buildanything 1.8.0 → 2.0.0

package/skills/web/zap-scan-config/references/false_positive_handling.md

@@ -0,0 +1,427 @@
+# ZAP False Positive Handling Guide
+
+Guide for identifying, verifying, and suppressing false positives in OWASP ZAP scan results.
+
+## Overview
+
+DAST tools like ZAP generate false positives - alerts for issues that aren't actually exploitable vulnerabilities. This guide helps you:
+
+1. Identify common false positives
+2. Verify findings manually
+3. Suppress false positives in future scans
+4. Tune scan policies
+
+## Common False Positives
+
+### 1. X-Content-Type-Options Missing
+
+**Alert:** Missing X-Content-Type-Options header
+
+**False Positive Scenario:**
+- Static content served by CDNs
+- Third-party resources
+- Legacy browsers not supported
+
+**Verification:**
+```bash
+curl -I https://example.com/static/script.js
+# Check if browser performs MIME sniffing
+```
+
+**When to Suppress:**
+- Static content only (CSS, JS, images)
+- Content served from trusted CDN
+- No user-controlled content in responses
+
+**Suppression Rule:**
+```tsv
+10021	https://cdn.example.com/.*	.*	693	IGNORE
+```
+
+### 2. Cookie Without Secure Flag
+
+**Alert:** Cookie without Secure flag set
+
+**False Positive Scenario:**
+- Development/testing environments (HTTP)
+- Non-sensitive cookies (analytics, preferences)
+- Localhost testing
+
+**Verification:**
+```bash
+curl -I https://example.com
+# Check Set-Cookie headers
+# Verify if cookie contains sensitive data
+```
+
+**When to Suppress:**
+- Non-sensitive cookies (theme preference, language)
+- HTTP-only development environments
+- Third-party analytics cookies
+
+**Suppression Rule:**
+```tsv
+10054	https://example.com.*	_ga|_gid|theme	614	WARN
+```
+
+### 3. Cross-Domain JavaScript Source File Inclusion
+
+**Alert:** JavaScript loaded from external domain
+
+**False Positive Scenario:**
+- Legitimate CDN usage (jQuery, Bootstrap, etc.)
+- Third-party integrations (Google Analytics, Stripe)
+- Using Subresource Integrity (SRI)
+
+**Verification:**
+```html
+<!-- Check if SRI is used -->
+<script src="https://cdn.example.com/library.js"
+        integrity="sha384-HASH"
+        crossorigin="anonymous"></script>
+```
+
+**When to Suppress:**
+- CDN resources with SRI
+- Trusted third-party services
+- Company-owned CDN domains
+
+**Suppression Rule:**
+```tsv
+10017	https://example.com/.*	https://cdn.jsdelivr.net/.*	829	IGNORE
+```
+
+### 4. Timestamp Disclosure
+
+**Alert:** Unix timestamps found in response
+
+**False Positive Scenario:**
+- Legitimate timestamp fields in API responses
+- Non-sensitive metadata
+- Public timestamps (post dates, etc.)
+
+**Verification:**
+```json
+{
+  "created_at": 1640995200,  // Legitimate field
+  "post_date": "2022-01-01"
+}
+```
+
+**When to Suppress:**
+- API responses with datetime fields
+- Public-facing timestamps
+- Non-sensitive metadata
+
+**Suppression Rule:**
+```tsv
+10096	https://api.example.com/.*	created_at|updated_at	200	IGNORE
+```
+
+### 5. Server Version Disclosure
+
+**Alert:** Server version exposed in headers
+
+**False Positive Scenario:**
+- Behind WAF/load balancer (version is of proxy, not app server)
+- Generic server headers
+- Already public knowledge
+
+**Verification:**
+```bash
+curl -I https://example.com | grep Server
+# Check if version matches actual server
+```
+
+**When to Suppress:**
+- Proxy/WAF version (not actual app server)
+- Generic headers without version numbers
+- When other compensating controls exist
+
+**Suppression Rule:**
+```tsv
+10036	https://example.com.*	.*	200	WARN
+```
+
+## Verification Methodology
+
+### Step 1: Understand the Alert
+
+Review ZAP alert details:
+- **Description:** What is the potential vulnerability?
+- **Evidence:** What triggered the alert?
+- **CWE/OWASP Mapping:** What category does it fall under?
+- **Risk Level:** How severe is it?
