diff --git a/addons/index.html b/addons/index.html
index 8bff0da894..87338acc88 100644
--- a/addons/index.html
+++ b/addons/index.html
@@ -456,7 +456,7 @@ ZAP Marketplace
- 
+
@@ -469,7 +469,7 @@ ZAP Marketplace
authhelper
- 0.31.0
+ 0.32.0
|
beta
@@ -478,7 +478,7 @@ ZAP Marketplace
ZAP Dev Team
|
- 2025-11-05
+ 2025-11-07
|
@@ -524,7 +524,7 @@ ZAP Marketplace
-
+
@@ -537,7 +537,7 @@ ZAP Marketplace
automation
- 0.55.0
+ 0.56.0
|
beta
@@ -546,7 +546,7 @@ ZAP Marketplace
ZAP Dev Team
|
- 2025-11-05
+ 2025-11-07
|
@@ -3075,7 +3075,7 @@ ZAP Marketplace
-
+
@@ -3088,7 +3088,7 @@ ZAP Marketplace
reports
- 0.41.0
+ 0.42.0
|
release
@@ -3097,7 +3097,7 @@ ZAP Marketplace
ZAP Dev Team
|
- 2025-09-04
+ 2025-11-07
|
diff --git a/docs/desktop/addons/automation-framework/index.html b/docs/desktop/addons/automation-framework/index.html
index e50e995f8c..12c54068ba 100644
--- a/docs/desktop/addons/automation-framework/index.html
+++ b/docs/desktop/addons/automation-framework/index.html
@@ -1865,6 +1865,7 @@ Command Line Options
diff --git a/docs/desktop/addons/report-generation/index.xml b/docs/desktop/addons/report-generation/index.xml
index cd50ccdcef..92130275a3 100644
--- a/docs/desktop/addons/report-generation/index.xml
+++ b/docs/desktop/addons/report-generation/index.xml
@@ -89,14 +89,14 @@
/docs/desktop/addons/report-generation/report-traditional-json/
Mon, 01 Jan 0001 00:00:00 +0000
/docs/desktop/addons/report-generation/report-traditional-json/
- <h1 id="traditional-json-report">Traditional JSON Report</h1>
<h3 id="sample">Sample <a class="header-link" href="#sample"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<pre tabindex="0"><code>{
"@version": "Dev Build",
"@generated": "Fri, 4 Feb 2022 13:04:51",
"created": "2022-02-04T13:04:51.236211400Z",
"site":[
{
"@name": "http://localhost:8080",
"@host": "localhost",
"@port": "8080",
"@ssl": "false",
"alerts": [
{
"pluginid": "40012",
"alertRef": "40012",
"alert": "Cross Site Scripting (Reflected)",
"name": "Cross Site Scripting (Reflected)",
"riskcode": "3",
"confidence": "2",
"riskdesc": "High (Medium)",
"desc": "<p>Cross-site Scripting (XSS) is an attack technique that involves ...</p>",
"instances":[
{
"uri": "http://localhost:8080/bodgeit/search.jsp?q=%3C%2Ffont%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cfont%3E",
"method": "GET",
"param": "q",
"attack": "</font><scrIpt>alert(1);</scRipt><font>",
"evidence": "</font><scrIpt>alert(1);</scRipt><font>",
"otherinfo": ""
},
{
"uri": "http://localhost:8080/bodgeit/contact.jsp",
"method": "POST",
"param": "comments",
"attack": "</td><scrIpt>alert(1);</scRipt><td>",
"evidence": "</td><scrIpt>alert(1);</scRipt><td>",
"otherinfo": ""
}
],
"count": "2",
"solution": "<p>Phase: Architecture and Design</p><p>Use a vetted library or framework that does not ...</p>",
"otherinfo": "",
"reference": "<p>http://projects.webappsec.org/Cross-Site-Scripting</p><p>http://cwe.mitre.org/data/definitions/79.html</p>",
"cweid": "79",
"wascid": "8",
"sourceid": "36977"
},
</code></pre><p>The report can also include details of Sequences and related active scanning results, for example:</p>
+ <h1 id="traditional-json-report">Traditional JSON Report</h1>
<h3 id="sample">Sample <a class="header-link" href="#sample"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<pre tabindex="0"><code>{
"@version": "Dev Build",
"@generated": "Fri, 4 Feb 2022 13:04:51",
"created": "2022-02-04T13:04:51.236211400Z",
"site":[
{
"@name": "http://localhost:8080",
"@host": "localhost",
"@port": "8080",
"@ssl": "false",
"alerts": [
{
"pluginid": "40012",
"alertRef": "40012",
