snp/snoop.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/snp/snoop.jsp", "method": "GET", "evidence": "20100101" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000018" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000005503" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000026" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000015294" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000016347" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000002280" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000043589" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000015448" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000007734" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000010013" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/manager-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/manager-howto.html", "method": "GET", "evidence": "46800300" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000005214" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000043442" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000005368" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/architecture/startup/serverStartup.pdf", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/architecture/startup/serverStartup.pdf", "method": "GET", "evidence": "0000000301" } @@ -467,102 +467,102 @@ "desc": "

At least one link on this page is vulnerable to Reverse tabnabbing as it uses a target attribute without using both of the \"noopener\" and \"noreferrer\" keywords in the \"rel\" attribute, which allows the target page to take control of this page.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/class-loader-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/class-loader-howto.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/virtual-hosting-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/virtual-hosting-howto.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-valve.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-valve.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/windows-service-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/windows-service-howto.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-manager.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-manager.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/apr.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/apr.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/connectors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/connectors.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/security-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/security-howto.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-channel.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-channel.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/jasper-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/jasper-howto.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/transport.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/transport.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/status.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/status.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/appdev/processes.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/appdev/processes.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/realm.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/realm.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/index.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/index.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/building.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/building.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/introduction.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/introduction.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/systemprops.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/systemprops.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/membership.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/membership.html", "method": "GET", "evidence": "\"The<\/a>" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-deployer.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-deployer.html", "method": "GET", "evidence": "\"The<\/a>" } @@ -582,102 +582,102 @@ "desc": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsptoserv/jts.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsptoserv/jts.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/automatic-deployment.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/automatic-deployment.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/mbean-names.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/mbean-names.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/include/include.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/include/include.jsp.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/rewrite.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/rewrite.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/basic-arithmetic.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/basic-arithmetic.jsp", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/tomcat.png", + "uri": "http://bodgeit.demo-targets.svc:8080/tomcat.png", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colors.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/images/asf-feather.png", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/images/asf-feather.png", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/funcspecs/fs-admin-apps.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/funcspecs/fs-admin-apps.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/introduction.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/introduction.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/tribes/faq.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/tribes/faq.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/servletapi/index.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/servletapi/index.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/misc/dynamicattrs.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/misc/dynamicattrs.jsp.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/building.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/building.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/jspattribute/shuffle.jsp.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/images/code.gif", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/images/code.gif", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/cluster-receiver.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/cluster-receiver.html", "method": "GET", "param": "X-Content-Type-Options" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/deployer-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/deployer-howto.html", "method": "GET", "param": "X-Content-Type-Options" } @@ -700,102 +700,102 @@ "desc": "

No Anti-CSRF tokens were found in a HTML submission form.<\/p>

A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.<\/p>

<\/p>

CSRF attacks are effective in a number of situations, including:<\/p>

* The victim has an active session on the target site.<\/p>

* The victim is authenticated via HTTP auth on the target site.<\/p>

* The victim is on the same local network as the target site.<\/p>

<\/p>

CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/num/numguess.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/num/numguess.jsp", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample?dataname=foo&datavalue=bar", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample?dataname=foo&datavalue=bar", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/cal/cal1.jsp?action=Submit&email=ZAP&name=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/cal/cal1.jsp?action=Submit&email=ZAP&name=ZAP", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/CookieExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/CookieExample", "method": "POST", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample?dataname=ZAP&datavalue=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample?dataname=ZAP&datavalue=ZAP", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/checkbox/check.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/checkbox/check.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/error/error.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/error/error.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=add", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=add", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/implicit-objects.jsp?foo=bar", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/implicit-objects.jsp?foo=bar", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/security/protected/index.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/security/protected/index.jsp", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/RequestParamExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestParamExample", "method": "POST", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/functions.jsp?foo=JSP+2.0", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/functions.jsp?foo=JSP+2.0", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/nonblocking/bytecounter.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/nonblocking/bytecounter.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colors.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colors.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/SessionExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/SessionExample", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/cal/login.html", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/cal/login.html", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/num/numguess.jsp?guess=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/num/numguess.jsp?guess=ZAP", "method": "GET", "evidence": "" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=remove", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=remove", "method": "GET", "evidence": "" } @@ -818,44 +818,44 @@ "desc": "