+
+### Step 2: Reproduce Manually
+
+Attempt to exploit the vulnerability:
+
+```bash
+# For XSS alerts
+curl "https://example.com/search?q=<script>alert(1)</script>"
+# Check if script is reflected unencoded
+
+# For SQL injection alerts
+curl "https://example.com/api/user?id=1' OR '1'='1"
+# Check for SQL errors or unexpected behavior
+
+# For path traversal alerts
+curl "https://example.com/download?file=../../etc/passwd"
+# Check if file is accessible
+```
+
+### Step 3: Check Context
+
+Consider the application context:
+- Is the functionality available to unauthenticated users?
+- Does it handle sensitive data?
+- Are there compensating controls (WAF, input validation)?
+
+### Step 4: Document Decision
+
+Create documentation for suppression decisions:
+
+```markdown
+## Alert: SQL Injection in /api/user
+
+**Decision:** False Positive
+
+**Rationale:**
+- Endpoint requires authentication
+- Input is validated server-side (allowlist: 0-9 only)
+- WAF rule blocks SQL injection patterns
+- Manual testing confirmed no injection possible
+
+**Suppressed:** Yes (Rule ID 40018, /api/user endpoint)
+
+**Reviewed by:** security-team@example.com
+**Date:** 2024-01-15
+```
+
+## Creating Suppression Rules
+
+### Rules File Format
+
+ZAP uses TSV (tab-separated values) format:
+
+```
+alert_id	URL_pattern	parameter	CWE_id	action
+```
+
+- **alert_id:** ZAP alert ID (e.g., 40018 for SQL Injection)
+- **URL_pattern:** Regex pattern for URL
+- **parameter:** Parameter name (or .* for all)
+- **CWE_id:** CWE identifier
+- **action:** IGNORE, WARN, or FAIL
+
+### Example Rules File
+
+`.zap/rules.tsv`:
+
+```tsv
+# Suppress X-Content-Type-Options for CDN static content
+10021	https://cdn.example.com/static/.*	.*	693	IGNORE
+
+# Warn (don't fail) on analytics cookies without Secure flag
+10054	https://example.com/.*	_ga|_gid	614	WARN
+
+# Ignore timestamp disclosure in API responses
+10096	https://api.example.com/.*	.*	200	IGNORE
+
+# Ignore legitimate external JavaScript (with SRI)
+10017	https://example.com/.*	https://cdn.jsdelivr.net/.*	829	IGNORE
+
+# Suppress CSRF warnings for stateless API
+10202	https://api.example.com/.*	.*	352	IGNORE
+```
+
+### Using Rules File
+
+```bash
+# Baseline scan with rules
+docker run -t zaproxy/zap-stable zap-baseline.py \
+  -t https://example.com \
+  -c .zap/rules.tsv \
+  -r report.html
+
+# Full scan with rules
+docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap-full-scan.py \
+  -t https://example.com \
+  -c /zap/wrk/.zap/rules.tsv \
+  -r /zap/wrk/report.html
+```
+
+## Custom Scan Policies
+
+### Disable Entire Scan Rules
+
+Create custom scan policy to disable problematic rules:
+
+1. **Via ZAP GUI:**
+   - Analyze > Scan Policy Manager
+   - Create new policy
+   - Disable specific rules
+   - Export policy file
+
+2. **Via Automation Framework:**
+
+```yaml
+# zap_automation.yaml
+jobs:
+  - type: activeScan
+    parameters:
+      policy: Custom-Policy
+    rules:
+      - id: 40018  # SQL Injection
+        threshold: MEDIUM
+        strength: HIGH
+      - id: 10202  # CSRF
+        threshold: OFF  # Disable completely
+```
+
+## Handling Different Alert Types
+
+### High-Risk Alerts (Never Suppress Without Verification)
+
+- SQL Injection
+- Command Injection
+- Remote Code Execution
+- Authentication Bypass
+- Server-Side Request Forgery (SSRF)
+
+**Process:**
+1. Manual verification required
+2. Security team review
+3. Document compensating controls
+4. Re-test after fixes
