dast

Passed Started 4 years ago by
This job is archived. Only the complete pipeline can be retried.
1Running with gitlab-runner 12.9.0 (4c96e5ad)
2  on docker-auto-scale fa6cab46
 3  Preparing the "docker+machine" executor  
  02:01
4Using Docker executor with image registry.gitlab.com/gitlab-org/security-products/dast:1 ...
5Pulling docker image registry.gitlab.com/gitlab-org/security-products/dast:1 ...
6Using docker image sha256:5e5fe6123f53ae01515941b1f4f33cdb74987085d4c296b9d4111101a83b55eb for registry.gitlab.com/gitlab-org/security-products/dast:1 ...
 7  Preparing environment  
  00:05
8Running on runner-fa6cab46-project-4422333-concurrent-0 via runner-fa6cab46-stg-srm-1586198226-e473426f...
 9  Getting source from Git repository  
  00:02
10Skipping Git repository setup
11Skipping Git checkout
12Skipping Git submodules setup
 13  Restoring cache  
  00:01
 14  Downloading artifacts  
  00:02
15Downloading artifacts for dast_environment_deploy (37141769)...
16Downloading artifacts from coordinator... ok        id=37141769 responseStatus=200 OK token=u8ACixsH
 17  Running before_script and script  
  00:22
18$ export DAST_WEBSITE=${DAST_WEBSITE:-$(cat environment_url.txt)}
19$ /analyze -t $DAST_WEBSITE
202020-04-06 18:39:18,140 using Python 3.6.9 (default, Nov  7 2019, 10:44:02) [GCC 8.3.0]
212020-04-06 18:39:18,140 waiting for http://dast-4422333-dast-default.34.67.11.220.nip.io to be available
222020-04-06 18:39:18,141 requesting access to http://dast-4422333-dast-default.34.67.11.220.nip.io
232020-04-06 18:39:18,473 starting scan
242020-04-06 18:39:18,474 Script params: [('-t', 'http://dast-4422333-dast-default.34.67.11.220.nip.io'), ('-J', 'gl-dast-report.json'), ('-z', '-config selenium.firefoxDriver=/usr/bin/geckodriver -addonupdate')]
252020-04-06 18:39:18,475 Params: ['zap-x.sh', '-daemon', '-port', '43880', '-host', '0.0.0.0', '-config', 'api.disablekey=true', '-config', 'api.addrs.addr.name=.*', '-config', 'api.addrs.addr.regex=true', '-config', 'spider.maxDuration=1', '-config', 'selenium.firefoxDriver=/usr/bin/geckodriver', '-addonupdate']
26Apr 06, 2020 6:39:24 PM java.util.prefs.FileSystemPreferences$1 run
27INFO: Created user preferences directory.
28[zap.out] Found Java version 1.8.0_242
29[zap.out] Available memory: 3693 MB
30[zap.out] Using JVM args: -Xmx923m
31[zap.out] 403 [main] INFO org.zaproxy.zap.DaemonBootstrap  - OWASP ZAP D-2020-02-10 started 06/04/20 18:39:19 with home /root/.ZAP_D/
32[zap.out] 468 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config api.disablekey = true was null
33[zap.out] 470 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config api.addrs.addr.name = .* was null
34[zap.out] 472 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config api.addrs.addr.regex = true was null
35[zap.out] 475 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config spider.maxDuration = 1 was null
36[zap.out] 475 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config selenium.firefoxDriver = /usr/bin/geckodriver was null
37[zap.out] 487 [main] INFO org.parosproxy.paros.network.SSLConnector  - Reading supported SSL/TLS protocols...
38[zap.out] 487 [main] INFO org.parosproxy.paros.network.SSLConnector  - Using a SSLEngine...
39[zap.out] 647 [main] INFO org.parosproxy.paros.network.SSLConnector  - Done reading supported SSL/TLS protocols: [SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2]
40[zap.out] 658 [main] INFO org.parosproxy.paros.extension.option.OptionsParamCertificate  - Unsafe SSL renegotiation disabled.
