[2026-05-30 09:50:45] ZAP 掃描開始 目標：https://fedora.tw 模式：baseline 工具：docker 暫存：/tmp/zap-6a1a4275d782d Using the Automation Framework Total of 243 URLs PASS: Vulnerable JS Library (Powered by Retire.js) [10003] PASS: In Page Banner Information Leak [10009] PASS: Cookie Without Secure Flag [10011] PASS: Content-Type Header Missing [10019] PASS: Anti-clickjacking Header [10020] PASS: X-Content-Type-Options Header Missing [10021] PASS: Information Disclosure - Debug Error Messages [10023] PASS: Information Disclosure - Sensitive Information in URL [10024] PASS: Information Disclosure - Sensitive Information in HTTP Referrer Header [10025] PASS: HTTP Parameter Override [10026] PASS: Information Disclosure - Suspicious Comments [10027] PASS: Off-site Redirect [10028] PASS: Cookie Poisoning [10029] PASS: User Controllable Charset [10030] PASS: Viewstate [10032] PASS: Directory Browsing [10033] PASS: Heartbleed OpenSSL Vulnerability (Indicative) [10034] PASS: Strict-Transport-Security Header [10035] PASS: HTTP Server Response Header [10036] PASS: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] PASS: X-Backend-Server Header Information Leak [10039] PASS: Secure Pages Include Mixed Content [10040] PASS: HTTP to HTTPS Insecure Transition in Form Post [10041] PASS: HTTPS to HTTP Insecure Transition in Form Post [10042] PASS: User Controllable JavaScript Event (XSS) [10043] PASS: Big Redirect Detected (Potential Sensitive Information Leak) [10044] PASS: Retrieved from Cache [10050] PASS: X-ChromeLogger-Data (XCOLD) Header Information Leak [10052] PASS: Cookie without SameSite Attribute [10054] PASS: CSP [10055] PASS: X-Debug-Token Information Leak [10056] PASS: Username Hash Found [10057] PASS: X-AspNet-Version Response Header [10061] PASS: PII Disclosure [10062] PASS: Hash Disclosure [10097] PASS: Cross-Domain Misconfiguration [10098] PASS: Weak Authentication Method [10105] PASS: Reverse Tabnabbing [10108] PASS: Modern Web Application [10109] PASS: Dangerous JS Functions [10110] PASS: Authentication Request Identified [10111] PASS: Verification Request Identified [10113] PASS: Script Served From Malicious Domain (polyfill) [10115] PASS: ZAP is Out of Date [10116] PASS: Absence of Anti-CSRF Tokens [10202] PASS: Session ID in URL Rewrite [3] PASS: Script Passive Scan Rules [50001] PASS: Stats Passive Scan Rule [50003] PASS: Insecure JSF ViewState [90001] PASS: Java Serialization Object [90002] PASS: Charset Mismatch [90011] PASS: Application Error Disclosure [90022] PASS: WSDL File Detection [90030] PASS: Loosely Scoped Cookie [90033] WARN-NEW: Cookie No HttpOnly Flag [10010] x 5 https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw/tutorials/41 (200 OK) https://fedora.tw/tutorials/46 (200 OK) https://fedora.tw/tutorials/category/%E6%A1%8C%E9%9D%A2%E6%87%89%E7%94%A8 (200 OK) WARN-NEW: Re-examine Cache-control Directives [10015] x 5 https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw/robots.txt (200 OK) https://fedora.tw/tutorials/46 (200 OK) https://fedora.tw/tutorials/category/%E6%A1%8C%E9%9D%A2%E6%87%89%E7%94%A8 (200 OK) WARN-NEW: Cross-Domain JavaScript Source File Inclusion [10017] x 5 https://fedora.tw/tutorials/41 (200 OK) https://fedora.tw/tutorials/42 (200 OK) https://fedora.tw/tutorials/43 (200 OK) https://fedora.tw/tutorials/45 (200 OK) https://fedora.tw/tutorials/46 (200 OK) WARN-NEW: User Controllable HTML Element Attribute (Potential XSS) [10031] x 1 https://fedora.tw/download?mirror=https%3A%2F%2Fdownload.fedoraproject.org%2Fpub%2Ffedora%2Flinux%2Freleases%2F (200 OK) WARN-NEW: Content Security Policy (CSP) Header Not Set [10038] x 5 https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw/sitemap.xml (404 Not Found) https://fedora.tw/tutorials/46 (200 OK) https://fedora.tw/tutorials/category/%E6%A1%8C%E9%9D%A2%E6%87%89%E7%94%A8 (200 OK) WARN-NEW: Non-Storable Content [10049] x 8 https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw/sitemap.xml (404 Not Found) https://fedora.tw/tutorials/46 (200 OK) https://fedora.tw/tutorials/category/%E6%A1%8C%E9%9D%A2%E6%87%89%E7%94%A8 (200 OK) WARN-NEW: Permissions Policy Header Not Set [10063] x 5 https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw/sitemap.xml (404 Not Found) https://fedora.tw/tutorials/46 (200 OK) https://fedora.tw/tutorials/category/%E6%A1%8C%E9%9D%A2%E6%87%89%E7%94%A8 (200 OK) WARN-NEW: Timestamp Disclosure - Unix [10096] x 1 https://fedora.tw/tutorials/33 (200 OK) WARN-NEW: Source Code Disclosure - SQL [10099] x 1 https://fedora.tw/tutorials/19 (200 OK) WARN-NEW: Session Management Response Identified [10112] x 11 https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw/tutorials (200 OK) https://fedora.tw/tutorials/41 (200 OK) https://fedora.tw/tutorials/42 (200 OK) WARN-NEW: Private IP Disclosure [2] x 9 https://fedora.tw/tutorials/11 (200 OK) https://fedora.tw/tutorials/16 (200 OK) https://fedora.tw/tutorials/20 (200 OK) https://fedora.tw/tutorials/23 (200 OK) https://fedora.tw/tutorials/25 (200 OK) WARN-NEW: Sub Resource Integrity Attribute Missing [90003] x 5 https://fedora.tw (200 OK) https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw/tutorials/46 (200 OK) WARN-NEW: Cross-Origin-Embedder-Policy Header Missing or Invalid [90004] x 9 https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw (200 OK) https://fedora.tw/ (200 OK) https://fedora.tw (200 OK) FAIL-NEW: 0 FAIL-INPROG: 0 WARN-NEW: 13 WARN-INPROG: 0 INFO: 0 IGNORE: 0 PASS: 54 [結束] exit=0