+
+### Medium-Risk Alerts (Contextual Suppression)
+
+- XSS (if output is properly encoded)
+- CSRF (if tokens are implemented)
+- Missing headers (if compensating controls exist)
+
+**Process:**
+1. Verify finding
+2. Check for compensating controls
+3. Document decision
+4. Suppress with WARN (not IGNORE)
+
+### Low-Risk Alerts (Can Be Suppressed)
+
+- Informational headers
+- Timestamp disclosure
+- Technology fingerprinting
+
+**Process:**
+1. Quick verification
+2. Document reason
+3. Suppress with IGNORE
+
+## Quality Assurance
+
+### Review Suppression Rules Regularly
+
+```bash
+# Monthly review checklist
+- [ ] Review all suppression rules for continued relevance
+- [ ] Check if suppressed issues have been fixed
+- [ ] Verify compensating controls are still in place
+- [ ] Update rules file with new false positives
+```
+
+### Track Suppression Metrics
+
+Monitor suppression trends:
+
+```bash
+# Count suppressions by alert type
+grep -v '^#' .zap/rules.tsv | awk '{print $1}' | sort | uniq -c
+
+# Alert if suppression count increases significantly
+```
+
+### Peer Review Process
+
+Require security team approval for suppressing high-risk alerts:
+
+```yaml
+# .github/workflows/security-review.yml
+- name: Check for new suppressions
+  run: |
+    git diff origin/main .zap/rules.tsv > suppressions.diff
+    if [ -s suppressions.diff ]; then
+      echo "New suppressions require security team review"
+      # Notify security team
+    fi
+```
+
+## Anti-Patterns to Avoid
+
+### ❌ Don't Suppress Everything
+
+Never create blanket suppression rules:
+
+```tsv
+# BAD: Suppresses all XSS findings
+40012	.*	.*	79	IGNORE
+```
+
+### ❌ Don't Suppress Without Documentation
+
+Always document why a finding is suppressed:
+
+```tsv
+# BAD: No context
+10054	https://example.com/.*	session_id	614	IGNORE
+
+# GOOD: Documented reason
+# Session cookie is HTTPS-only in production; suppressing for staging environment
+10054	https://staging.example.com/.*	session_id	614	IGNORE
+```
+
+### ❌ Don't Ignore High-Risk Findings
+
+Never suppress critical vulnerabilities without thorough investigation:
+
+```tsv
+# DANGEROUS: Never suppress SQL injection without verification
+40018	https://example.com/.*	.*	89	IGNORE
+```
+
+## Tools and Scripts
+
+### Analyze ZAP JSON Report
+
+```python
+#!/usr/bin/env python3
+import json
+import sys
+
+with open('report.json') as f:
+    report = json.load(f)
+
+false_positives = []
+for site in report['site']:
+    for alert in site['alerts']:
+        if alert['risk'] in ['High', 'Medium']:
+            print(f"{alert['alert']} - {alert['risk']}")
+            print(f"  URL: {alert['url']}")
+            print(f"  Evidence: {alert.get('evidence', 'N/A')}")
+            print()
+```
+
+### Generate Suppression Rules Template
+
+```bash
+# Extract unique alert IDs from report
+jq -r '.site[].alerts[] | "\(.pluginid)\t\(.url)\t.*\t\(.cweid)\tWARN"' report.json \
+  | sort -u > rules-template.tsv
+```
+
+## Additional Resources
+
+- [ZAP Alert Details](https://www.zaproxy.org/docs/alerts/)
+- [ZAP Scan Rules](https://www.zaproxy.org/docs/docker/baseline-scan/)
+- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)

package/skills/web/zap-scan-config/references/owasp_mapping.md

@@ -0,0 +1,255 @@
+# OWASP ZAP Alert Mapping to OWASP Top 10 2021 and CWE
+
+This reference maps common OWASP ZAP alerts to OWASP Top 10 2021 categories and CWE (Common Weakness Enumeration) identifiers for compliance and reporting.
