diff --git a/README.md b/README.md
index ab50f2f3..06299a91 100644
--- a/README.md
+++ b/README.md
@@ -272,7 +272,7 @@ To run bench test against populated volume data (2 endpoints)
npm run bench:volume
```
-For convenience, you can load the volume db and run the bench tests with the single command.
+For convenience, you can load the volume db and run the bench tests with the single command.
```
npm run bench:load-volume
@@ -306,6 +306,24 @@ The injection tests can be configured in the [sqlmap config][]. A few output con
See the [sqlmap][] repository for more details.
+Also, Udaru, has some additional security related (penetration) testing available through npm commands based on [OWASP Zed Attack Proxy](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project).
+End results of the scans are stored as HTML reports in the Udaru documentation and should be reviewed manually post execution.
+
+**Note:** before running this, make sure you have a Docker installed and the weekly Zed Attack proxy might take quite a bit to download (1,5GB + in size). Also note that the API scan is very thorough, extensive and takes quite some time to complete (45+ mins).
+
+To run the baseline scan:
+```
+npm run test:security:pentest:baseline
+```
+
+To run the API attack scan:
+```
+npm run test:security:pentest:api
+```
+To run both:
+```
+npm run test:security:pentest
+```
## License
[license]: ./LICENSE.md
diff --git a/docs/_sidebar.md b/docs/_sidebar.md
index f5be119b..1d0c86cc 100644
--- a/docs/_sidebar.md
+++ b/docs/_sidebar.md
@@ -6,3 +6,7 @@
- API
- [Example Usage](example.md)
- [Swagger Documentation](swagger/index.html ":ignore")
+
+- Security
+ - [Pentration test scans](udaru/pentests/)
+ - [SQL Injection](sqlinjection.md)
diff --git a/docs/contributing.md b/docs/contributing.md
index 56b1528b..fe6f8c76 100644
--- a/docs/contributing.md
+++ b/docs/contributing.md
@@ -50,3 +50,5 @@ We are currently supporting node 6 and 8.
# Security testing of Udaru
Udaru has been extensively tested for SQL injections, please see [sqlinjection.md](./sqlinjection.md) for more information.
+
+Aside from that, Udaru is occasionally tested with OWASP ZAProxy for any known security vulnerabilities. For a list, please see [pentests](./pentests) for more information.
diff --git a/docs/udaru/pentests/udaru-api-scan-2018-05-21T12:33:30.044Z.html b/docs/udaru/pentests/udaru-api-scan-2018-05-21T12:33:30.044Z.html
new file mode 100644
index 00000000..30c214b2
--- /dev/null
+++ b/docs/udaru/pentests/udaru-api-scan-2018-05-21T12:33:30.044Z.html
@@ -0,0 +1,1025 @@
+
+
+
+
+
+
+
+Medium (Medium) | Backup File Disclosure |
+
+
+
+
+
+
+Description | A backup of the file was disclosed by the web server |
+
+
+ |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/policies/search.zip |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/policies/search.zip |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/policies/search?query=query] is available at [http://docker.for.mac.localhost:8080/authorization/policies/search.zip] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams/teamId.zip |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/teams/teamId.zip |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/teams/teamId] is available at [http://docker.for.mac.localhost:8080/authorization/teams/teamId.zip] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/Copy (3) of id |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/users/Copy (3) of id |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/users/id] is available at [http://docker.for.mac.localhost:8080/authorization/users/Copy (3) of id] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/id - Copy (3) |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/users/id - Copy (3) |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/users/id] is available at [http://docker.for.mac.localhost:8080/authorization/users/id - Copy (3)] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams/teamId.backup |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/teams/teamId.backup |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/teams/teamId] is available at [http://docker.for.mac.localhost:8080/authorization/teams/teamId.backup] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams/id.bak |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/teams/id.bak |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/teams/id] is available at [http://docker.for.mac.localhost:8080/authorization/teams/id.bak] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams/id - Copy/nested |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/teams/id - Copy/nested |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/teams/id/nested?page=10&limit=10] is available at [http://docker.for.mac.localhost:8080/authorization/teams/id - Copy/nested] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/shared-policies/search.log |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/shared-policies/search.log |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/shared-policies/search?query=query] is available at [http://docker.for.mac.localhost:8080/authorization/shared-policies/search.log] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/userId.bak |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/users/userId.bak |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/users/userId] is available at [http://docker.for.mac.localhost:8080/authorization/users/userId.bak] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/search.bak |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/users/search.bak |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/users/search?query=query] is available at [http://docker.for.mac.localhost:8080/authorization/users/search.bak] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/id - Copy (2) |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/users/id - Copy (2) |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/users/id] is available at [http://docker.for.mac.localhost:8080/authorization/users/id - Copy (2)] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/shared-policies/search.backup |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/shared-policies/search.backup |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/shared-policies/search?query=query] is available at [http://docker.for.mac.localhost:8080/authorization/shared-policies/search.backup] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/policies/id.bak |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/policies/id.bak |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/policies/id?sig=sig] is available at [http://docker.for.mac.localhost:8080/authorization/policies/id.bak] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/search.log |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/users/search.log |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/users/search?query=query] is available at [http://docker.for.mac.localhost:8080/authorization/users/search.log] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/policies/id.tar |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/policies/id.tar |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/policies/id?sig=sig] is available at [http://docker.for.mac.localhost:8080/authorization/policies/id.tar] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/shared-policies/search~ |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/shared-policies/search~ |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/shared-policies/search?query=query] is available at [http://docker.for.mac.localhost:8080/authorization/shared-policies/search~] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/list/userId - Copy/{resource*} |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/list/userId - Copy/{resource*} |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/list/userId/%7Bresource*%7D] is available at [http://docker.for.mac.localhost:8080/authorization/list/userId - Copy/{resource*}] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams/Copy of id/users |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/teams/Copy of id/users |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/teams/id/users?page=10&limit=10] is available at [http://docker.for.mac.localhost:8080/authorization/teams/Copy of id/users] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/id.bac |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/users/id.bac |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/users/id] is available at [http://docker.for.mac.localhost:8080/authorization/users/id.bac] |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/id.old |
+
+
+
+Method | GET |
+
+
+
+Attack | http://docker.for.mac.localhost:8080/authorization/users/id.old |
+
+
+
+Evidence | A backup of [http://docker.for.mac.localhost:8080/authorization/users/id] is available at [http://docker.for.mac.localhost:8080/authorization/users/id.old] |
+
+
+
+
+
+Instances | 251 |
+
+
+
+Solution | Do not edit files in-situ on the web server, and ensure that un-necessary files (including hidden files) are removed from the web server. |
+
+
+
+Other information | http://docker.for.mac.localhost:8080/authorization/policies/search?query=query |
+
+
+ |
+
+
+
+Reference | http://projects.webappsec.org/Predictable-Resource-Location http://cwe.mitre.org/data/definitions/425.html |
+
+
+
+CWE Id | 425 |
+
+
+
+WASC Id | 34 |
+
+
+
+Source ID | 1 |
+
+
+
+
+
+
+
+
+Informational (High) | A Client Error response code was returned by the server |
+
+
+
+
+
+
+Description | A response code of 400 was returned by the server. This may indicate that the application is failing to handle unexpected input correctly. Raised by the 'Alert on HTTP Response Code Error' script |
+
+
+ |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users?query=%29 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/organizations/id?query=query%27 |
+
+
+
+Method | DELETE |
+
+
+
+Evidence | HTTP/1.1 404 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/policies/id?query=query%27+AND+%271%27%3D%272%27+--+ |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams?page=10%3B&limit=10 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users?query=query%22%26cat+%2Fetc%2Fpasswd%26%22 |
+
+
+
+Method | POST |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/shared-policies?page=10&limit=Set-cookie%3A+Tamper%3Ded05869b-0813-4e18-ba6c-6752e6f64445 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/id/policies?page=10&limit=%22%27 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 401 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/shared-policies?sig=http%3A%2F%2Fwww.google.com%3A80%2F |
+
+
+
+Method | POST |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams/id/nested?page=10%27%29+UNION+ALL+select+NULL+--+&limit=10 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization?query=query%3Bget-help+%23 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 404 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams/id/policies?query=%2Fpolicies |
+
+
+
+Method | DELETE |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/organizations/id/policies?page=10%22%7Ctimeout+%2FT+15&limit=10 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/id/policies?query=any%0ASet-cookie%3A+Tamper%3Dc220d01e-db02-4f37-b626-530b781fbc3b |
+
+
+
+Method | PUT |
+
+
+
+Evidence | HTTP/1.1 401 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/shared-policies?query=www.google.com%2F |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/shared-policies?sig=sig%3Bstart-sleep+-s+%7B0%7D |
+
+
+
+Method | POST |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users/id/policies?page=%28%29+%7B+%3A%3B%7D%3B+%2Fbin%2Fsleep+15&limit=10 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 401 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/shared-policies?page=10%3Bsleep+15%3B&limit=10 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/policies/id/ |
+
+
+
+Method | DELETE |
+
+
+
+Evidence | HTTP/1.1 404 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/teams/id/users?page=10&limit=any%0ASet-cookie%3A+Tamper%3D208212ef-86fb-404d-88f0-155c7b24e684 |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+URL | http://docker.for.mac.localhost:8080/authorization/users?query=any%0D%0ASet-cookie%3A+Tamper%3D062ad8b9-837c-4dd2-982b-400e74a44046%0D%0A |
+
+
+
+Method | GET |
+
+
+
+Evidence | HTTP/1.1 400 |
+
+
+
+
+
+Instances | 13422 |
+
+
+
+Solution | |
+
+
+
+Reference | |
+
+
+
+CWE Id | 388 |
+
+
+
+WASC Id | 20 |
+
+
+
+Source ID | 4 |
+
+
+
+
+
diff --git a/docs/udaru/pentests/udaru-basline-scan-2018-05-18T13:39:28.850Z.html b/docs/udaru/pentests/udaru-basline-scan-2018-05-18T13:39:28.850Z.html
new file mode 100644
index 00000000..4e8612ca
--- /dev/null
+++ b/docs/udaru/pentests/udaru-basline-scan-2018-05-18T13:39:28.850Z.html
@@ -0,0 +1,96 @@
+
+
+