zaproxy / zaproxy/community-scripts
Missing exclude path in FullScanDvwaAuth.yaml
Open
Beginner friendly
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 895
- Forks
- 260
- Avg merge
- 53m
- Merged PRs (30d)
- 1
Description
I was testing with the FullScanDvwaAuth.yaml in other/af-plans/
The automation works well but in the yml the should be an additional excludepath: "http://localhost:4280/vulnerabilities/cryptography.*"
Not having this excludepath makes the spider find thousands of urls on the /vulnerabilities/cryptography?token= endpoint.
Can this be fixed?
Thanks!
Regards,
Rob
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open other/af-plans/FullScanDvwaAuth.yaml and inspect its existing excludepath settings. Add the requested exclusion for the cryptography endpoint, then run the automation plan and verify the spider no longer discovers thousands of matching URLs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- yaml
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 90/100