41[zap.out] 1487 [main] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - dataFileCache open start
42[zap.out] 1498 [main] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - dataFileCache open end
43[zap.out] 1630 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory  - Loading extensions
44[zap.out] 4630 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory  - Installed add-ons: [[id=accessControl, version=6.0.0], [id=alertFilters, version=10.0.0], [id=ascanrules, version=34.0.0], [id=ascanrulesBeta, version=27.0.0], [id=bruteforce, version=9.0.0], [id=coreLang, version=14.0.0], [id=diff, version=10.0.0], [id=directorylistv1, version=4.0.0], [id=formhandler, version=3.0.0], [id=fuzz, version=12.0.0], [id=gettingStarted, version=11.0.0], [id=help, version=10.0.0], [id=hud, version=0.10.0], [id=importurls, version=7.0.0], [id=invoke, version=10.0.0], [id=onlineMenu, version=7.0.0], [id=openapi, version=15.0.0], [id=plugnhack, version=12.0.0], [id=portscan, version=9.0.0], [id=pscanrules, version=27.0.0], [id=pscanrulesBeta, version=21.0.0], [id=quickstart, version=28.0.0], [id=replacer, version=8.0.0], [id=reveal, version=3.0.0], [id=saverawmessage, version=5.0.0], [id=savexmlmessage, version=0.1.0], [id=scripts, version=26.0.0], [id=selenium, version=15.1.0], [id=sequence, version=6.0.0], [id=spiderAjax, version=23.1.0], [id=tips, version=7.0.0], [id=webdriverlinux, version=17.0.0], [id=webdrivermacos, version=16.0.0], [id=webdriverwindows, version=17.0.0], [id=websocket, version=21.0.0], [id=zest, version=32.0.0]]
45[zap.out] 5178 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory  - Extensions loaded
46[zap.out] 5473 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows ZAP to check for updates
47[zap.out] 5479 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Options Extension
48[zap.out] 5483 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Edit Menu Extension
49[zap.out] 5483 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Provides a rest based API for controlling and accessing ZAP
50[zap.out] 5497 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Session State Extension
51[zap.out] 5501 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Report Extension
52[zap.out] 5502 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing History Extension
53[zap.out] 5504 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Show hidden fields and enable disabled fields
54[zap.out] 5505 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Search messages for strings and regular expressions
55[zap.out] 5507 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Encode/Decode/Hash...
56[zap.out] 5507 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to intercept and modify requests and responses
57[zap.out] 5509 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Passive scanner
58[zap.out] 5661 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Script Passive Scan Rules
59[zap.out] 5664 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Stats Passive Scan Rule
60[zap.out] 5664 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Application Error Disclosure
61[zap.out] 5665 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Absence of Anti-CSRF Tokens
62[zap.out] 5666 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Incomplete or No Cache-control and Pragma HTTP Header Set
63[zap.out] 5666 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Charset Mismatch
64[zap.out] 5666 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: CSP Scanner
65[zap.out] 5666 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Content-Type Header Missing
66[zap.out] 5666 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cookie No HttpOnly Flag
67[zap.out] 5666 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Loosely Scoped Cookie
68[zap.out] 5666 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cookie Without SameSite Attribute
69[zap.out] 5666 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cookie Without Secure Flag
70[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cross-Domain Misconfiguration
71[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cross-Domain JavaScript Source File Inclusion
72[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Information Disclosure - Debug Error Messages
73[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Information Disclosure - Sensitive Information in URL
74[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Information Disclosure - Sensitive Information in HTTP Referrer Header
75[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Information Disclosure - Suspicious Comments
76[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Weak Authentication Method
77[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Insecure JSF ViewState
78[zap.out] 5667 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Secure Pages Include Mixed Content
79[zap.out] 5668 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Private IP Disclosure
80[zap.out] 5668 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Session ID in URL Rewrite
81[zap.out] 5668 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Timestamp Disclosure
82[zap.out] 5668 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Username Hash Found
83[zap.out] 5669 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Viewstate Scanner
84[zap.out] 5670 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-AspNet-Version Response Header Scanner
85[zap.out] 5670 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-Content-Type-Options Header Missing
86[zap.out] 5671 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-Debug-Token Information Leak
87[zap.out] 5671 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-Frame-Options Header Scanner
88[zap.out] 5671 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
89[zap.out] 5671 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Big Redirect Detected (Potential Sensitive Information Leak)
90[zap.out] 5671 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Content Security Policy (CSP) Header Not Set
91[zap.out] 5672 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Directory Browsing
92[zap.out] 5672 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Hash Disclosure
