<commit_before># ascanrulesAlpha 
#
# This file defines the default (English) variants of all of the internationalised messages
ascanalpha.desc = Active Scan Rules - alpha

ascanalpha.examplefile.name=An example active scan rule which loads data from a file
ascanalpha.examplefile.desc=Add more information about the vulnerability here
ascanalpha.examplefile.other=This is for information that doesnt fit in any of the other sections
ascanalpha.examplefile.soln=A general description of how to solve the problem
ascanalpha.examplefile.refs=http://zaproxy.blogspot.co.uk/2014/04/hacking-zap-4-active-scan-rules.html

ascanalpha.sourcecodedisclosure.desc = The source code for the current page was disclosed by the web server
ascanalpha.sourcecodedisclosure.lfibased.name = Source Code Disclosure - File Inclusion
ascanalpha.sourcecodedisclosure.lfibased.soln = Ensure that arbitrary files specified by the user are not included in the output
ascanalpha.sourcecodedisclosure.lfibased.extrainfo = The output for the source code filename [{0}] differs sufficiently from that of the random parameter [{1}], at [{2}%], compared to a threshold of [{3}%]
ascanalpha.sourcecodedisclosure.lfibased.evidence = 
ascanalpha.sourcecodedisclosure.svnbased.name = Source Code Disclosure - SVN
ascanalpha.sourcecodedisclosure.svnbased.soln = Ensure that SVN metadata files are not deployed to the web server or application server
ascanalpha.sourcecodedisclosure.svnbased.extrainfo = The source code for [{0}] was found at [{1}]
ascanalpha.sourcecodedisclosure.svnbased.evidence =
ascanalpha.sourcecodedisclosure.gitbased.name = Source Code Disclosure - Git 
ascanalpha.sourcecodedisclosure.gitbased.soln = Ensure that Git metadata files are not deployed to the web server or application server
ascanalpha.sourcecodedisclosure.gitbased.extrainfo =  
ascanalpha.sourcecodedisclosure.gitbased.evidence = The source code for [{0}] was extracted using [{1}]
ascanalpha.backupfiledisclosure.name = Backup File Disclosure
ascanalpha.backupfiledisclosure.desc = A backup of the file was disclosed by the web server
ascanalpha.backupfiledisclosure.soln = Do not edit files in-situ on the web server, and ensure that un-necessary files (including hidden files) are removed from the web server.
ascanalpha.backupfiledisclosure.evidence = A backup of [{0}] is available at [{1}]

ascanalpha.elinjection.name = Expression Language Injection
ascanalpha.elinjection.desc = The software constructs all or part of an expression language (EL) statement in a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed. In certain versions of Spring 3.0.5 and earlier, there was a vulnerability (CVE-2011-2730) in which Expression Language tags would be evaluated twice, which effectively exposed any application to EL injection. However, even for later versions, this weakness is still possible depending on configuration.
ascanalpha.elinjection.soln = Perform data validation best practice against untrusted input and to ensure that output encoding is applied when data arrives on the EL layer, so that no metacharacter is found by the interpreter within the user content before evaluation. The most obvious patterns to detect include ${ and #{, but it may be possible to encode or fragment this data.
ascanalpha.elinjection.refs = https://www.owasp.org/index.php/Expression_Language_Injection\nhttp://cwe.mitre.org/data/definitions/917.html

ascanalpha.heartbleed.name=Heartbleed OpenSSL Vulnerability
ascanalpha.heartbleed.desc=The TLS implementation in OpenSSL 1.0.1 before 1.0.1g does not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, potentially disclosing sensitive information.
ascanalpha.heartbleed.soln=Update to OpenSSL 1.0.1g or later. Re-issue HTTPS certificates. Change asymmetric private keys and shared secret keys, since these may have been compromised, with no evidence of compromise in the server log files.
ascanalpha.heartbleed.refs=http://cvedetails.com/cve-details.php?t=1&cve_id=CVE-2014-0160
ascanalpha.heartbleed.extrainfo=This issue was confirmed by exfiltrating data from the server, using {0}. This is unlikely to be a false positive.

