Giter Site home page Giter Site logo

zaproxy / zaproxy-website Goto Github PK

View Code? Open in Web Editor NEW
61.0 11.0 104.0 69.51 MB

The source of ZAP website

Home Page: https://www.zaproxy.org

License: MIT License

JavaScript 6.16% Dockerfile 0.19% Shell 0.59% HTML 74.49% CSS 6.40% SCSS 11.46% Python 0.71%

zaproxy-website's Introduction

ZAP Website

Development

To work on the website you'll need to have either node.js or Docker installed. In your development environment npm run preview will start up a webpack-dev-server on port 3000 for development which will hot-reload the site as file changes are detected.

Docker

The suggested setup for development is using the Docker.

# Build image
docker build -t zaproxy-website .

# Start container with image of zaproxy-website
docker run -it -v "$(pwd)/site:/app/site" \
    -v "$(pwd)/src:/app/src" -p 3000:3000 zaproxy-website npm run preview

Dependencies

For development, the site heavily depends on node.js for utilities that build the front-end CSS & JavaScript. The entrypoint for modifying the site JavaScript is src/index.js which gets transpiled using babel & packed up with webpack packages.

# Check for associated vulns
npm audit

# Check for packages
npm outdated

# Update a package
npm update @babel/core

Building

./bin/build.sh
cp -r ./dist/ ../zaproxy-website-builds
cd ../zaproxy-website-builds
git push origin staging

Hugo

Generically speaking, the term post & page can be used interchangeably, the exception is when content types are defined (type: post)

Structure

https://gohugo.io/getting-started/directory-structure/

|--site                // Everything in here will be built with hugo
|  |--content          // Posts and collections - ask if you need extra posts
|  |--data             // YAML data files with any data for use in examples
|  |--layouts          // This is where all templates go
|  |  |--_default      // This is where the default layouts live
|  |  |--partials      // This is where includes live
|  |  |--index.html    // The index page
|  |--static           // Files in here ends up in the public folder
|--src                 // Files that will pass through the asset pipeline
|  |--css              // Webpack will bundle imported css seperately
|  |--index.js         // index.js is the webpack entry for your css & js assets

Content

For adding & modifying content the place to be is site/content/. Content is written in the form of markdown files with YAML headers including details about the post such as title, date & layout. The name of the file is tranformed into a url when the site is generated. A file named site/content/download.md becomes /download. Additionally, any folder structure you create in that directory will be reflected in the sites' url heirarchy. That means site/content/blog/2017-08-22-zap-browser-launch.md becomes /blog/2017-08-22-zap-browser-launch.

Sample

---
type: page
title: Get Involved
---

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vivamus et dui ligula. 
Donec semper ex at molestie scelerisque. In sodales bibendum leo, vitae porttitor
est viverra at. Phasellus tincidunt enim ac rutrum convallis. Duis at tellus a
erat consequat fringilla. Ut augue leo, blandit vel d

## Mauris

You can also use hugo commands to create the yaml content files.

# Move to site directory
cd site/

# Create generic content file
hugo new contributing.md

# Create a content file using the site/archetypes/blog.md template
hugo new blog/$(date -v +7d '+%Y-%m-%d')-learning-zap-api/index.md

For keeping content organized you also have the option of encapsulating the content of a post in a directory. If a post has a number of images or other assets related to it, it is much cleaner to include those assets with the post instead of putting them all in the assets directory. For example instead of having site/content/download.md, you could have site/content/download/index.md & all the post's related images would also live in that same download directory.

New Content

For adding new categories of content such as addons or wiki entries follow the pattern below using addons as an example

  • Create the content directory mkdir -p site/content/addons/{images,icons}
  • If there IS NOT a lot of media within that section, copy images into the images directory
  • If the content IS media heavy, insteading of creating a single markdown file per post, create a directory with the post name
    • site/content/addons/active-scan-rules/images/
  • If there is sub pages of content, then you will also need to create the directories that reflect the content structure
    • For example for Access Control Context Options you would use one of the structures depending on the depth of the content
      • site/content/addons/access-control/context-options/_index.md
      • site/content/addons/access-control/context-options.md
  • When you create entries that, include a type in the header
Sample

site/content/addons/active-scan-rules.md

---
title: "Active Scan Rules"
type: addon
status: alpha
icon: 
---

Layouts

For controlling what HTML is rendered, you need to work with the site templates. In the directory, site/layouts/, you'll find a number of HTML files with various template tags. The first file to check out is site/layouts/_default/baseof.html - this is the base layout Hugo uses to build your site that templates extend. Hugo has a lookup order for associating a content entry to a template. A single entry whose type is post (type: post), Hugo will look for a layout in site/layouts/post/single.html, and if that does not exist, it will fallback to site/layouts/_default/single.html.

