diff --git a/addOns/scanpolicies/CHANGELOG.md b/addOns/scanpolicies/CHANGELOG.md index 0253ef917f..c477ab2856 100644 --- a/addOns/scanpolicies/CHANGELOG.md +++ b/addOns/scanpolicies/CHANGELOG.md @@ -5,5 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## Unreleased ### Added +- A set of standardized active scan policies: + - Developer CI/CD + - Developer Standard + - Developer Full - First version, just with the Default Policy. - Initial help. \ No newline at end of file diff --git a/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-cicd.html b/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-cicd.html new file mode 100644 index 0000000000..3e29d0a3b0 --- /dev/null +++ b/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-cicd.html @@ -0,0 +1,25 @@ + + + + + +Developer CI/CD Policy + + + +

Developer CI/CD Policy

+ +This policy is designed to be used by developers in a CI/CD pipeline. + + + diff --git a/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-full.html b/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-full.html new file mode 100644 index 0000000000..f7174e71ad --- /dev/null +++ b/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-full.html @@ -0,0 +1,24 @@ + + + + + +Developer Full Policy + + + +

Developer Full Policy

+ +A developer focused policy, including a superset of the dev standard with a greater variety of +potential findings and only minimal environmental/server related rules, intended for use in a dev environment. + + + diff --git a/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-std.html b/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-std.html new file mode 100644 index 0000000000..b1aa4fc76d --- /dev/null +++ b/addOns/scanpolicies/src/main/javahelp/help/contents/policy-dev-std.html @@ -0,0 +1,26 @@ + + + + + +Developer Standard Policy + + + +

Developer Standard Policy

+ +A develoepr focused policy eant to perform fairly quickly while providing a greater set of results than the CICD policy, +intended for use in a dev environment. + + + diff --git a/addOns/scanpolicies/src/main/javahelp/help/contents/scanpolicies.html b/addOns/scanpolicies/src/main/javahelp/help/contents/scanpolicies.html index 4d4357c6ed..8a94c72364 100644 --- a/addOns/scanpolicies/src/main/javahelp/help/contents/scanpolicies.html +++ b/addOns/scanpolicies/src/main/javahelp/help/contents/scanpolicies.html @@ -13,7 +13,10 @@

Scan Policies

These policies are initialised as detailed in the relevant pages, but you can tune them as required. diff --git a/addOns/scanpolicies/src/main/javahelp/help/map.jhm b/addOns/scanpolicies/src/main/javahelp/help/map.jhm index 1a41fc351b..dc43ba0979 100644 --- a/addOns/scanpolicies/src/main/javahelp/help/map.jhm +++ b/addOns/scanpolicies/src/main/javahelp/help/map.jhm @@ -6,5 +6,8 @@ + + + diff --git a/addOns/scanpolicies/src/main/javahelp/help/toc.xml b/addOns/scanpolicies/src/main/javahelp/help/toc.xml index 11e0c3925d..d6127aeafc 100644 --- a/addOns/scanpolicies/src/main/javahelp/help/toc.xml +++ b/addOns/scanpolicies/src/main/javahelp/help/toc.xml @@ -8,6 +8,9 @@ + + + diff --git a/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev CICD.policy b/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev CICD.policy new file mode 100644 index 0000000000..ea8af8c7b9 --- /dev/null +++ b/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev CICD.policy @@ -0,0 +1,55 @@ + + + Developer CI/CD + + OFF + MEDIUM + + + + External Redirect + true + MEDIUM + + + Cross Site Scripting (Reflected) + true + MEDIUM + + + SQL Injection + true + MEDIUM + + + Remote OS Command Injection + true + MEDIUM + + + XPath Injection + true + MEDIUM + + + XML External Entity Attack + true + MEDIUM + + + Server Side Template Injection + true + MEDIUM + + + XSLT Injection + true + MEDIUM + + + Script Active Scan Rules + true + MEDIUM + + + diff --git a/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev Full.policy b/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev Full.policy new file mode 100644 index 0000000000..e8a0680f4d --- /dev/null +++ b/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev Full.policy @@ -0,0 +1,155 @@ + + + Developer Full + + OFF + MEDIUM + + + + Path Traversal + true + MEDIUM + + + Remote File Inclusion + true + MEDIUM + + + External Redirect + true + MEDIUM + + + Server Side Include + true + MEDIUM + + + Cross Site Scripting (Reflected) + true + MEDIUM + + + Cross Site Scripting (Persistent) + true + MEDIUM + + + SQL Injection + true + MEDIUM + + + SQL Injection - MySQL + true + MEDIUM + + + SQL Injection - Hypersonic SQL + true + MEDIUM + + + SQL Injection - Oracle + true + MEDIUM + + + SQL Injection - PostgreSQL + true + MEDIUM + + + Cross Site Scripting (DOM Based) + true + MEDIUM + + + SQL Injection - MsSQL + true + MEDIUM + + + Server Side Code Injection + true + MEDIUM + + + Remote OS Command Injection + true + MEDIUM + + + XPath Injection + true + MEDIUM + + + XML External Entity Attack + true + MEDIUM + + + Server Side Template Injection + true + MEDIUM + + + Server Side Template Injection (Blind) + true + MEDIUM + + + CRLF Injection + true + MEDIUM + + + Parameter Tampering + true + MEDIUM + + + XSLT Injection + true + MEDIUM + + + Cross Site Scripting (Persistent) - Prime + true + MEDIUM + + + Cross Site Scripting (Persistent) - Spider + true + MEDIUM + + + Script Active Scan Rules + true + MEDIUM + + + Out of Band XSS + true + MEDIUM + + + Server Side Request Forgery + true + MEDIUM + + + Text4shell (CVE-2022-42889) + true + MEDIUM + + + Insecure HTTP Method + true + MEDIUM + + + diff --git a/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev Standard.policy b/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev Standard.policy new file mode 100644 index 0000000000..e21505cfac --- /dev/null +++ b/addOns/scanpolicies/src/main/zapHomeFiles/policies/Dev Standard.policy @@ -0,0 +1,70 @@ + + + Developer Standard + + OFF + MEDIUM + + + + Path Traversal + true + MEDIUM + + + Remote File Inclusion + true + MEDIUM + + + External Redirect + true + MEDIUM + + + Server Side Include + true + MEDIUM + + + Cross Site Scripting (Reflected) + true + MEDIUM + + + SQL Injection + true + MEDIUM + + + Remote OS Command Injection + true + MEDIUM + + + XPath Injection + true + MEDIUM + + + XML External Entity Attack + true + MEDIUM + + + Server Side Template Injection + true + MEDIUM + + + XSLT Injection + true + MEDIUM + + + Script Active Scan Rules + true + MEDIUM + + +