"alert": "Cross Site Scripting (Reflected)",
"name": "Cross Site Scripting (Reflected)",
"riskcode": "3",
"confidence": "2",
"riskdesc": "High (Medium)",
"desc": "<p>Cross-site Scripting (XSS) is an attack technique that involves ...</p>",
"instances":[
{
"uri": "http://localhost:8080/bodgeit/search.jsp?q=%3C%2Ffont%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cfont%3E",
"nodeName": "http://localhost:8080/bodgeit/search.jsp (q)",
"method": "GET",
"param": "q",
"attack": "</font><scrIpt>alert(1);</scRipt><font>",
"evidence": "</font><scrIpt>alert(1);</scRipt><font>",
"otherinfo": ""
},
{
"uri": "http://localhost:8080/bodgeit/contact.jsp",
"nodeName": "http://localhost:8080/bodgeit/contact.jsp",
"method": "POST",
"param": "comments",
"attack": "</td><scrIpt>alert(1);</scRipt><td>",
"evidence": "</td><scrIpt>alert(1);</scRipt><td>",
"otherinfo": ""
}
],
"count": "2",
"systemic": false,
"solution": "<p>Phase: Architecture and Design</p><p>Use a vetted library or framework that does not ...</p>",
"otherinfo": "",
"reference": "<p>http://projects.webappsec.org/Cross-Site-Scripting</p><p>http://cwe.mitre.org/data/definitions/79.html</p>",
"cweid": "79",
"wascid": "8",
"sourceid": "36977"
},
</code></pre><p>The report can also include details of Sequences and related active scanning results, for example:</p>
-
Traditional JSON Report with Requests and Responses
/docs/desktop/addons/report-generation/report-traditional-json-plus/
Mon, 01 Jan 0001 00:00:00 +0000
/docs/desktop/addons/report-generation/report-traditional-json-plus/
- <h1 id="traditional-json-report-with-requests-and-responses">Traditional JSON Report with Requests and Responses</h1>
<h3 id="sections">Sections <a class="header-link" href="#sections"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<table>
<thead>
<tr>
<th style="text-align: left">Section</th>
<th style="text-align: left">ID</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: left">Statistics</td>
<td style="text-align: left">statistics</td>
</tr>
<tr>
<td style="text-align: left">Sequence Details</td>
<td style="text-align: left">sequencedetails</td>
</tr>
<tr>
<td style="text-align: left">Automation Framework State</td>
<td style="text-align: left">afstate</td>
</tr>
</tbody>
</table>
<h3 id="sample">Sample <a class="header-link" href="#sample"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<pre tabindex="0"><code>{
"@version": "Dev Build",
"@generated": "Fri, 4 Feb 2022 13:04:51",
"created": "2022-02-04T13:04:51.236211400Z",
"site":[
{
"@name": "http://localhost:8080",
"@host": "localhost",
"@port": "8080",
"@ssl": "false",
"alerts": [
{
"pluginid": "40012",
"alertRef": "40012",
"alert": "Cross Site Scripting (Reflected)",
"name": "Cross Site Scripting (Reflected)",
"riskcode": "3",
"confidence": "2",
"riskdesc": "High (Medium)",
"desc": "<p>Cross-site Scripting (XSS) is an attack technique that involves ...</p>",
"instances":[
{
"uri": "http://localhost:8080/bodgeit/search.jsp?q=%3C%2Ffont%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cfont%3E",
"method": "GET",
"param": "q",
"attack": "</font><scrIpt>alert(1);</scRipt><font>",
"evidence": "</font><scrIpt>alert(1);</scRipt><font>",
"otherinfo": "",
"request-header": "GET http://localhost:8080/bodgeit/search.jsp?q=%3C%2Ffont%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cfont%3E HTTP/1.1\r\n...",
"request-body": "",
"response-header": "HTTP/1.1 200\r\nContent-Type: text/html;charset=ISO-8859-1\r\nContent-Length: 2045\r\nDate: Fri, 04 Feb 2022 11:56:38 GMT\r\n\r\n",
"response-body": "\n\n\n\n\n\n\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\">\n<html>..."