For generic posts, the lookup resolution works great, but sometimes you have posts that requires custom layouts, such as the downloads page. In those cases, you can specifiy the layout in the content markdown file & it will lookup the template.

This is what site/content/download.md currently looks like which resolves to the template found site/layouts/page/download.html.

type: page
layout: download
---

Data

Data that is shared across the site lives in site/data/. For example, a list of all the site authors is an example of a piece of data you would reference across numerous places on the site. You can create site/data/authors.yaml.

---
- name: 'Simon Bennets'
  picture: 'https://pbs.twimg.com/profile_images/2186782633/simonbennetts2_400x400.jpg'
  twitter: '@psiinon'
  is_core: true

- name: 'David Scrobonia'
  picture: 'https://pbs.twimg.com/profile_images/1132029219876347904/FYA3rHRq_400x400.png'
  twitter: '@david_scrobonia'
  is_core: true

Later, in the templates, you would reference that data & the template would render.

{{ range $author := $.Site.Data.authors }}
    <section class="post-author-single flex p-10">
      <div class="col-1-5">
        <img class="author-picture" src="{{ $author.picture }}" />
      </div>
      <div class="author-name col-4-5">
        {{ $author.name }}
        <a class="author-twitter" href="https://twitter.com/{{ $author.twitter }}">{{ $author.twitter }}</a>
      </div>
    </section>
{{ end }}

https://gohugo.io/templates/data-templates/

Frontend Assets

Static

For assets that are completely static and don't need to go through the asset pipeline, use the site/static folder. Images, font-files, etc, all go there. Files in the static folder end up in the web root. So a file called site/static/favicon.ico will end up being available as /favicon.ico and so on...

CSS/SCSS

All the CSS is written in SCSS ("Sassy CSS") with all the files in src/css/ with src/css/main.css being the entrypoint, defining main variables & importing the needed styles.

Styles are separated by broad category, component and post specific styles. For example, if you need to change the typography across the entire site, src/css/_type.scss is the file to edit.

https://sass-lang.com/documentation/syntax

JavaScript

The src/index.js file is the entrypoint for webpack and will be built to /dist/main.js

You can use ES6 and use both relative imports or import libraries from npm. Any CSS file imported into the index.js will be run through Webpack, compiled with PostCSS Next, and minified to /dist/[name].[hash:5].css. Import statements will be resolved as part of the build.

Basic Concepts

You can read more about Hugo's template language in their documentation below. The most useful page there is the one about the available functions.

Environment variables

To separate the development and production - aka build - stages, all gulp tasks run with a node environment variable named either development or production.

You can access the environment variable inside the theme files with getenv "NODE_ENV". See the following example for a conditional statement:

{{ if eq (getenv "NODE_ENV") "development" }}You're in development!{{ end }}

All tasks starting with build set the environment variable to production - the other will set it to development.

Helpful Links

zaproxy-website's People

Contributors

aryangupta701 avatar atomtigerzoo avatar bdougie avatar biilmann avatar calavera avatar dependabot[bot] avatar eingengraou avatar erquhart avatar fool avatar jammasterj89 avatar jhardy avatar kingthorin avatar lpmi-13 avatar mattsturgeon avatar moeez905 avatar njmulsqb avatar piedone avatar preetkaran20 avatar psiinon avatar rdarkflow avatar renovate[bot] avatar rezen avatar ricekot avatar sibiraj-s avatar skyplabs avatar sshniro avatar thc202 avatar vitikasoni avatar yns000 avatar zapbot avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

zaproxy-website's Issues

Dev page: how to debug ZAP and add-ons

How to use a debugger with ZAP (which sould be relatively easy) and add-ons (which will be harder).
Ideally should be IDE independant, or if necessary include sections for different IDS. These can be added to over time of course :)

Enable "Edit on GitHub" in more pages

Enable on:

  • FAQs
  • Guides
  • User Guide (requires changes in help converter)
  • Blog posts
  • ?

How about we add a link (in the footer maybe?) to the relevant github file so people can easily suggest changes?
Hopefully these can be automated, but in some cases (like the evangelists) we'd need to add manual links to the relevant data files.