ascanalpha.crossdomain.name = Cross-Domain Misconfiguration
#the refs cannot be customised for each sub-category (Adobe, Silverlight, etc)
ascanalpha.crossdomain.refs = http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html\nhttp://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/CrossDomain_PolicyFile_Specification.pdf\nhttp://msdn.microsoft.com/en-US/library/cc197955%28v=vs.95%29.aspx\nhttp://msdn.microsoft.com/en-us/library/cc838250%28v=vs.95%29.aspx
ascanalpha.crossdomain.adobe.read.name = Cross-Domain Misconfiguration - Adobe - Read
ascanalpha.crossdomain.adobe.send.name = Cross-Domain Misconfiguration - Adobe - Send
ascanalpha.crossdomain.adobe.desc = Flash/Silverlight based cross-site request forgery may be possible, due to a misconfiguration on the web server. 
ascanalpha.crossdomain.adobe.read.soln = Configure the crossdomain.xml file to restrict the list of domains that are allowed to make cross-domain read requests to this web server, using <allow-access-from domain="example.com">. You should only grant access to "*" (all domains) if you are certain that this service does not host any access-controlled, personalized, or private data.
ascanalpha.crossdomain.adobe.read.extrainfo = The web server permits malicious cross-domain data read requests originating from Flash/Silverlight components served from any third party domain, to this domain. If the victim user is logged into this service, the malicious read requests are processed using the privileges of the victim, and can result in data from this service being compromised by an unauthorised third party web site, via the victim's web browser. This is particularly likely to be an issue if a Cookie based session implementation is in use. 
ascanalpha.crossdomain.adobe.send.soln = Configure the crossdomain.xml file to restrict the list of domains that are allowed to make cross-domain send (but not necessarily read) requests to this web server, using <allow-http-request-headers-from domain="example.com" headers="Authorization,X-Blahh">. You should only grant access to "*" (all domains) if you are certain that this service that this service is not vulnerable to Cross Site Request Forgery (CSRF) attacks.
ascanalpha.crossdomain.adobe.send.extrainfo = The web server permits malicious cross-domain data send (but not necessarily read) requests originating from Flash/Silverlight components served from any third party domain, to this domain. If the victim user is logged into this service, the malicious send requests are processed using the privileges of the victim, and can result in Cross Site Request Forgery (CSRF) type attacks, via the victim's web browser. This is particularly likely to be an issue if a Cookie based session implementation is in use.
ascanalpha.crossdomain.silverlight.name = Cross-Domain Misconfiguration - Silverlight
ascanalpha.crossdomain.silverlight.desc = Silverlight based cross-site request forgery may be possible, due to a misconfiguration on the web server.
ascanalpha.crossdomain.silverlight.soln = Configure the clientaccesspolicy.xml file to restrict the list of domains that are allowed to make cross-domain requests to this web server, using <domain uri="https://example.com" />. You should only grant access to "*" (all domains) if you are certain that this service does not host any access-controlled, personalized, or private data.
ascanalpha.crossdomain.silverlight.extrainfo = The web server permits malicious cross-domain requests originating from Silverlight components served from any third party domain, to this domain. If the victim user is logged into this service, the malicious requests are processed using the privileges of the victim, and can result in data from this service being compromised by an unauthorised third party web site, via the victim's web browsers. It can also result in Cross Site Request Forgery (CSRF) type attacks. This is particularly likely to be an issue if a Cookie based session implementation is in use.<commit_msg>Adding strings for alpha scan rule Cookie Slack Detector, to support I8n<commit_after># ascanalphaAlpha 
#
# This file defines the default (English) variants of all of the internationalised messages
ascanalpha.desc = Active Scan Rules - alpha

ascanalpha.examplefile.name=An example active scan rule which loads data from a file
ascanalpha.examplefile.desc=Add more information about the vulnerability here
ascanalpha.examplefile.other=This is for information that doesnt fit in any of the other sections
ascanalpha.examplefile.soln=A general description of how to solve the problem
ascanalpha.examplefile.refs=http://zaproxy.blogspot.co.uk/2014/04/hacking-zap-4-active-scan-rules.html