},
{
"uri": "http://localhost:8080/bodgeit/contact.jsp",
"method": "POST",
"param": "comments",
"attack": "</td><scrIpt>alert(1);</scRipt><td>",
"evidence": "</td><scrIpt>alert(1);</scRipt><td>",
"otherinfo": "",
"request-header": "POST http://localhost:8080/bodgeit/contact.jsp HTTP/1.1\r\nHost: localhost:8080\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0)...",
"request-body": "null=&anticsrf=0.7583553183173598&comments=%3C%2Ftd%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Ctd%3E",
"response-header": "HTTP/1.1 200\r\nContent-Type: text/html;charset=ISO-8859-1\r\nContent-Length: 2025\r\nDate: Fri, 04 Feb 2022 11:56:35 GMT\r\n\r\n",
"response-body": "\n\n\n\n\n\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\">\n<html>..."
}
],
"count": "2",
"solution": "<p>Phase: Architecture and Design</p><p>Use a vetted library or framework that does not ...</p>",
"otherinfo": "",
"reference": "<p>http://projects.webappsec.org/Cross-Site-Scripting</p><p>http://cwe.mitre.org/data/definitions/79.html</p>",
"cweid": "79",
"wascid": "8",
"sourceid": "36977",
"tags":[
{
"tag": "OWASP_2021_A03",
"link": "https://owasp.org/Top10/A03_2021-Injection/"
},
{
"tag": "WSTG-v42-INPV-01",
"link": "https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/01-Testing_for_Reflected_Cross_Site_Scripting"
},
{
"tag": "OWASP_2017_A07",
"link": "https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS).html"
}
]
},
...
]
}
]
}
</code></pre>
<h4 id="statistics-section">Statistics Section <a class="header-link" href="#statistics-section"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h4>
<p>The report can also include statistics, per site and global, for example:</p>
+ <h1 id="traditional-json-report-with-requests-and-responses">Traditional JSON Report with Requests and Responses</h1>
<h3 id="sections">Sections <a class="header-link" href="#sections"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<table>
<thead>
<tr>
<th style="text-align: left">Section</th>
<th style="text-align: left">ID</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: left">Statistics</td>
<td style="text-align: left">statistics</td>
</tr>
<tr>
<td style="text-align: left">Sequence Details</td>
<td style="text-align: left">sequencedetails</td>
</tr>
<tr>
<td style="text-align: left">Automation Framework State</td>
<td style="text-align: left">afstate</td>
</tr>
</tbody>
</table>
<h3 id="sample">Sample <a class="header-link" href="#sample"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<pre tabindex="0"><code>{
"@version": "Dev Build",
"@generated": "Fri, 4 Feb 2022 13:04:51",
"created": "2022-02-04T13:04:51.236211400Z",
"site":[
{
"@name": "http://localhost:8080",
"@host": "localhost",
"@port": "8080",
"@ssl": "false",
"alerts": [
{
"pluginid": "40012",
"alertRef": "40012",
"alert": "Cross Site Scripting (Reflected)",
"name": "Cross Site Scripting (Reflected)",
"riskcode": "3",
"confidence": "2",
"riskdesc": "High (Medium)",
"desc": "<p>Cross-site Scripting (XSS) is an attack technique that involves ...</p>",
"instances":[
{
"uri": "http://localhost:8080/bodgeit/search.jsp?q=%3C%2Ffont%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cfont%3E",
"nodeName": "http://localhost:8080/bodgeit/search.jsp (q)",
"method": "GET",
"param": "q",
"attack": "</font><scrIpt>alert(1);</scRipt><font>",
"evidence": "</font><scrIpt>alert(1);</scRipt><font>",
"otherinfo": "",
"request-header": "GET http://localhost:8080/bodgeit/search.jsp?q=%3C%2Ffont%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Cfont%3E HTTP/1.1\r\n...",
"request-body": "",
"response-header": "HTTP/1.1 200\r\nContent-Type: text/html;charset=ISO-8859-1\r\nContent-Length: 2045\r\nDate: Fri, 04 Feb 2022 11:56:38 GMT\r\n\r\n",
"response-body": "\n\n\n\n\n\n\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\">\n<html>..."