ZAP Scan Baseline Report

View the following link to download the report.
RunnerID:3678363333

Urls for each download

Currently on the website downloads are tracked with a track-event attribute which hooks into Google Analytics. What if instead the links were to url(s) unique for each installer which redirected to the correct download? This would provide the benefit of access logs providing stats instead of just Google Analytics.

ZAP Scan Baseline Report

View the following link to download the report.
RunnerID:3717928172


ZAP is supported by the Crash Override Open Source Fellowship

Help/User Guide punctuation issues

There's some User Guide content that needs to be tweaked (both here and in core-help I guess). I'm happy to tackle the changes, just opening this issue so that I don't forget 👍

One is a comma included in a link, the other is a quote included in a link, in both cases on the trailing end.

13525 [ZAP-SpiderThreadPool-0-thread-1] WARN org.zaproxy.zap.spider.URLCanonicalizer - Host could not be reliably evaluated from: http://www.nottrusted.com, (on base https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/)
18156 [ZAP-SpiderThreadPool-0-thread-1] WARN org.zaproxy.zap.spider.URLCanonicalizer - Host could not be reliably evaluated from: http://www.example.com%22 (on base https://www.zaproxy.org/docs/desktop/ui/dialogs/options/dynsslcert/)

Home vs Install how are they actually used

Had a request today for clarity in what goes in Home vs Install:

G 9:57 AM
I am here with another ZAP question.
9:57
I know the Zap install and home directories are meant to be different.
9:58
I know the default home directories for different platforms
9:58
and I know that this default can be overridden with the -dir command line arg and the ZAPROXY_HOME environment variable.
9:59
But what I am really looking for is any documentation that describes explicitly what it is used for.
9:59
I have an idea, suspicions, but I want an explicit citation so I am not assuming anything
10:03
To date I have not found anything
kingthorin 10:20 AM
Well one is literal install and one is user files, but let me see if I can find you some linkage

ZAP Full Scan Report

View the following link to download the report.
RunnerID:91223515

ZAP Scan Baseline Report

View the following link to download the report.
RunnerID:8105093389

Social Previews for Site Content

We need to figure out how to enable social previews of site content (primarily for Twitter and Slack I believe, but LinkedIn might also be a good move). I don't think we really have much Facebook, Youtube, etc activity. Though if simple enough we shouldn't ignore them.

Some regs:

Looks like we should be adding this to: https://github.com/zaproxy/zaproxy-website/blob/master/site/layouts/_default/baseof.html

zaproxy.org content update needed (minor)

Describe the bug
I hope this is the right place to report this. I am a new user to ZAP and am going through A LOT of the material on your website (very useful!). I noticed that Plug-n-Hack is still referred to on the https://www.zaproxy.org/docs/guides/zapping-the-top-10/ page, which now goes to a dead link (via reading stuff here, it seems it is no longer running/supported so that link should be removed).

To Reproduce

  1. Go to https://www.zaproxy.org/docs/guides/zapping-the-top-10/
  2. Scroll down to A7 Cross-Site Scripting (XSS)
  3. click on Plug-n-Hack

Expected behavior
Helpful webpage appears OR link is not on page :)

Screenshots

Software versions
N/A

Errors from the zap.log file
N/A

List Blogs By Author?

If there's already a way to do this please feel free to close this ticket (I couldn't find a way).

Is there a way to list blogs by author(s)? I know we allow a blog to have multiple authors but it should still be possible somehow to list articles associated with a given author.

ZAP Scan Baseline Report

View the following link to download the report.
RunnerID:524405164

2.10 Features Blog

An issue to collect ideas for a 2.10 features blog post, similar to: https://www.zaproxy.org/blog/2020-06-04-zap-2-9-0-highlights/ only more appropriately timed 😉

These are the things I'm currently thinking. Please edit this and add others or comment below and I'll add them.

  1. Dark Mode
  2. Expandable/Collapseable top panes
  3. Custom Pages
  4. Scriptable Encode/Decode/Hash
  5. Auth polling
  6. Auth Header via ENV Vars
  7. Site Tree Control

Combined Community page

This would include replace the "Get Involved" and "Support" pages.
I'll have a play and share some screenshots to show how it could look...

Add SHA hash for downloads

Is your feature request related to a problem? Please describe.

No

Describe the solution you'd like

Can we please add a list of SHA256 or SHA512 hashes for the downloads, it should help make the downloads more secure

Describe alternatives you've considered

winget can be used for now for the download, winget is i think secure

winget install ZAP.ZAP

Screenshots

No response

Additional context

No response

Would you like to help fix this issue?

