ERROR SqlInjectionMsSqlScanRule - Connection timed out: no further information

84 views
Skip to first unread message

Lia

unread,
Sep 25, 2023, 9:29:43 PM9/25/23
to ZAP User Group
Hi there,

I'm getting the below error in my zap.log file.

[ZAP-ActiveScanner-6] ERROR SqlInjectionMsSqlScanRule - An error occurred checking a url for MsSQL Injection vulnerabilities
org.apache.hc.client5.http.HttpHostConnectException: Connect to https:example.com:xxx [example.com/exampleip] failed: Connection timed out: no further information
at sun.nio.ch.Net.pollConnect(Native Method) ~[?:?]
at sun.nio.ch.Net.pollConnectNow(Net.java:682) ~[?:?]
at sun.nio.ch.NioSocketImpl.timedFinishConnect(NioSocketImpl.java:549) ~[?:?]
at sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:592) ~[?:?]
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327) ~[?:?]
at java.net.Socket.connect(Socket.java:751) ~[?:?]
at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.lambda$connectSocket$0(SSLConnectionSocketFactory.java:232) ~[?:?]
at java.security.AccessController.doPrivileged(AccessController.java:571) ~[?:?]
at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:231) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.SslConnectionSocketFactory.connectSocket(SslConnectionSocketFactory.java:195) ~[?:?]
at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:181) ~[?:?]
at org.apache.hc.client5.http.impl.io.ZapHttpClientConnectionOperator.connect(ZapHttpClientConnectionOperator.java:95) ~[?:?]
at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:447) ~[?:?]
at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:162) ~[?:?]
at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:172) ~[?:?]
at org.apache.hc.client5.http.impl.classic.ConnectExec.execute(ConnectExec.java:142) ~[?:?]
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51) ~[?:?]
at org.apache.hc.client5.http.impl.classic.ZapProtocolExec.execute(ZapProtocolExec.java:178) ~[?:?]
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51) ~[?:?]
at org.apache.hc.client5.http.impl.classic.ZapHttpRequestRetryExec.execute(ZapHttpRequestRetryExec.java:81) ~[?:?]
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51) ~[?:?]
at org.apache.hc.client5.http.impl.classic.ZapInternalHttpClient.doExecute(ZapInternalHttpClient.java:173) ~[?:?]
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:245) ~[?:?]
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:188) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl0(HttpSenderApache.java:481) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:362) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:116) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendRateLimited(BaseHttpSender.java:412) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:381) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:349) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:305) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:276) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:233) ~[?:?]
at org.parosproxy.paros.network.HttpSender.sendImpl(HttpSender.java:524) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:356) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:315) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:252) ~[zap-2.13.0.jar:2.13.0]
at org.zaproxy.zap.extension.ascanrules.SqlInjectionMsSqlScanRule.getRoundTripTime(SqlInjectionMsSqlScanRule.java:283) ~[?:?]
at org.zaproxy.zap.extension.ascanrules.SqlInjectionMsSqlScanRule.scan(SqlInjectionMsSqlScanRule.java:217) ~[?:?]
at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:207) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:132) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:92) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractPlugin.run(AbstractPlugin.java:368) ~[zap-2.13.0.jar:2.13.0]
at java.lang.Thread.run(Thread.java:1583) [?:?]

I have already increased the timeout from 180 seconds to 300 seconds and this exception still appears. How can I fix this connection timed out: no further information error?

Simon Bennetts

unread,
Sep 26, 2023, 5:05:19 AM9/26/23
to ZAP User Group
Have you checked how your application is responding?
There might not be anything to fix in ZAP...

Lia

unread,
Sep 26, 2023, 7:15:29 AM9/26/23
to ZAP User Group
Hi Simon,

Any suggestion on how to check how my application is responding? I am running it via -cmd

Thanks

kingthorin+zap

unread,
Sep 26, 2023, 7:22:53 AM9/26/23
to ZAP User Group
Browse to it?
Use CURL or wget?