},
{
"uri": "http://localhost:8080/bodgeit/contact.jsp",
"nodeName": "http://localhost:8080/bodgeit/contact.jsp",
"method": "POST",
"param": "comments",
"attack": "</td><scrIpt>alert(1);</scRipt><td>",
"evidence": "</td><scrIpt>alert(1);</scRipt><td>",
"otherinfo": "",
"request-header": "POST http://localhost:8080/bodgeit/contact.jsp HTTP/1.1\r\nHost: localhost:8080\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0)...",
"request-body": "null=&anticsrf=0.7583553183173598&comments=%3C%2Ftd%3E%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E%3Ctd%3E",
"response-header": "HTTP/1.1 200\r\nContent-Type: text/html;charset=ISO-8859-1\r\nContent-Length: 2025\r\nDate: Fri, 04 Feb 2022 11:56:35 GMT\r\n\r\n",
"response-body": "\n\n\n\n\n\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\">\n<html>..."
}
],
"count": "2",
"systemic": false,
"solution": "<p>Phase: Architecture and Design</p><p>Use a vetted library or framework that does not ...</p>",
"otherinfo": "",
"reference": "<p>http://projects.webappsec.org/Cross-Site-Scripting</p><p>http://cwe.mitre.org/data/definitions/79.html</p>",
"cweid": "79",
"wascid": "8",
"sourceid": "36977",
"tags":[
{
"tag": "OWASP_2021_A03",
"link": "https://owasp.org/Top10/A03_2021-Injection/"
},
{
"tag": "WSTG-v42-INPV-01",
"link": "https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/01-Testing_for_Reflected_Cross_Site_Scripting"
},
{
"tag": "OWASP_2017_A07",
"link": "https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS).html"
}
]
},
...
