Skip to content

Active scanner rules (beta) version 43

Choose a tag to compare

View all tags
@zapbot zapbot released this 27 Oct 13:00
· 6583 commits to main since this release
ascanrulesBeta-v43
895169a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Changed

  • Update minimum ZAP version to 2.12.0.
  • Depend on database add-on.
  • Maintenance changes.
  • Rely on Network add-on to obtain more information about socket timeouts.

Added

  • The following scan rules were added, having been promoted to Beta:
    • CORS
    • Exponential Entity Expansion
    • Forbidden Bypass
    • Log4Shell
    • Out-of-Band XSS
    • Spring4Shell
    • Spring Actuator
    • Blind SSTI
    • SSTI

Fixed

  • NPE in Source Code Disclosure File Inclusion Scan Rule

Removed

  • The following scan rules were removed, having been promoted to Release:
    • .env Information Leak
    • Cloud Metadata Attack
    • GET for POST
    • Heartbleed OpenSSL Vulnerability
    • Hidden File Finder
    • Padding Oracle
    • Remote Code Execution - CVE-2012-1823
    • Source Code Disclosure - CVE-2012-1823
    • SQL Injection - Hypersonic (Time Based)
    • SQL Injection - MsSQL (Time Based)
    • SQL Injection - MySQL (Time Based)
    • SQL Injection - Oracle (Time Based)
    • SQL Injection - PostgreSQL (Time Based)
    • SQL Injection - SQLite
    • Trace.axd Information Leak
    • User Agent Fuzzer
    • XSLT Injection
    • XXE
Assets 3
Loading