Xeno 23

unread,
Sep 26, 2023, 7:31:13 AM9/26/23
to zaprox...@googlegroups.com
Hi there,

Do you mean browse to the website during scan or after scan? 
I always check it after scan and it seems ok.

--
You received this message because you are subscribed to the Google Groups "ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/b2de9e77-bcd8-4e2c-8dc7-474a7544742cn%40googlegroups.com.

Lia

unread,
Oct 11, 2023, 10:21:24 PM10/11/23
to ZAP User Group
Hi there,

I am getting another similar ERROR message in zap.log

ERROR SqlInjectionScanRule - An error occurred checking a url for SQL Injection vulnerabilities
org.zaproxy.addon.network.common.ZapSocketTimeoutException: Read timed out
at sun.nio.ch.NioSocketImpl.timedRead(NioSocketImpl.java:278) ~[?:?]
at sun.nio.ch.NioSocketImpl.implRead(NioSocketImpl.java:304) ~[?:?]
at sun.nio.ch.NioSocketImpl.read(NioSocketImpl.java:346) ~[?:?]
at sun.nio.ch.NioSocketImpl$1.read(NioSocketImpl.java:796) ~[?:?]
at java.net.Socket$SocketInputStream.read(Socket.java:1099) ~[?:?]
at sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:489) ~[?:?]
at sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:483) ~[?:?]
at sun.security.ssl.SSLSocketInputRecord.bytesInCompletePacket(SSLSocketInputRecord.java:70) ~[?:?]
at sun.security.ssl.SSLSocketImpl.readApplicationRecord(SSLSocketImpl.java:1461) ~[?:?]
at sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:1066) ~[?:?]
at org.apache.hc.core5.http.impl.io.SessionInputBufferImpl.read(SessionInputBufferImpl.java:195) ~[?:?]
at org.apache.hc.core5.http.impl.io.IdentityInputStream.read(IdentityInputStream.java:99) ~[?:?]
at org.apache.hc.core5.http.io.EofSensorInputStream.read(EofSensorInputStream.java:135) ~[?:?]
at org.apache.hc.core5.http.io.EofSensorInputStream.read(EofSensorInputStream.java:148) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.getBytes(HttpSenderApache.java:327) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.getBytes(HttpSenderApache.java:116) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.lambda$new$5(BaseHttpSender.java:219) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.copyResponse(HttpSenderApache.java:725) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.lambda$sendImpl0$2(HttpSenderApache.java:485) ~[?:?]
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:247) ~[?:?]

at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:188) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl0(HttpSenderApache.java:481) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:362) ~[?:?]
at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:116) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendRateLimited(BaseHttpSender.java:413) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:382) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:350) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:306) ~[?:?]
at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:277) ~[?:?]

at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:233) ~[?:?]
at org.parosproxy.paros.network.HttpSender.sendImpl(HttpSender.java:524) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:356) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:315) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(AbstractPlugin.java:252) ~[zap-2.13.0.jar:2.13.0]
at org.zaproxy.zap.extension.ascanrules.SqlInjectionScanRule.scan(SqlInjectionScanRule.java:713) ~[?:?]

at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:207) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:132) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractAppParamPlugin.scan(AbstractAppParamPlugin.java:92) ~[zap-2.13.0.jar:2.13.0]
at org.parosproxy.paros.core.scanner.AbstractPlugin.run(AbstractPlugin.java:368) ~[zap-2.13.0.jar:2.13.0]

Can I know if the cause of these ERROR messages are due to slow application? OR is it due to other causes eg: repeated scanning etc.

Many thanks.

Lia

unread,
Oct 13, 2023, 8:11:23 AM10/13/23
to ZAP User Group
Hi there,

Just wondering if anyone has any input on this?
Thank you.

Lia

unread,
Oct 16, 2023, 11:55:58 PM10/16/23
to ZAP User Group
Hi there,

Just wondering if anyone has any input on this?
Thank you.

Reply all
Reply to author
Forward
0 new messages