]
}
]
}
</code></pre>
<h4 id="statistics-section">Statistics Section <a class="header-link" href="#statistics-section"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h4>
<p>The report can also include statistics, per site and global, for example:</p>
-
Traditional Markdown Report
@@ -117,14 +117,14 @@
/docs/desktop/addons/report-generation/report-traditional-xml/
Mon, 01 Jan 0001 00:00:00 +0000
/docs/desktop/addons/report-generation/report-traditional-xml/
- <h1 id="traditional-xml-report">Traditional XML Report</h1>
<h3 id="sample">Sample <a class="header-link" href="#sample"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<pre tabindex="0"><code><?xml version="1.0"?>
<OWASPZAPReport version="Dev Build" generated="Fri, 4 Feb 2022 17:42:18" created="2022-02-04T17:42:18.236211400Z">
<site name="http://localhost:8080" host="localhost" port="8080" ssl="false">
<alerts>
<alertitem>
<pluginid>20012</pluginid>
<alertRef>20012</alertRef>
<alert>Anti-CSRF Tokens Check</alert>
<name>Anti-CSRF Tokens Check</name>
<riskcode>3</riskcode>
<confidence>2</confidence>
<riskdesc>High (Medium)</riskdesc>
<confidencedesc>Medium</confidencedesc>
<desc><p>A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge...</desc>
<instances>
<instance>
<uri>http://localhost:8080/bodgeit/advanced.jsp</uri>
<method>GET</method>
<param></param>
<attack></attack>
<evidence><form id="advanced" name="advanced" method="POST" onsubmit="return validateForm(this);false;"></evidence>
<otherinfo></otherinfo>
</instance>
<instance>
<uri>http://localhost:8080/bodgeit/advanced.jsp</uri>
<method>GET</method>
<param></param>
<attack></attack>
<evidence><form id="query" name="advanced" method="POST"></evidence>
<otherinfo></otherinfo>
</instance>
<instance>
<uri>http://localhost:8080/bodgeit/basket.jsp</uri>
<method>GET</method>
<param></param>
<attack></attack>
<evidence><form action="basket.jsp" method="post"></evidence>
<otherinfo></otherinfo>
</instance>
</code></pre>
+ <h1 id="traditional-xml-report">Traditional XML Report</h1>
<h3 id="sample">Sample <a class="header-link" href="#sample"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<pre tabindex="0"><code><?xml version="1.0"?>
<OWASPZAPReport version="Dev Build" generated="Fri, 4 Feb 2022 17:42:18" created="2022-02-04T17:42:18.236211400Z">
<site name="http://localhost:8080" host="localhost" port="8080" ssl="false">
<alerts>
<alertitem>
<pluginid>20012</pluginid>
<alertRef>20012</alertRef>
<alert>Anti-CSRF Tokens Check</alert>
<name>Anti-CSRF Tokens Check</name>
<riskcode>3</riskcode>
<confidence>2</confidence>
<riskdesc>High (Medium)</riskdesc>
<confidencedesc>Medium</confidencedesc>
<desc><p>A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge...</desc>
<instances>
<instance>
<uri>http://localhost:8080/bodgeit/advanced.jsp</uri>
<nodeName>http://localhost:8080/bodgeit/advanced.jsp</nodeName>
<method>GET</method>
<param></param>
<attack></attack>
<evidence><form id="advanced" name="advanced" method="POST" onsubmit="return validateForm(this);false;"></evidence>
<otherinfo></otherinfo>
</instance>
<instance>
<uri>http://localhost:8080/bodgeit/advanced.jsp</uri>
<nodeName>http://localhost:8080/bodgeit/advanced.jsp</nodeName>
<method>GET</method>
<param></param>
<attack></attack>
<evidence><form id="query" name="advanced" method="POST"></evidence>
<otherinfo></otherinfo>
</instance>
<instance>
<uri>http://localhost:8080/bodgeit/basket.jsp</uri>
<nodeName>http://localhost:8080/bodgeit/basket.jsp</nodeName>
<method>GET</method>
<param></param>
<attack></attack>
<evidence><form action="basket.jsp" method="post"></evidence>
<otherinfo></otherinfo>
</instance>
<count>2</count>
<systemic>false</systemic>
<solution>The solution</solution>
<otherinfo>The other info</otherinfo>
</code></pre>
-
Traditional XML Report with Requests and Responses
/docs/desktop/addons/report-generation/report-traditional-xml-plus/
Mon, 01 Jan 0001 00:00:00 +0000
/docs/desktop/addons/report-generation/report-traditional-xml-plus/
- <h1 id="traditional-xml-report-with-requests-and-responses">Traditional XML Report with Requests and Responses</h1>