  • Yes

ZAP Scan Baseline Report

View the following link to download the report.
RunnerID:2546438756

Clarify macOS architecture in installer options

Hey there,

I was just trying to download the new Apple silicon version of the ZAP installer from the downloads: https://www.zaproxy.org/download/#main

The options listed for macOS are amd64 and aarch64. Using a M1 mac myself I did not immediately know which option is the right one for me. So I had to google. I would have expected something like Intel and Apple Silicon.

Therefore, I would suggest to change the description of the download options to

macOS (Intel - amd64) Installer
macOS (Apple Silicon - aarch64) Installer

What do you think?

Have pages for scanner/alert/plugin types

For custom reports, it would be nice to able to link to a reference of all the scanner plugins' details. There could be a page that lists them all and then individual pages for each plugin. For each plugin we can create an entry and then have the templates generate a table with links to each individual plugin.

id name cweid wascid tags more
10020 Xframe ... 16 15 headers
---
type: plugin
pluginid: 10020
name: Xframe....
----

Description down under here?

Fix site for mobiles

psiinon wrote:

I've had a look at the site in Firefox reactive mode and it could definitely be improved!
The header and footer dont look good on larger mobile screens.
The hamburger menu only appears on smaller screens and works better, but the text is probably too big.
We should probably simplify the footer for mobiles, maybe removing most of the links?
Header and footer hopefully fixed by #81

ZAP Scan Baseline Report

View the following link to download the report.
RunnerID:74366119

Dev page: How to implement a new add-on

Whether its in zap-extensions or in another repo.
Should ideally also link to templates that can be easily copied to get people started.
Could cover scan rules or are those better in another page?

Simplify Docker documentation using host.docker.internal and docker-compose

Source: https://www.zaproxy.org/docs/docker/about

Site Section: Scanning an app running on the host OS

Issue
The site details how to get the host IP for hitting the host, which is outside of the docker network.
Not only does this solution not work for Windows users (except maybe if they install Cygwin), it is also overly complex.

Solution:
Docker now uses host.docker.internal for hitting the host as detailed here: https://docs.docker.com/desktop/mac/networking

Here is how I am able to run ZAP in Docker with only one command thanks to this docker-compose.yml:

version: “3”
services:
  zap:
    image: owasp/zap2docker-stable:2.10.0
    command: zap-api-scan.py -t http://host.docker.internal:3000/openapi.yml -f openapi -r zap-report.html
    volumes:
      - ./report:/zap/wrk:rw

Not only does this use the host.docker.internal solution for accessing the host in a clean, cross platform, way... it uses docker-compose to pull the image and run the scan with one single call:

docker-compose up zap

I think this is probably the best way to run ZAP on a local dev environment. It may be worth updating the documentation.

ZAP Scan Baseline Report

  • Site: https://www.zaproxy.org
    New Alerts

    Ignored Alerts

    • Strict-Transport-Security Header Not Set [10035] total: 20:
    • Incomplete or No Cache-control and Pragma HTTP Header Set [10015] total: 20:
    • Cross-Domain Misconfiguration [10098] total: 20:
    • Timestamp Disclosure - Unix [10096] total: 20:
    • Cross-Domain JavaScript Source File Inclusion [10017] total: 20:
    • X-Content-Type-Options Header Missing [10021] total: 20:
    • Retrieved from Cache [10050] total: 20:
    • Content Security Policy (CSP) Header Not Set [10038] total: 20:
    • Private IP Disclosure [2] total: 7:
    • Application Error Disclosure [90022] total: 3:
    • Information Disclosure - Debug Error Messages [10023] total: 5:
    • Information Disclosure - Suspicious Comments [10027] total: 4:
    • Loosely Scoped Cookie [90033] total: 3:
    • Cookie Without Secure Flag [10011] total: 2:
    • Reverse Tabnabbing [10108] total: 1:
    • PII Disclosure [10062] total: 1:

View the following link to download the report.
RunnerID:123156654

Developer docs tracker

  • A Quick Start Guide to Building ZAP
  • Building ZAP with Eclipse - #365
  • Building ZAP with Intellij - #371
  • Debug ZAP and add-ons with Intellij
  • Building ZAP with VSCode - Simon
  • Building ZAP with ??? - Can add as many as we like/need
  • Creating a new add-on in zap-extensions #370
  • Creating a new add-on in a new repo
  • Contributing code back to ZAP
  • GUI Programming Guidelines

