zap-cli icon indicating copy to clipboard operation
zap-cli copied to clipboard

Trouble excluding results from a quick scan

Open arthurakay opened this issue 5 years ago • 0 comments

I have a bash script in which I run the following:

docker run -i owasp/zap2docker-weekly zap-cli quick-scan \
    --self-contained \
    --start-options '-config api.disablekey=true' \
    -s all \
    -e /*\.js$/i \
    --spider \
    --ajax-spider \
    -r \
    $STACK

Notice the -e /*\.js$/i bit -- I'm trying to eliminate the following false-positives which (I'm fairly certain) are the result of my JavaScript files being obfuscated:

[INFO]            Running a quick scan for https://xx.yyy.io
[INFO]            Issues found: 3
+----------------------------------------+--------+----------+--------------------------------------------------------------+
| Alert                                  | Risk   |   CWE ID | URL                                                          |
+========================================+========+==========+==============================================================+
| Hash Disclosure - Mac OSX salted SHA-1 | High   |      200 | https://xx.yyy.io/static/dll/76c7a32f60c9b2ab5d0f.js |
+----------------------------------------+--------+----------+--------------------------------------------------------------+
| Hash Disclosure - Mac OSX salted SHA-1 | High   |      200 | https://xx.yyy.io/static/dll/76c7a32f60c9b2ab5d0f.js |
+----------------------------------------+--------+----------+--------------------------------------------------------------+
| Anti CSRF Tokens Scanner               | High   |      352 | https://xx.yyy.io/static/dll/353fb1927e899732c1fc.js |
+----------------------------------------+--------+----------+--------------------------------------------------------------+

I'd actually prefer to simply ignore the CWE IDs directly (rather than exclude files)... but I don't think there are any flags which enable me to do that.

Am I using the -e flag incorrectly? It's clearly not excluding my JS files. Or is there another way I can configure this scan to ignore those two CWE IDs?

arthurakay avatar Feb 04 '20 19:02 arthurakay