<h3 id="sample">Sample <a class="header-link" href="#sample"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<pre tabindex="0"><code> <?xml version="1.0"?>
<OWASPZAPReport version="2.11.1" generated="Fr., 30 Sep. 2022 08:40:35" created="2022-09-30T08:40:35.236211400Z">
<site name="http://localhost:8080" host="localhost" port="8080" ssl="false">
<alerts>
<alertitem>
<pluginid>90027</pluginid>
<alertRef>90027</alertRef>
<alert>Cookie Slack Detector</alert>
<name>Cookie Slack Detector</name>
<riskcode>1</riskcode>
<confidence>1</confidence>
<riskdesc>Low (Low)</riskdesc>
<confidencedesc>Low</confidencedesc>
<desc>Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.</desc>
<instances>
<instance>
<uri>http://localhost:8080/bodgeit/js</uri>
<method>GET</method>
<param></param>
<attack></attack>
<evidence></evidence>
<otherinfo></otherinfo>
<requestheader>GET http://localhost:8080/bodgeit/js HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Connection: keep-alive
Referer: https://localhost:8080/bodgeit/
Cookie: JSESSIONID=9E75E26E50F681208096FFAA0B566901
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
</requestheader>
<requestbody></requestbody>
<responseheader>HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Location: /bodgeit/js/
Content-Length: 0
Date: Fri, 30 Sep 2022 06:40:17 GMT
</responseheader>
<responsebody></responsebody>
</instance>
<instance>
<uri>http://localhost:8080/bodgeit/js/util.js</uri>
<method>GET</method>
<param></param>
<attack></attack>
<evidence></evidence>
<otherinfo></otherinfo>
<requestheader>GET http://localhost:8080/bodgeit/js/util.js HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Connection: keep-alive
Referer: https://localhost:8080/bodgeit/
Cookie: JSESSIONID=9E75E26E50F681208096FFAA0B566901
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
</requestheader>
<requestbody></requestbody>
<responseheader>HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/&quot;1812-1343651578000&quot;
Last-Modified: Mon, 30 Jul 2012 12:32:58 GMT
Content-Type: application/javascript
Content-Length: 1812
Date: Fri, 30 Sep 2022 06:40:17 GMT
</responseheader>
<responsebody>
function loadfile(filename){
var filetype = filename.split(&apos;.&apos;).pop();
switch (filetype){
case &quot;js&quot;:
var insert=document.createElement(&apos;script&apos;)
insert.setAttribute(&quot;type&quot;,&quot;text/javascript&quot;)
insert.setAttribute(&quot;src&quot;, filename)
break;
case &apos;css&apos;:
var insert=document.createElement(&quot;link&quot;);
insert.setAttribute(&quot;type&quot;, &quot;text/css&quot;)
insert.setAttribute(&quot;href&quot;, filename)
insert.setAttribute(&quot;rel&quot;, &quot;stylesheet&quot;)
break;
}
if (typeof insert!=&quot;undefined&quot;)
document.getElementsByTagName(&quot;head&quot;)[0].appendChild(insert);
return false;
}
////The following is from:
//http://stackoverflow.com/questions/316781/how-to-build-query-string-with-javascript
function form_to_params( form )
{
var output = &quot;&quot;;
var length = form.elements.length
for( var i = 0; i &lt; length; i++ )
{
element = form.elements[i]
if(element.tagName == &apos;TEXTAREA&apos; )
{
output += &quot;|&quot; + element.name + &quot;:&quot; + element.value;
}
else if( element.tagName == &apos;INPUT&apos; )
{
switch(element.type){
case &apos;radio&apos;:
case &apos;checkbox&apos;:
if(element.checked &amp;&amp; !element.value){
output += &quot;|&quot; + element.name + &quot;:on&quot;;
break;
}
case &apos;text&apos;:
case &apos;hidden&apos;:
case &apos;password&apos;:
if(element.value)
output += &quot;|&quot; + element.name + &quot;:&quot; + element.value;
break;
}
}
}
return output.substring(1);
}
function htmlEntities(str) {
return String(str).replace(/&amp;/g, &apos;&amp;amp;&apos;).replace(/&lt;/g, &apos;&amp;lt;&apos;).replace(/&gt;/g, &apos;&amp;gt;&apos;).replace(/&quot;/g, &apos;&amp;quot;&apos;);
}</responsebody>
</instance>
</instances>
<count>3</count>
<solution></solution>
<otherinfo>NOTE: Because of its name this cookie may be important, but dropping it appears to have no effect: [JSESSIONID]
Cookies that don&apos;t have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.
