Using ZAP to scan the demo.testfire.net web site, it doesn't detect some basic SQL injections on the page http://demo.testfire.net/login.jsp

**To Reproduce the SQL injection
Steps to reproduce the behavior:

1. Go to http://demo.testfire.net/login.jsp
2. Enter jsmith'-- as username and anything as password
3. You can login
4. Note, actual password is demo1234

Expected behavior
N

🐛 Bug report

Description

Hacking Instructor doesn't take into account a custom domain.

Here's a part of my custom config:

application:
  domain: "example.com"

Take the "Login Jim" challenge instructor script. At the stage of inputting Jim's email, the instructor script expects "[email protected]" and not "[email protected]".

Looking at the source code, looks li

The current swagger definition is autogenerated. The automatically generated definitions rely on reflection and annotations to create the documentation. The reflection capabilities are poor at best and lead to missing API parameters. Annotations can help in some cases, but the only fix for Swagger is to create individual POJOs for every possible request. This will lead to unnecessary large number

Authentication via Azure/aad-pod-identity for keyvault access could be a good feature to avoid use of clientId/ clientSecret in chart values. Don't you think ?

I just finished dealing with auto-migrated issues for this article, it could definitely use some content updates:
https://github.com/OWASP/www-community/blob/master/pages/HttpOnly.md it still talks about old versions of IE and Opera.

This article includes an extensive table that needs re-working after the auto-migration as well (which I did not tackle).

Is Opera even relevant in 2020? Do

Seeing the below error while installing rush.js. Probably might need a package in the base image. Any help would be appreciated.

#21 516.9 > [email protected] install /usr/local/lib/node_modules/@microsoft/rush/node_modules/keytar
#21 516.9 > prebuild-install || npm run build
#21 516.9 
#21 521.6 prebuild-install WARN install No prebuilt binaries found (target=14.16.0 runtime=node arch=arm64

If HTTP sites (is not HTTPS ones) use the Access-Control-Allow-Origin header then the site will typically not work.
ZAP should automatically fix this header.
https://stackoverflow.com/questions/61940616/how-do-i-work-with-http-sites-using-the-hud-in-owasps-zap-proxy