+
+## OWASP Top 10 2021 Coverage
+
+### A01:2021 - Broken Access Control
+
+**ZAP Alerts:**
+- Path Traversal (CWE-22)
+- Directory Browsing (CWE-548)
+- Cross-Domain Misconfiguration (CWE-346)
+- Bypassing Access Controls (CWE-284)
+
+**Risk Level:** High to Medium
+
+**Remediation:**
+- Implement proper access control checks on server-side
+- Use allowlists for file access patterns
+- Disable directory listing
+- Enforce CORS policies strictly
+
+### A02:2021 - Cryptographic Failures
+
+**ZAP Alerts:**
+- Weak SSL/TLS Ciphers (CWE-327)
+- Cookie Without Secure Flag (CWE-614)
+- Password Autocomplete (CWE-522)
+- Sensitive Information in URL (CWE-598)
+
+**Risk Level:** High to Medium
+
+**Remediation:**
+- Use TLS 1.2+ with strong cipher suites
+- Set Secure and HttpOnly flags on all cookies
+- Disable autocomplete for sensitive fields
+- Never transmit sensitive data in URLs
+
+### A03:2021 - Injection
+
+**ZAP Alerts:**
+- SQL Injection (CWE-89)
+- Cross-Site Scripting (XSS) (CWE-79)
+- Command Injection (CWE-78)
+- LDAP Injection (CWE-90)
+- XML Injection (CWE-91)
+- XPath Injection (CWE-643)
+
+**Risk Level:** High
+
+**Remediation:**
+- Use parameterized queries (prepared statements)
+- Implement context-aware output encoding
+- Validate and sanitize all user input
+- Use allowlists for input validation
+- Implement Content Security Policy (CSP)
+
+### A04:2021 - Insecure Design
+
+**ZAP Alerts:**
+- Application Error Disclosure (CWE-209)
+- Insufficient Anti-automation (CWE-799)
+- Missing Rate Limiting
+
+**Risk Level:** Medium to Low
+
+**Remediation:**
+- Implement proper error handling (generic error messages)
+- Add CAPTCHA or rate limiting for sensitive operations
+- Design security controls during architecture phase
+- Implement anti-automation measures
+
+### A05:2021 - Security Misconfiguration
+
+**ZAP Alerts:**
+- Missing Security Headers (CWE-693)
+  - X-Content-Type-Options
+  - X-Frame-Options (CWE-1021)
+  - Content-Security-Policy
+  - Strict-Transport-Security (HSTS)
+- Server Leaks Information (CWE-200)
+- Default Credentials
+- Unnecessary HTTP Methods Enabled (CWE-650)
+
+**Risk Level:** Medium to Low
+
+**Remediation:**
+- Configure all security headers properly
+- Remove server version headers
+- Disable unnecessary HTTP methods (PUT, DELETE, TRACE)
+- Change default credentials
+- Implement minimal privilege principle
+
+### A06:2021 - Vulnerable and Outdated Components
+
+**ZAP Alerts:**
+- Outdated Software Version Detected
+- Known Vulnerable Components (requires integration with CVE databases)
+
+**Risk Level:** High to Medium
+
+**Remediation:**
+- Maintain software inventory
+- Regularly update dependencies and libraries
+- Subscribe to security advisories
+- Use dependency scanning tools (OWASP Dependency-Check, Snyk)
+
+### A07:2021 - Identification and Authentication Failures
+
+**ZAP Alerts:**
+- Weak Authentication (CWE-287)
+- Session Fixation (CWE-384)
+- Session ID in URL Rewrite (CWE-598)
+- Cookie No HttpOnly Flag (CWE-1004)
+- Credential Enumeration (CWE-209)
+
+**Risk Level:** High
+
+**Remediation:**
+- Implement multi-factor authentication (MFA)
+- Use secure session management
+- Regenerate session IDs after login
+- Set HttpOnly and Secure flags on session cookies
+- Implement account lockout mechanisms
+- Use generic error messages for authentication failures
+
+### A08:2021 - Software and Data Integrity Failures
+
+**ZAP Alerts:**
+- Missing Subresource Integrity (SRI) (CWE-353)
+- Insecure Deserialization (CWE-502)
+
+**Risk Level:** High to Medium
+
+**Remediation:**
+- Implement Subresource Integrity for CDN resources
+- Avoid deserializing untrusted data
+- Use digital signatures for critical data
+- Implement integrity checks
+
+### A09:2021 - Security Logging and Monitoring Failures
+
+**ZAP Alerts:**
+- Authentication attempts not logged
+- No monitoring of security events
+
+**Risk Level:** Low (detection issue, not vulnerability)
+
+**Remediation:**
+- Log all authentication attempts
+- Monitor for security anomalies