These cookies affected the response:
These cookies did NOT affect the response: JSESSIONID
</otherinfo>
<reference>http://projects.webappsec.org/Fingerprinting
</reference>
<cweid>200</cweid>
<wascid>45</wascid>
<sourceid>2420</sourceid>
<tags>
<tag>
<tag>OWASP_2017_A06 </tag>
<link>https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration.html </link>
</tag>
<tag>
<tag>OWASP_2021_A05 </tag>
<link>https://owasp.org/Top10/A05_2021-Security_Misconfiguration/ </link>
</tag>
<tag>
<tag>WSTG-v42-SESS-02 </tag>
<link>https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes </link>
</tag>
</tags>
</alertitem>
</alerts>
<statistics>
<statistic>
<key>site.specific.stat.a</key>
<value>1</value>
</statistic>
<statistic>
<key>site.specific.stat.b</key>
<value>2</value>
</statistic>
</statistics>
</site>
<statistics>
<statistic>
<key>global.stat.a</key>
<value>1</value>
</statistic>
<statistic>
<key>global.stat.b</key>
<value>2</value>
</statistic>
</statistics>
</OWASPZAPReport>
</code></pre>
+ <h1 id="traditional-xml-report-with-requests-and-responses">Traditional XML Report with Requests and Responses</h1>
<h3 id="sample">Sample <a class="header-link" href="#sample"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
<pre tabindex="0"><code> <?xml version="1.0"?>
<OWASPZAPReport version="2.11.1" generated="Fr., 30 Sep. 2022 08:40:35" created="2022-09-30T08:40:35.236211400Z">
<site name="http://localhost:8080" host="localhost" port="8080" ssl="false">
<alerts>
<alertitem>
<pluginid>90027</pluginid>
<alertRef>90027</alertRef>
<alert>Cookie Slack Detector</alert>
<name>Cookie Slack Detector</name>
<riskcode>1</riskcode>
<confidence>1</confidence>
<riskdesc>Low (Low)</riskdesc>
<confidencedesc>Low</confidencedesc>
<desc>Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.</desc>
<instances>
<instance>
<uri>http://localhost:8080/bodgeit/js</uri>
<nodeName>http://localhost:8080/bodgeit/js</nodeName>
<method>GET</method>
<param></param>
<attack></attack>
<evidence></evidence>
<otherinfo></otherinfo>
<requestheader>GET http://localhost:8080/bodgeit/js HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Connection: keep-alive
Referer: https://localhost:8080/bodgeit/
Cookie: JSESSIONID=9E75E26E50F681208096FFAA0B566901
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
</requestheader>
<requestbody></requestbody>
<responseheader>HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Location: /bodgeit/js/
Content-Length: 0
Date: Fri, 30 Sep 2022 06:40:17 GMT
</responseheader>
<responsebody></responsebody>
</instance>
<instance>
<uri>http://localhost:8080/bodgeit/js/util.js</uri>
<nodeName>http://localhost:8080/bodgeit/js/util.js</nodeName>
<method>GET</method>
<param></param>
<attack></attack>
<evidence></evidence>
<otherinfo></otherinfo>
<requestheader>GET http://localhost:8080/bodgeit/js/util.js HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Connection: keep-alive
Referer: https://localhost:8080/bodgeit/
Cookie: JSESSIONID=9E75E26E50F681208096FFAA0B566901
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
</requestheader>
<requestbody></requestbody>
<responseheader>HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/&quot;1812-1343651578000&quot;
Last-Modified: Mon, 30 Jul 2012 12:32:58 GMT
Content-Type: application/javascript
Content-Length: 1812
Date: Fri, 30 Sep 2022 06:40:17 GMT
</responseheader>
<responsebody>
function loadfile(filename){
