Add ScanRuleMetadata to Active and Passive Scan Rules

Tracker issue for adding ScanRuleMetadata to active and passive scripts in this repo.

There are some scripts in the list below which may clash with existing rules in one of the scan rule add-ons (e.g. the check done by X-Powered-By_header_checker.js script is also done by the XPoweredByHeaderInfoLeakScanRule scan rule). We should either remove the script or the scan rule to avoid duplicate alerts.

Also, WebSocket passive scripts are not included here since they don't support the getMetadata() function at the moment.

Active

• bxss.py
• corsair.py
• Cross Site WebSocket Hijacking.js
• cve-2019-5418.js
• gof_lite.js (Duplicate of: BackupFileDisclosureScanRule.java)
• JWT None Exploit.js
• RCE.py
• SSTI.js
• SSTI.py
• TestInsecureHTTPVerbs.py
• User defined attacks.js

Passive

• clacks.js
• CookieHTTPOnly.js
• detect_csp_notif_and_reportonly.js
• detect_samesite_protection.js
• f5_bigip_cookie_internal_ip.js
• find base64 strings.js
• Find Credit Cards.js
• Find Emails.js
• Find Hashes.js
• Find HTML Comments.js
• Find IBANs.js
• Find Internal IPs.js
• find_reflected_params.py
• google_api_keys_finder.js
• HUNT.py
• JavaDisclosure.js
• Mutliple Security Header Check.js
• Report non static sites.js
• RPO.js
• s3.js
• Server Header Disclosure.js
• SQL injection detection.js
• Telerik Using Poor Crypto.js
• Upload form discovery.js
• X-Powered-By_header_checker.js (Duplicate of: XPoweredByHeaderInfoLeakScanRule)

Start with the unchecked active scripts bxss.py, corsair.py, RCE.py, SSTI.py, TestInsecureHTTPVerbs.py, and User defined attacks.js, then review the linked ScanRuleMetadata tracker issue. Check the listed passive scripts and existing scan-rule links for duplicate alerts; done means the remaining scripts support metadata and identified duplicates are resolved.