ZAP Scan Baseline Report

  • Site[https://www.zaproxy.org]
    New Alerts
    • Alert[10035] count(20): Strict-Transport-Security Header Not Set
    • Alert[10098] count(20): Cross-Domain Misconfiguration
    • Alert[10050] count(20): Retrieved from Cache
    • Alert[10017] count(20): Cross-Domain JavaScript Source File Inclusion
    • Alert[10021] count(20): X-Content-Type-Options Header Missing
    • Alert[10096] count(20): Timestamp Disclosure - Unix
    • Alert[10015] count(20): Incomplete or No Cache-control and Pragma HTTP Header Set
    • Alert[10038] count(20): Content Security Policy (CSP) Header Not Set
    • Alert[90022] count(3): Application Error Disclosure
    • Alert[10023] count(2): Information Disclosure - Debug Error Messages
    • Alert[10027] count(4): Information Disclosure - Suspicious Comments
    • Alert[10011] count(2): Cookie Without Secure Flag
    • Alert[90033] count(3): Loosely Scoped Cookie
    • Alert[2] count(3): Private IP Disclosure
    • Alert[10062] count(2): PII Scanner
    • Alert[10108] count(1): Reverse Tabnabbing

View the following link to download the report.
RunnerID:72792259

Docker File is having references to files which are not present in Repo causing failure

- Do you want to request a feature or report a bug?
I think it is a bug.
- What is the current behavior?
Currently running docker file fails because of Copy command pointing to files which are not present in the Repository like Renovate and yarn.lock
Alse in ./bin/build file there is a mention to variable called realpath but i am not sure if it is expected to be created. If there is a mention then please ignore, if not then i think we need to handle that.
- If the current behavior is a bug, please provide the steps to reproduce.
We can remove them so that command work perfectly
- What is the expected behavior?
Docker file should run properly.
- Please mention your node.js, NPM, Hugo and operating system version.
Mac OS, I think it is not related to node version

ZAP Scan Baseline Report

View the following link to download the report.
RunnerID:2025968167

ZAP Scan Baseline Report

View the following link to download the report.
RunnerID:862420546

Add CSP

We're now adding security headers via cloudflare, so we should also add as strict a CSP as we can.
But this will need careful testing ;)

Collect and Restore/Implement Quotes

Raised by @kingthorin:

The quotes section of the front page was disabled in: https://github.com/rezen/zaproxy-website/pull/42 as there was only one quote in place (and it might not be the correct location for the content).

Additional quotes should be assembled into: https://github.com/rezen/zaproxy-website/blob/master/site/data/homepage/quotes.yml https://github.com/zaproxy/zaproxy-website/blob/master/site/data/homepage/quotes.yml (The one quote that is already in this file is from the "Key Feature 1" doc previously provided by Diamond Documentation)

Then either re-added to the front page or otherwise leveraged.

The following were from other "Key Feature" docs...

Quotes found today: Click the arrow/control to the left to expand
"Having such a high quality open source and freely-available dynamic application security scanner helps to lower barriers to entry for teams looking to include application security in their DevOps pipelines and should make dynamic scanning in pipelines a must-do rather than a nice-to-do activity.”

Dan Cornell, CTO, Denim Group

“We chose to use OWASP ZAP as the cornerstone of our BDD-Security testing framework for a number of technical and cultural reasons....ZAP has a strong pedigree in the security community with an extremely responsive team and open development process... ZAP’s focus as a tool ...makes it a shoe in for cross functional teams that may not have a security expert on board, but need a tool to integrate security into their build processes.”

Stephen De Vries, Continuum Security Co-Founder and CEO

"The web-based interactive user interface for the API allows DevOps engineers to quickly prototype pipeline-to-API interactions, and the availability of client libraries in a plethora of languages (Java, Python, Node.js, PHP, Ruby) makes ZAP integration approachable for teams with a variety of language skillsets. " 

Dan Cornell, CTO, Denim Group

"ZAP's API-first design and extensibility make it exceptionally powerful when we use it as an integration with continuous security automation tools developed internally. "

Tim Bach, Salesforce, Sr. Product Security Engineer

"...ZAP’s API is lightyears ahead of other competing solutions which was a key factor for us, since automating and controlling ZAP from build scripts and cucumber tests was essential in being able to insert it into CI/CD pipelines. The fact that nearly all of the features are available from the API means that we can make decisions about risk based on individual vulnerabilities rather than trying to parse a report. "

Stephen De Vries, Continuum Security Co-Founder and CEO

"OWASP’s ZAP tool enables developers and security analysts to quickly create and verify hypotheses about the security of a complex web application with a perfect blend of automation and manual utilities."
 
Jeff Williams, CEO, Aspect Security

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.