This check looks at user-supplied input in query string parameters and POST data to identify where certain HTML attribute values might be controlled. This provides hot-spot detection for XSS (cross-site scripting) that will require further review by a security analyst to determine exploitability.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colrs.jsp?action=Hint&color1=ZAP&color2=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colrs.jsp?action=Hint&color1=ZAP&color2=ZAP", "method": "GET", "param": "action" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colrs.jsp?action=Submit&color1=ZAP&color2=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colrs.jsp?action=Submit&color1=ZAP&color2=ZAP", "method": "GET", "param": "action" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/functions.jsp?foo=JSP+2.0", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/functions.jsp?foo=JSP+2.0", "method": "GET", "param": "foo" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/jsp2/el/implicit-objects.jsp?foo=bar", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/jsp2/el/implicit-objects.jsp?foo=bar", "method": "GET", "param": "foo" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=remove", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=remove", "method": "GET", "param": "submit" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colrs.jsp?action=Submit&color1=ZAP&color2=ZAP", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colrs.jsp?action=Submit&color1=ZAP&color2=ZAP", "method": "GET", "param": "action" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=add", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/sessions/carts.jsp?item=X-files+movie&submit=add", "method": "GET", "param": "submit" } ], "count": "7", "solution": "

Validate all input and sanitize output it before writing to any HTML attributes.<\/p>", - "otherinfo": "

User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:<\/p>

<\/p>

http://bodgeit.demo-apps.svc:8080/examples/jsp/colors/colrs.jsp?action=Hint&color1=ZAP&color2=ZAP<\/p>

<\/p>

appears to include user input in: <\/p>

<\/p>

a(n) [input] tag [value] attribute <\/p>

<\/p>

The user input found was:<\/p>

action=Hint<\/p>

<\/p>

The user-controlled value was:<\/p>

hint<\/p>", + "otherinfo": "

User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:<\/p>

<\/p>

http://bodgeit.demo-targets.svc:8080/examples/jsp/colors/colrs.jsp?action=Hint&color1=ZAP&color2=ZAP<\/p>

<\/p>

appears to include user input in: <\/p>

<\/p>

a(n) [input] tag [value] attribute <\/p>

<\/p>

The user input found was:<\/p>

action=Hint<\/p>

<\/p>

The user-controlled value was:<\/p>

hint<\/p>", "reference": "

http://websecuritytool.codeplex.com/wikipage?title=Checks#user-controlled-html-attribute<\/p>", "cweid": "20", "wascid": "20", @@ -871,22 +871,22 @@ "desc": "

A private IP (such as 10.x.x.x, 172.x.x.x, 192.168.x.x) or an Amazon EC2 private hostname (for example, ip-10-0-56-78) has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/servlets/servlet/RequestInfoExample", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/servlets/servlet/RequestInfoExample", "method": "GET", "evidence": "10.1.20.26" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/jsp/snp/snoop.jsp", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/jsp/snp/snoop.jsp", "method": "GET", "evidence": "10.1.20.26" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/filter.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/filter.html", "method": "GET", "evidence": "192.168.0.10" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/monitoring.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/monitoring.html", "method": "GET", "evidence": "192.168.1.75" } @@ -909,27 +909,27 @@ "desc": "

This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/jndi-resources-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/jndi-resources-howto.html", "method": "GET", "evidence": "JDBC Driver" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/manager-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/manager-howto.html", "method": "GET", "evidence": "java.lang.NumberFormatException: For input string:" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/jndi-datasource-examples-howto.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/jndi-datasource-examples-howto.html", "method": "GET", "evidence": "JDBC Driver" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/listeners.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/listeners.html", "method": "GET", "evidence": "JDBC Driver" }, { - "uri": "http://bodgeit.demo-apps.svc:8080/docs/config/valve.html", + "uri": "http://bodgeit.demo-targets.svc:8080/docs/config/valve.html", "method": "GET", "evidence": "Error Report" } @@ -951,22 +951,22 @@ "desc": "

The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.<\/p>", "instances": [ { - "uri": "http://bodgeit.demo-apps.svc:8080/examples/websocket/echo.xhtml", + "uri": "http://bodgeit.demo-targets.svc:8080/examples/websocket/echo.xhtml", "method": "GET", "evidence": "

Apache Tomcat 8

\n Version 8.0.37,\n

SSI How To

Table of Contents

\n\n

Introduction

\n\n

SSI (Server Side Includes) are directives that are placed in HTML pages,\nand evaluated on the server while the pages are being served. They let you\nadd dynamically generated content to an existing HTML page, without having\nto serve the entire page via a CGI program, or other dynamic technology.\n

\n\n

Within Tomcat SSI support can be added when using Tomcat as your\nHTTP server and you require SSI support. Typically this is done\nduring development when you don't want to run a web server like Apache.

