即使禁用 ZAP 被动扫描规则也是扫描的一部分

如何解决即使禁用 ZAP 被动扫描规则也是扫描的一部分

我正在使用 ZAP docker 镜像来执行 API 扫描。我在 zap_started hook python 脚本中禁用了一些被动扫描规则。尽管如此，这些仍被列为最终报告的一部分。

禁用被动扫描规则的脚本：

pscan_id_list = [10003,10015,10017,10020,10021,10028,10029,10031,10032,10039,10040,10041,10043,10052,10050,10056,10061,10108,10109,90001,90026,90029,90030]
for pscan_id in pscan_id_list:
    zap.pscan.set_scanner_alert_threshold(id=pscan_id,alertthreshold='OFF')

日志确认规则被禁用：

2021-06-17 06:44:10,269 Starting new HTTP connection (1): localhost:51008                                                                                     
2021-06-17 06:44:10,281 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10003&alertThreshold=OFF&apikey= HTTP/1.1" 200 15                                                                                                                                                             
2021-06-17 06:44:10,288 Starting new HTTP connection (1): localhost:51008                                                                                     
2021-06-17 06:44:10,298 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10015&alertThreshold=OFF&apikey= HTTP/1.1" 200 15                                                                                                                                                             
2021-06-17 06:44:10,304 Starting new HTTP connection (1): localhost:51008                                                                                     
2021-06-17 06:44:10,313 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10017&alertThreshold=OFF&apikey= HTTP/1.1" 200 15                                                                                                                                                             
2021-06-17 06:44:10,320 Starting new HTTP connection (1): localhost:51008                                                                                     
2021-06-17 06:44:10,327 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10020&alertThreshold=OFF&apikey= HTTP/1.1" 200 15                                                                                                                                                             
2021-06-17 06:44:10,333 Starting new HTTP connection (1): localhost:51008                                                                                     
2021-06-17 06:44:10,343 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10021&alertThreshold=OFF&apikey= HTTP/1.1" 200 15                                                                                                                                                             
2021-06-17 06:44:10,350 Starting new HTTP connection (1): localhost:51008                                                                                     
2021-06-17 06:44:10,361 http://localhost:51008 "GET http://zap/JSON/pscan/action/setScannerAlertThreshold/?id=10028&alertThreshold=OFF&apikey= HTTP/1.1" 200 15

被动扫描规则仍列在最终报告中：

PASS: Vulnerable JS Library [10003]
PASS: Cookie No HttpOnly Flag [10010]
PASS: Cookie Without Secure Flag [10011]
PASS: Incomplete or No Cache-control and Pragma HTTP Header Set [10015]
PASS: Cross-Domain JavaScript Source File Inclusion [10017]
PASS: Content-Type Header Missing [10019]
PASS: x-frame-options Header [10020]
PASS: X-Content-Type-Options Header Missing [10021]
PASS: information disclosure - Sensitive information in URL [10024]
PASS: information disclosure - Sensitive information in HTTP Referrer Header [10025]
PASS: HTTP Parameter Override [10026]
PASS: information disclosure - SuspicIoUs Comments [10027]
PASS: Open Redirect [10028]
PASS: Cookie Poisoning [10029]
PASS: User Controllable Charset [10030]
PASS: User Controllable HTML Element Attribute (Potential XSS) [10031]

解决方法

按照 https://www.zaproxy.org/docs/api/#pscanactionsetscanneralertthreshold 尝试使用 alertThreshold='OFF'（大写 T）