如何防止OWASP ZAP扫描仪以标准模式击中外部URL？
我是Owasp Zap的新手。我在本地主持的网站上以标准模式进行了自动扫描（ http://127.0.0.0.1.1:8000 ）带有传统和Ajax蜘蛛。
Localhost网站上有一些外部公共URL不在
- 蜘蛛选项卡显示了以外的外部URL。
- Ajax蜘蛛选项卡显示了一些返回的403禁止的外部URL。
- 活动扫描选项卡在底部显示content-signate-2.cdn.mozilla.net。
ZAP实际上是否“扫描”了这些外部URL？如果是，那么如何防止这种情况发生？这会导致某种法律问题吗？
谢谢。
I am new to OWASP ZAP. I ran a automated scan in Standard Mode on my own website hosted on localhost (http://127.0.0.1:8000) with both traditional and AJAX spiders.
There are some external public URLs in the localhost website which are not under http://127.0.0.1:8000 like CDN's etc. Yet ZAP's Information Window shows them:
- The Spider tab shows the external URLs Flagged as Out of Scope.
- The AJAX Spider tab shows some external URLs returned 403 Forbidden.
- The Active Scan tab shows content-signature-2.cdn.mozilla.net at the bottom.
Did ZAP actually "scanned" those external URLs? If yes, then how to prevent this from happening? Can this cause some kind of legal issue?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
Ajax Spider没有击中这些URL-请求是由ZAP启动的浏览器制成的，ZAP正在返回403s。
ZAP将允许对JavaScript文件的请求（我认为来自内存中的CSS文件）将阻止这些破坏许多应用程序。但是，这些只是任何浏览器都会提出的标准请求-ZAP不会攻击超出范围的URL。
The AJAX Spider is not hitting those URLs - the requests are made from the browsers which ZAP launches and ZAP is returning the 403s.
ZAP will permit requests for JavaScript files (and I think CSS ones too from memory) as blocking these breaks many apps. However these are just standard requests that any browser would make - ZAP does NOT attack URLs that are out of scope.