ascanalpha.sourcecodedisclosure.desc = The source code for the current page was disclosed by the web server
ascanalpha.sourcecodedisclosure.lfibased.name = Source Code Disclosure - File Inclusion
ascanalpha.sourcecodedisclosure.lfibased.soln = Ensure that arbitrary files specified by the user are not included in the output
ascanalpha.sourcecodedisclosure.lfibased.extrainfo = The output for the source code filename [{0}] differs sufficiently from that of the random parameter [{1}], at [{2}%], compared to a threshold of [{3}%]
ascanalpha.sourcecodedisclosure.lfibased.evidence = 
ascanalpha.sourcecodedisclosure.svnbased.name = Source Code Disclosure - SVN
ascanalpha.sourcecodedisclosure.svnbased.soln = Ensure that SVN metadata files are not deployed to the web server or application server
ascanalpha.sourcecodedisclosure.svnbased.extrainfo = The source code for [{0}] was found at [{1}]
ascanalpha.sourcecodedisclosure.svnbased.evidence =
ascanalpha.sourcecodedisclosure.gitbased.name = Source Code Disclosure - Git 
ascanalpha.sourcecodedisclosure.gitbased.soln = Ensure that Git metadata files are not deployed to the web server or application server
ascanalpha.sourcecodedisclosure.gitbased.extrainfo =  
ascanalpha.sourcecodedisclosure.gitbased.evidence = The source code for [{0}] was extracted using [{1}]
ascanalpha.backupfiledisclosure.name = Backup File Disclosure
ascanalpha.backupfiledisclosure.desc = A backup of the file was disclosed by the web server
ascanalpha.backupfiledisclosure.soln = Do not edit files in-situ on the web server, and ensure that un-necessary files (including hidden files) are removed from the web server.
ascanalpha.backupfiledisclosure.evidence = A backup of [{0}] is available at [{1}]

ascanalpha.elinjection.name = Expression Language Injection
ascanalpha.elinjection.desc = The software constructs all or part of an expression language (EL) statement in a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed. In certain versions of Spring 3.0.5 and earlier, there was a vulnerability (CVE-2011-2730) in which Expression Language tags would be evaluated twice, which effectively exposed any application to EL injection. However, even for later versions, this weakness is still possible depending on configuration.
ascanalpha.elinjection.soln = Perform data validation best practice against untrusted input and to ensure that output encoding is applied when data arrives on the EL layer, so that no metacharacter is found by the interpreter within the user content before evaluation. The most obvious patterns to detect include ${ and #{, but it may be possible to encode or fragment this data.
ascanalpha.elinjection.refs = https://www.owasp.org/index.php/Expression_Language_Injection\nhttp://cwe.mitre.org/data/definitions/917.html

ascanalpha.heartbleed.name=Heartbleed OpenSSL Vulnerability
ascanalpha.heartbleed.desc=The TLS implementation in OpenSSL 1.0.1 before 1.0.1g does not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, potentially disclosing sensitive information.
ascanalpha.heartbleed.soln=Update to OpenSSL 1.0.1g or later. Re-issue HTTPS certificates. Change asymmetric private keys and shared secret keys, since these may have been compromised, with no evidence of compromise in the server log files.
ascanalpha.heartbleed.refs=http://cvedetails.com/cve-details.php?t=1&cve_id=CVE-2014-0160
ascanalpha.heartbleed.extrainfo=This issue was confirmed by exfiltrating data from the server, using {0}. This is unlikely to be a false positive.