93[zap.out] 5674 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Heartbleed OpenSSL Vulnerability (Indicative)
94[zap.out] 5674 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: HTTP to HTTPS Insecure Transition in Form Post
95[zap.out] 5674 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: HTTPS to HTTP Insecure Transition in Form Post
96[zap.out] 5675 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Reverse Tabnabbing
97[zap.out] 5675 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: PII Scanner
98[zap.out] 5675 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Retrieved from Cache
99[zap.out] 5675 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: HTTP Server Response Header Scanner
100[zap.out] 5675 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: HTTP Parameter Override
101[zap.out] 5677 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Strict-Transport-Security Header Scanner
102[zap.out] 5677 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: User Controllable Charset
103[zap.out] 5677 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cookie Poisoning
104[zap.out] 5677 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: User Controllable HTML Element Attribute (Potential XSS)
105[zap.out] 5677 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: User Controllable JavaScript Event (XSS)
106[zap.out] 5677 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Open Redirect
107[zap.out] 5677 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-Backend-Server Header Information Leak
108[zap.out] 5677 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-ChromeLogger-Data (XCOLD) Header Information Leak
109[zap.out] 5690 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to view and manage alerts
110[zap.out] 5694 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Active scanner, heavily based on the original Paros active scanner, but with additional tests added
111[zap.out] 5703 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionSequence
112[zap.out] 5706 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Spider used for automatically finding URIs on a site
113[zap.out] 5718 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing A set of common popup menus for miscellaneous tasks
114[zap.out] 5718 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Forced browsing of files and directories using code from the OWASP DirBuster tool
115[zap.out] 5719 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Simple but effective port scanner
116[zap.out] 5719 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Manual Request Editor Extension
117[zap.out] 5720 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Compares 2 sessions and generates an HTML file showing the differences
118[zap.out] 5720 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Invoke external applications passing context related information such as URLs and parameters
119[zap.out] 5720 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Handles anti cross site request forgery (CSRF) tokens
120[zap.out] 5729 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Authentication Extension
121[zap.out] 5743 [ZAP-daemon] INFO org.zaproxy.zap.extension.authentication.ExtensionAuthentication  - Loaded authentication method types: [Form-based Authentication, HTTP/NTLM Authentication, Manual Authentication, Script-based Authentication, JSON-based Authentication]
122[zap.out] 5744 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Creates a dynamic SSL certificate to allow SSL communications to be intercepted without warnings being generated by the browser
123[zap.out] 5745 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Logs errors to the Output tab in development mode only
124[zap.out] 5745 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Users Extension
125[zap.out] 5754 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Summarise and analyse FORM and URL parameters as well as cookies
126[zap.out] 5755 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Script integration
127[zap.out] 5799 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Scripting console, supports all JSR 223 scripting languages
128[zap.out] 6040 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Forced User Extension
129[zap.out] 6042 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Extension handling HTTP sessions
130[zap.out] 6043 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Zest is a specialized scripting language from Mozilla specifically designed to be used in security tools
131[zap.out] 6375 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionDiff
132[zap.out] 6378 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Post Table View Extension
133[zap.out] 6379 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Simple browser configuration
134[zap.out] 6379 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Session Management Extension
135[zap.out] 6387 [ZAP-daemon] INFO org.zaproxy.zap.extension.sessions.ExtensionSessionManagement  - Loaded session management method types: [Cookie-based Session Management, HTTP Authentication Session Management, Script-based Session Management]
136[zap.out] 6388 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Form Table View Extension
137[zap.out] 6389 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Capture messages from WebSockets with the ability to set breakpoints.
138[zap.out] 6406 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to import a file containing URLs which ZAP will access, adding them to the Sites tree
139[zap.out] 6408 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Core UI related functionality.
140[zap.out] 6408 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Authorization Extension
141[zap.out] 6408 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing AJAX Spider, uses Crawljax
142[zap.out] 6409 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Provides WebDrivers to control several browsers using Selenium and includes HtmlUnit browser.
143[zap.out] 6421 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Manages the local proxy configurations
144[zap.out] 6426 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Add-on that adds a set of tools for testing access control in web applications.
