Evidence field is empty for Rule "The source code for the current page was disclosed by the web server"

[Partha S S]

Hi,

In reports ZAP creating critical alert for Source Code Disclosure - File Inclusion

But the Attack and Evidence field is empty, How to get details of this attack?

Regards,

Partha

[Simon Bennetts]

Hi Partha,

Are you sure?

It looks to me like the attack and evidence fields are always specified in the code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/SourceCodeDisclosureFileInclusionScanRule.java

How are you viewing the alert?

Cheers,

Simon

[Partha S S]

Thanks for fast replay.

Yes I am seeing blank fields. I checked for 2 different environments. I am using ZAP_WEEKLY_D-2022-06-15

I am using C#, at last of test run through API call we are generating reports.

[Partha S S]

Do I need to enable any settings to get this Evidence / Attack fields?

[Simon Bennetts]

No, that should always be set.

TBH I'm confused :/

[Partha S S]

Ok. Please check. Its generating report and informing issues, But no evidence. Since I am new, Not able to get use-case for reproducing.
Thanks