ascanalpha.crossdomain.name = Cross-Domain Misconfiguration
#the refs cannot be customised for each sub-category (Adobe, Silverlight, etc)
ascanalpha.crossdomain.refs = http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html\nhttp://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/CrossDomain_PolicyFile_Specification.pdf\nhttp://msdn.microsoft.com/en-US/library/cc197955%28v=vs.95%29.aspx\nhttp://msdn.microsoft.com/en-us/library/cc838250%28v=vs.95%29.aspx
ascanalpha.crossdomain.adobe.read.name = Cross-Domain Misconfiguration - Adobe - Read
ascanalpha.crossdomain.adobe.send.name = Cross-Domain Misconfiguration - Adobe - Send
ascanalpha.crossdomain.adobe.desc = Flash/Silverlight based cross-site request forgery may be possible, due to a misconfiguration on the web server. 
ascanalpha.crossdomain.adobe.read.soln = Configure the crossdomain.xml file to restrict the list of domains that are allowed to make cross-domain read requests to this web server, using <allow-access-from domain="example.com">. You should only grant access to "*" (all domains) if you are certain that this service does not host any access-controlled, personalized, or private data.
ascanalpha.crossdomain.adobe.read.extrainfo = The web server permits malicious cross-domain data read requests originating from Flash/Silverlight components served from any third party domain, to this domain. If the victim user is logged into this service, the malicious read requests are processed using the privileges of the victim, and can result in data from this service being compromised by an unauthorised third party web site, via the victim's web browser. This is particularly likely to be an issue if a Cookie based session implementation is in use. 
ascanalpha.crossdomain.adobe.send.soln = Configure the crossdomain.xml file to restrict the list of domains that are allowed to make cross-domain send (but not necessarily read) requests to this web server, using <allow-http-request-headers-from domain="example.com" headers="Authorization,X-Blahh">. You should only grant access to "*" (all domains) if you are certain that this service that this service is not vulnerable to Cross Site Request Forgery (CSRF) attacks.
ascanalpha.crossdomain.adobe.send.extrainfo = The web server permits malicious cross-domain data send (but not necessarily read) requests originating from Flash/Silverlight components served from any third party domain, to this domain. If the victim user is logged into this service, the malicious send requests are processed using the privileges of the victim, and can result in Cross Site Request Forgery (CSRF) type attacks, via the victim's web browser. This is particularly likely to be an issue if a Cookie based session implementation is in use.
ascanalpha.crossdomain.silverlight.name = Cross-Domain Misconfiguration - Silverlight
ascanalpha.crossdomain.silverlight.desc = Silverlight based cross-site request forgery may be possible, due to a misconfiguration on the web server.
ascanalpha.crossdomain.silverlight.soln = Configure the clientaccesspolicy.xml file to restrict the list of domains that are allowed to make cross-domain requests to this web server, using <domain uri="https://example.com" />. You should only grant access to "*" (all domains) if you are certain that this service does not host any access-controlled, personalized, or private data.
ascanalpha.crossdomain.silverlight.extrainfo = The web server permits malicious cross-domain requests originating from Silverlight components served from any third party domain, to this domain. If the victim user is logged into this service, the malicious requests are processed using the privileges of the victim, and can result in data from this service being compromised by an unauthorised third party web site, via the victim's web browsers. It can also result in Cross Site Request Forgery (CSRF) type attacks. This is particularly likely to be an issue if a Cookie based session implementation is in use.

ascanalpha.cookieslack.name = Cookie Slack Detector
ascanalpha.cookieslack.desc = Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.
ascanalpha.cookieslack.solution = N.a.
ascanalpha.cookieslack.otherinfo.intro = Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.\n
ascanalpha.cookieslack.session.warning = NOTE: Because of its name this cookie may be important, but dropping it appears to have no effect: [{0}] \n
ascanalpha.cookieslack.affect.response.yes = These cookies affected the response: 
ascanalpha.cookieslack.affect.response.no = These cookies did NOT affect the response: 
ascanalpha.cookieslack.session.destroyed = Dropping this cookie appears to have invalidated the session: [{0}] A follow-on request with all original cookies still had a different response than the original request. \n
ascanalpha.cookieslack.separator = ,
ascanalpha.cookieslack.endline = \n
{'fraction_non_alphanumeric': 0.05936500937052144, 'fraction_numerical': 0.008323227869033183, 'mean_word_length': 5.413220219158713, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 4, 'lorem ipsum': 0, 'www.': 6, 'xml': 6}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '984820', 'n_tokens_mistral': 4806, 'n_tokens_neox': 4550, 'n_words': 2077}