145[zap.out] 6426 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Handles adding Global Excluded URLs
146[zap.out] 6427 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Adds menu item to refresh the Sites tree
147[zap.out] 6427 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing OWASP ZAP User Guide
148[zap.out] 6427 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Provides a URL suitable for calling from target sites
149[zap.out] 6428 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to configure which extensions are loaded when ZAP starts
150[zap.out] 6429 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Combined HTTP Panels Extension
151[zap.out] 6429 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Hex View Extension
152[zap.out] 6429 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Image View Extension
153[zap.out] 6429 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Large Request View Extension
154[zap.out] 6430 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Large Response View Extension
155[zap.out] 6430 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Query Table View Extension
156[zap.out] 6431 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Syntax Highlighter View Extension
157[zap.out] 6436 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Adds support for configurable keyboard shortcuts for all of the ZAP menus.
158[zap.out] 6436 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Active and passive rule configuration
159[zap.out] 6439 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Statistics
160[zap.out] 6442 [ZAP-daemon] INFO org.zaproxy.zap.extension.stats.ExtensionStats  - Start recording in memory stats
161[zap.out] 6443 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing This extension allows a user to change the default values used by ZAP Spiders.
162[zap.out] 6446 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Translations of the core language files
163[zap.out] 6449 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Passive Scan Rules
164[zap.out] 6449 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Provides the foundation for concrete message types (for example, HTTP, WebSockets) expose fuzzer implementations.
165[zap.out] 6452 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows to fuzz HTTP messages.
166[zap.out] 6452 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Tips and Tricks
167[zap.out] 6454 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Active Scan Rules - beta
168[zap.out] 6454 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to spider and import OpenAPI (Swagger) definitions 
169[zap.out] 6486 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionSaveRawHttpMessage
170[zap.out] 6487 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Context alert rules filter
171[zap.out] 6488 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows to fuzz WebSocket messages.
172[zap.out] 6490 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Active Scan Rules
173[zap.out] 6491 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing The ZAP Getting Started Guide
174[zap.out] 6491 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Easy way to replace strings in requests and responses
175[zap.out] 6499 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing The Online menu links
176[zap.out] 6499 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionSaveXMLHttpMessage
177[zap.out] 6499 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Adds the Quick Start panel for scanning and exploring applications
178[zap.out] 6501 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Add the option to use the Ajax Spider in the Quick Start scan
179[zap.out] 6504 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Launch browsers proxying through ZAP
180[zap.out] 6505 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Launch browsers proxying through ZAP
181[zap.out] 6505 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Heads Up Display
182[zap.out] 6660 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionHUDlaunch
183[zap.out] 6664 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Passive Scan Rules - beta
184[zap.out] 7060 [ZAP-daemon] INFO org.zaproxy.zap.extension.callback.ExtensionCallback  - Started callback server on 0.0.0.0:40361
185[zap.out] 7061 [ZAP-daemon] INFO org.zaproxy.zap.extension.dynssl.ExtensionDynSSL  - Creating new root CA certificate
186[zap.out] 7963 [ZAP-daemon] INFO org.zaproxy.zap.extension.dynssl.ExtensionDynSSL  - New root CA certificate created
187[zap.out] 8974 [ZAP-daemon] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate  - There is/are 1 newer addons
188[zap.out] 10609 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate  - Installing new addon selenium v15.2.0