+- Implement centralized logging
+- Set up alerts for suspicious activities
+
+### A10:2021 - Server-Side Request Forgery (SSRF)
+
+**ZAP Alerts:**
+- Server-Side Request Forgery (CWE-918)
+- External Redirect (CWE-601)
+
+**Risk Level:** High
+
+**Remediation:**
+- Validate and sanitize all URLs
+- Use allowlists for allowed domains
+- Disable unnecessary URL schemas (file://, gopher://)
+- Implement network segmentation
+
+## ZAP Alert ID to OWASP/CWE Quick Reference
+
+| Alert ID | Alert Name | OWASP 2021 | CWE | Risk |
+|----------|-----------|------------|-----|------|
+| 40018 | SQL Injection | A03 | CWE-89 | High |
+| 40012 | Cross-Site Scripting (Reflected) | A03 | CWE-79 | High |
+| 40014 | Cross-Site Scripting (Persistent) | A03 | CWE-79 | High |
+| 40013 | Cross-Site Scripting (DOM) | A03 | CWE-79 | High |
+| 6 | Path Traversal | A01 | CWE-22 | High |
+| 7 | Remote File Inclusion | A01 | CWE-98 | High |
+| 90019 | Server-Side Code Injection | A03 | CWE-94 | High |
+| 90020 | Remote OS Command Injection | A03 | CWE-78 | High |
+| 90033 | Loosely Scoped Cookie | A07 | CWE-565 | Medium |
+| 10021 | X-Content-Type-Options Missing | A05 | CWE-693 | Low |
+| 10020 | X-Frame-Options Missing | A05 | CWE-1021 | Medium |
+| 10038 | Content Security Policy Missing | A05 | CWE-693 | Medium |
+| 10035 | Strict-Transport-Security Missing | A05 | CWE-319 | Low |
+| 10054 | Cookie Without Secure Flag | A02 | CWE-614 | Medium |
+| 10010 | Cookie No HttpOnly Flag | A07 | CWE-1004 | Medium |
+| 10098 | Cross-Domain Misconfiguration | A01 | CWE-346 | Medium |
+| 10055 | CSP Scanner: Wildcard Directive | A05 | CWE-693 | Medium |
+| 10096 | Timestamp Disclosure | A05 | CWE-200 | Low |
+| 10049 | Weak Authentication Method | A07 | CWE-287 | Medium |
+| 40029 | Server-Side Request Forgery | A10 | CWE-918 | High |
+
+## Risk Level Priority Matrix
+
+### High Risk (Immediate Action Required)
+- SQL Injection
+- Remote Code Execution
+- Authentication Bypass
+- SSRF
+- XXE (XML External Entity)
+
+### Medium Risk (Fix in Current Sprint)
+- XSS (Cross-Site Scripting)
+- CSRF (Cross-Site Request Forgery)
+- Missing Security Headers (CSP, X-Frame-Options)
+- Insecure Cookie Configuration
+- Path Traversal (with limited impact)
+
+### Low Risk (Fix in Backlog)
+- Information Disclosure (version headers)
+- Missing Informational Headers
+- Timestamp Disclosure
+- Autocomplete on Form Fields
+
+### Informational (Documentation/Awareness)
+- Server Technology Disclosure
+- Application Error Messages
+- Charset Mismatch
+
+## Compliance Mapping
+
+### PCI-DSS 3.2.1
+- **Requirement 6.5.1** (Injection): SQL Injection, Command Injection, XSS
+- **Requirement 6.5.3** (Insecure Cryptography): Weak SSL/TLS, Insecure Cookies
+- **Requirement 6.5.7** (XSS): All XSS variants
+- **Requirement 6.5.8** (Access Control): Path Traversal, Broken Access Control
+- **Requirement 6.5.10** (Authentication): Weak Authentication, Session Management
+
+### NIST 800-53
+- **AC-3** (Access Enforcement): Path Traversal, Authorization Issues
+- **IA-5** (Authenticator Management): Weak Authentication
+- **SC-8** (Transmission Confidentiality): Missing HTTPS, Weak TLS
+- **SI-10** (Information Input Validation): All Injection Flaws
+
+### GDPR
+- **Article 32** (Security of Processing): All High/Medium findings affecting data security
+- **Article 25** (Data Protection by Design): Security Misconfigurations
+
+## Usage in Reports
+
+When generating compliance reports, reference this mapping to:
+
+1. **Categorize findings** by OWASP Top 10 category
+2. **Assign CWE IDs** for standardized vulnerability classification
+3. **Map to compliance requirements** for audit trails
+4. **Prioritize remediation** based on risk level and compliance impact
+5. **Track metrics** by OWASP category over time
+
+## Additional Resources
+
+- [OWASP Top 10 2021](https://owasp.org/Top10/)
+- [CWE Top 25](https://cwe.mitre.org/top25/)
+- [ZAP Alert Details](https://www.zaproxy.org/docs/alerts/)
+- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)