var filetype = filename.split(&apos;.&apos;).pop();
switch (filetype){
case &quot;js&quot;:
var insert=document.createElement(&apos;script&apos;)
insert.setAttribute(&quot;type&quot;,&quot;text/javascript&quot;)
insert.setAttribute(&quot;src&quot;, filename)
break;
case &apos;css&apos;:
var insert=document.createElement(&quot;link&quot;);
insert.setAttribute(&quot;type&quot;, &quot;text/css&quot;)
insert.setAttribute(&quot;href&quot;, filename)
insert.setAttribute(&quot;rel&quot;, &quot;stylesheet&quot;)
break;
}
if (typeof insert!=&quot;undefined&quot;)
document.getElementsByTagName(&quot;head&quot;)[0].appendChild(insert);
return false;
}
////The following is from:
//http://stackoverflow.com/questions/316781/how-to-build-query-string-with-javascript
function form_to_params( form )
{
var output = &quot;&quot;;
var length = form.elements.length
for( var i = 0; i &lt; length; i++ )
{
element = form.elements[i]
if(element.tagName == &apos;TEXTAREA&apos; )
{
output += &quot;|&quot; + element.name + &quot;:&quot; + element.value;
}
else if( element.tagName == &apos;INPUT&apos; )
{
switch(element.type){
case &apos;radio&apos;:
case &apos;checkbox&apos;:
if(element.checked &amp;&amp; !element.value){
output += &quot;|&quot; + element.name + &quot;:on&quot;;
break;
}
case &apos;text&apos;:
case &apos;hidden&apos;:
case &apos;password&apos;:
if(element.value)
output += &quot;|&quot; + element.name + &quot;:&quot; + element.value;
break;
}
}
}
return output.substring(1);
}
function htmlEntities(str) {
return String(str).replace(/&amp;/g, &apos;&amp;amp;&apos;).replace(/&lt;/g, &apos;&amp;lt;&apos;).replace(/&gt;/g, &apos;&amp;gt;&apos;).replace(/&quot;/g, &apos;&amp;quot;&apos;);
}</responsebody>
</instance>
</instances>
<count>3</count>
<systemic>false</systemic>
<solution></solution>
<otherinfo>NOTE: Because of its name this cookie may be important, but dropping it appears to have no effect: [JSESSIONID]
Cookies that don&apos;t have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.
These cookies affected the response:
These cookies did NOT affect the response: JSESSIONID
</otherinfo>
<reference>http://projects.webappsec.org/Fingerprinting
</reference>
<cweid>200</cweid>
<wascid>45</wascid>
<sourceid>2420</sourceid>
<tags>
<tag>
<tag>OWASP_2017_A06 </tag>
<link>https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration.html </link>
</tag>
<tag>
<tag>OWASP_2021_A05 </tag>
<link>https://owasp.org/Top10/A05_2021-Security_Misconfiguration/ </link>
</tag>
<tag>
<tag>WSTG-v42-SESS-02 </tag>
<link>https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes </link>
</tag>
</tags>
</alertitem>
</alerts>
<statistics>
<statistic>
<key>site.specific.stat.a</key>
<value>1</value>
</statistic>
<statistic>
<key>site.specific.stat.b</key>
<value>2</value>
</statistic>
</statistics>
</site>
<statistics>
<statistic>
<key>global.stat.a</key>
<value>1</value>
</statistic>
<statistic>
<key>global.stat.b</key>
<value>2</value>
</statistic>
</statistics>
</OWASPZAPReport>
</code></pre>
diff --git a/docs/desktop/addons/report-generation/report-traditional-json-plus/index.html b/docs/desktop/addons/report-generation/report-traditional-json-plus/index.html
index 2e518e8681..db35aa84af 100644
--- a/docs/desktop/addons/report-generation/report-traditional-json-plus/index.html
+++ b/docs/desktop/addons/report-generation/report-traditional-json-plus/index.html
@@ -1908,6 +1908,7 @@ Sample