\n\n

Tomcat SSI support implements the same SSI directives as Apache. See the\n\nApache Introduction to SSI for information on using SSI directives.

\n\n

SSI support is available as a servlet and as a filter. You should use one\nor the other to provide SSI support but not both.

\n\n

Servlet based SSI support is implemented using the class\norg.apache.catalina.ssi.SSIServlet. Traditionally, this servlet\nis mapped to the URL pattern \"*.shtml\".

\n\n

Filter based SSI support is implemented using the class\norg.apache.catalina.ssi.SSIFilter. Traditionally, this filter\nis mapped to the URL pattern \"*.shtml\", though it can be mapped to \"*\" as\nit will selectively enable/disable SSI processing based on mime types. The\ncontentType init param allows you to apply SSI processing to JSP pages,\njavascript, or any other content you wish.

\n

By default SSI support is disabled in Tomcat.

\n

Installation

\n\n

CAUTION - SSI directives can be used to execute programs\nexternal to the Tomcat JVM. If you are using the Java SecurityManager this\nwill bypass your security policy configuration in catalina.policy.\n

\n\n

To use the SSI servlet, remove the XML comments from around the SSI servlet\nand servlet-mapping configuration in\n$CATALINA_BASE/conf/web.xml.

\n\n

To use the SSI filter, remove the XML comments from around the SSI filter\nand filter-mapping configuration in\n$CATALINA_BASE/conf/web.xml.

\n\n

Only Contexts which are marked as privileged may use SSI features (see the\nprivileged property of the Context element).

\n\n

Servlet Configuration

\n\n

There are several servlet init parameters which can be used to\nconfigure the behaviour of the SSI servlet.

\n
    \n
  • buffered - Should output from this servlet be buffered?\n(0=false, 1=true) Default 0 (false).
    • \n
  • debug - Debugging detail level for messages logged\nby this servlet. Default 0.
    • \n
  • expires - The number of seconds before a page with SSI\ndirectives will expire. Default behaviour is for all SSI directives to be\nevaluated for every request.
    • \n
  • isVirtualWebappRelative - Should \"virtual\" SSI directive\npaths be interpreted as relative to the context root, instead of the server\nroot? Default false.
    • \n
  • inputEncoding - The encoding to be assumed for SSI\nresources if one cannot be determined from the resource itself. Default is\nthe default platform encoding.
    • \n
  • outputEncoding - The encoding to be used for the result\nof the SSI processing. Default is UTF-8.
    • \n
  • allowExec - Is the exec command enabled? Default is\nfalse.
    • \n
\n\n\n

Filter Configuration

\n\n

There are several filter init parameters which can be used to\nconfigure the behaviour of the SSI filter.

\n
    \n
  • contentType - A regex pattern that must be matched before\nSSI processing is applied. When crafting your own pattern, don't forget that a\nmime content type may be followed by an optional character set in the form\n\"mime/type; charset=set\" that you must take into account. Default is\n\"text/x-server-parsed-html(;.*)?\".
    • \n
  • debug - Debugging detail level for messages logged\nby this servlet. Default 0.
    • \n
  • expires - The number of seconds before a page with SSI\ndirectives will expire. Default behaviour is for all SSI directives to be\nevaluated for every request.
    • \n
  • isVirtualWebappRelative - Should \"virtual\" SSI directive\npaths be interpreted as relative to the context root, instead of the server\nroot? Default false.
    • \n
  • allowExec - Is the exec command enabled? Default is\nfalse.
    • \n
\n\n\n

Directives

\n

Server Side Includes are invoked by embedding SSI directives in an HTML document\n whose type will be processed by the SSI servlet. The directives take the form of an HTML\n comment. The directive is replaced by the results of interpreting it before sending the\n page to the client. The general form of a directive is:

\n

<!--#directive [parm=value] -->

\n

The directives are:

\n