Exclude unused SQL engines

[Slime Diallo]

I defined in my context to want to exclude certain Database, (All except MySQL) My configuration file for my context clearly indicates <exclude>, however these DBs are scanned during my tests. Do you know what other parameters need to be specified to avoid these scans during tests?

[thc...@gmail.com]

Hi.

Could you provide more details? How are you starting the scan?


P.S. We are still there if you want to chat :)

Best regards.

[Slime D.]

Hey, Sure.

I use A Jenkins job which trigger and execute my ZAP scan once a month in a Aws S3 bucket which contains context and sessions files of my Zap server.

The file which contains these Include or Exclude Databases Scans are in "mycompany.context" file. Even with the DB parameter unticked and the mention <exclude> in the context config file, this one is still scanned thing that i want to avoid.

[thc...@gmail.com]

But how is ZAP/active scan started specifically? Are you specifying the
context?

btw, are you using ZAP 2.9.0?

Best regards.

[Slime D.]

Yes, the context is specified. at the beginning of the context file you can see these lines 

        <tech>

            <include>Db.MySQL</include>

            <include>Language.PHP</include>

            <include>OS.Linux</include>

            <include>SCM.Git</include>

            <exclude>Db</exclude>

            <exclude>Db.CouchDB</exclude>

            <exclude>Db.Firebird</exclude>

            <exclude>Db.HypersonicSQL</exclude>

            <exclude>Db.IBM DB2</exclude>

            <exclude>Db.Microsoft Access</exclude>

            <exclude>Db.Microsoft SQL Server</exclude>

            <exclude>Db.MongoDB</exclude>

            <exclude>Db.Oracle</exclude>

            <exclude>Db.PostgreSQL</exclude>

            <exclude>Db.SAP MaxDB</exclude>

But even exclude the scan include for example MongoDB or SQL Server which i don't want. Yes i'm using the last ZAP 2.9.0

That's why i don't understand..

[kingthorin+owaspzap]

Did you specify the context as the target for the scan? (Versus a URL)

[Slime D.]

Yes, if i refer to the line between <incregexes> does that mean that my context in not normally used ?

[thc...@gmail.com]

Correct, you need to start the scan specifying the context you want used.

Best regards.

[kingthorin+owaspzap]

The target of the scan needs to actually be the context not simply a URL included in the context.

[Slime D.]

Replaced the URL target by the name of context. Unfortunately i excluded SQLInjections "SQLite" but it's still in reports

[thc...@gmail.com]

The context name is a different parameter of the endpoint.

Best regards.