189[zap.out] 10986 [ZAP-DownloadInstaller] INFO org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate  - Finished installing new addon selenium v15.2.0
190[zap.out] 11015 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine  - Add-on downloaded to: /root/.ZAP_D/plugin/selenium-release-15.2.0.zap
191[zap.out] 11015 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine  - Add-on update check complete
192[zap.out] 11016 [ZAP-daemon] INFO org.zaproxy.zap.DaemonBootstrap  - ZAP is now listening on 0.0.0.0:43880
193[zap.out] 11514 [ZAP-ProxyThread-2] INFO org.parosproxy.paros.control.Control  - Discard Session
194[zap.out] 11537 [ZAP-ProxyThread-2] INFO org.parosproxy.paros.control.Control  - New Session
195[zap.out] 11543 [ZAP-ProxyThread-2] INFO org.parosproxy.paros.control.Control  - Create and Open Untitled Db
196[zap.out] 11573 [ZAP-ProxyThread-2] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - dataFileCache commit start
197[zap.out] 11576 [ZAP-ProxyThread-2] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - dataFileCache commit end
198[zap.out] 11583 [ZAP-ProxyThread-2] INFO hsqldb.db.HSQLDB379AF3D2020-04-06 18:39:38,995 The following 4 URLs were scanned:
199GET http://dast-4422333-dast-default.34.67.11.220.nip.io
200GET http://dast-4422333-dast-default.34.67.11.220.nip.io/
201GET http://dast-4422333-dast-default.34.67.11.220.nip.io/robots.txt
202GET http://dast-4422333-dast-default.34.67.11.220.nip.io/sitemap.xml
203Total of 3 URLs
204PASS: Cookie No HttpOnly Flag [10010]
205PASS: Cookie Without Secure Flag [10011]
206PASS: Incomplete or No Cache-control and Pragma HTTP Header Set [10015]
207PASS: Cross-Domain JavaScript Source File Inclusion [10017]
208PASS: Content-Type Header Missing [10019]
209PASS: X-Frame-Options Header Scanner [10020]
210PASS: X-Content-Type-Options Header Missing [10021]
211PASS: Information Disclosure - Debug Error Messages [10023]
212PASS: Information Disclosure - Sensitive Information in URL [10024]
213PASS: Information Disclosure - Sensitive Information in HTTP Referrer Header [10025]
214PASS: HTTP Parameter Override [10026]
215PASS: Information Disclosure - Suspicious Comments [10027]
216PASS: Open Redirect [10028]
217PASS: Cookie Poisoning [10029]
218PASS: User Controllable Charset [10030]
219PASS: User Controllable HTML Element Attribute (Potential XSS) [10031]
220PASS: Viewstate Scanner [10032]
221PASS: Directory Browsing [10033]
222PASS: Heartbleed OpenSSL Vulnerability (Indicative) [10034]
223PASS: Strict-Transport-Security Header Scanner [10035]
224PASS: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037]
225PASS: Content Security Policy (CSP) Header Not Set [10038]
226PASS: X-Backend-Server Header Information Leak [10039]
227PASS: Secure Pages Include Mixed Content [10040]
228PASS: HTTP to HTTPS Insecure Transition in Form Post [10041]
229PASS: HTTPS to HTTP Insecure Transition in Form Post [10042]
230PASS: User Controllable JavaScript Event (XSS) [10043]
231PASS: Big Redirect Detected (Potential Sensitive Information Leak) [10044]
232PASS: Retrieved from Cache [10050]
233PASS: X-ChromeLogger-Data (XCOLD) Header Information Leak [10052]
234PASS: Cookie Without SameSite Attribute [10054]
235PASS: CSP Scanner [10055]
236PASS: X-Debug-Token Information Leak [10056]
237PASS: Username Hash Found [10057]
238PASS: X-AspNet-Version Response Header Scanner [10061]
239PASS: PII Scanner [10062]
240PASS: Timestamp Disclosure [10096]
241PASS: Hash Disclosure [10097]
242PASS: Cross-Domain Misconfiguration [10098]
243PASS: Weak Authentication Method [10105]
244PASS: Reverse Tabnabbing [10108]
245PASS: Absence of Anti-CSRF Tokens [10202]
246PASS: Private IP Disclosure [2]
247PASS: Session ID in URL Rewrite [3]
248PASS: Script Passive Scan Rules [50001]
249PASS: Insecure JSF ViewState [90001]
250PASS: Charset Mismatch [90011]
251PASS: Application Error Disclosure [90022]
252PASS: Loosely Scoped Cookie [90033]
253WARN-NEW: Server Leaks Version Information via "Server" HTTP Response Header Field [10036] x 4 
254	http://dast-4422333-dast-default.34.67.11.220.nip.io/ (404 Not Found)
255	http://dast-4422333-dast-default.34.67.11.220.nip.io/robots.txt (404 Not Found)
256	http://dast-4422333-dast-default.34.67.11.220.nip.io/sitemap.xml (404 Not Found)
257	http://dast-4422333-dast-default.34.67.11.220.nip.io (404 Not Found)
258FAIL-NEW: 0	FAIL-INPROG: 0	WARN-NEW: 1	WARN-INPROG: 0	INFO: 0	IGNORE: 0	PASS: 49
259cat: /tmp/.X1-lock: No such file or directory
260/zap/zap-x.sh: 10: kill: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
261kill -l [exitstatus]
 262  Running after_script  
  00:02
 263  Saving cache  
  00:01
 264  Uploading artifacts for successful job  
  00:03
265Uploading artifacts...
266gl-dast-report.json: found 1 matching files        
267Uploading artifacts to coordinator... ok            id=37141770 responseStatus=201 Created token=KyrQehV2
268Job succeeded
Admin message

Admin message
