{"action":"created","comment":{"url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/comments/37753568","id":37753568,"diff_hunk":"@@ -0,0 +1,66 @@\n+// The scan function will be called for request/response made via ZAP, excluding some of the automated tools\r\n+// Passive scan rules should not make any requests \r\n+\r\n+// Note that new passive scripts will initially be disabled\r\n+// Right click the script in the Scripts tree and select \"enable\"  \r\n+\r\n+// kingthorin+owaspzap@gmail.com\r\n+// Ref: https://support.f5.com/kb/en-us/solutions/public/6000/900/sol6917.html\r\n+\r\n+function scan(ps, msg, src) {\r\n+\t//Setup some details we will need for alerts later if we find something\r\n+\talertRisk = 1\r\n+\talertConfidence = 3\r\n+\talertTitle = 'Internal IP Exposed via F5 BigIP Presistence Cookie'\r\n+\talertDesc = 'The F5 Big-IP Persistence cookie set for this website can be decoded to a specific internal IP and port. An attacker may leverage this information to conduct Social Engineering attacks or other exploits.'\r\n+\talertSolution = 'Configure BIG-IP cookie encryption.'\r\n+\talertRefs = 'https://support.f5.com/kb/en-us/solutions/public/6000/900/sol6917.html'\r\n+\tcweId = 311\r\n+\twascId = 13\r\n+\r\n+\turl = msg.getRequestHeader().getURI().toString();\r\n+\t//Only check when a cookie is set\r\n+\tif(msg.getResponseHeader().getHeaders(\"Set-Cookie\")) { \r","path":"passive/f5_bigip_cookie_internal_ip.js","position":23,"original_position":23,"commit_id":"e17809d35f77de8f9c0a630e92eca7552906505c","original_commit_id":"e17809d35f77de8f9c0a630e92eca7552906505c","user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"body":"I purposefully decided to only implement on set-cookie in order to keep from assessing every single request, decoding the cookie value(s) over and over again, for a single alert.","created_at":"2015-08-24T14:00:20Z","updated_at":"2015-08-24T14:00:20Z","html_url":"https://github.com/zaproxy/community-scripts/pull/17#discussion_r37753568","pull_request_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/17","_links":{"self":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/comments/37753568"},"html":{"href":"https://github.com/zaproxy/community-scripts/pull/17#discussion_r37753568"},"pull_request":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/17"}}},"pull_request":{"url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/17","id":42521970,"html_url":"https://github.com/zaproxy/community-scripts/pull/17","diff_url":"https://github.com/zaproxy/community-scripts/pull/17.diff","patch_url":"https://github.com/zaproxy/community-scripts/pull/17.patch","issue_url":"https://api.github.com/repos/zaproxy/community-scripts/issues/17","number":17,"state":"open","locked":false,"title":"Add new pasive script which detects F5 BigIP persistence cookies that leak internal IPs","user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"body":"Add new pasive script which detects F5 BigIP persistence cookies that contain encoded (not encrypted) internal IP details.","created_at":"2015-08-15T16:42:40Z","updated_at":"2015-08-24T14:00:20Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ea4129aaac27934128f91ee0973527ea40e0c848","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/17/commits","review_comments_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/17/comments","review_comment_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/comments{/number}","comments_url":"https://api.github.com/repos/zaproxy/community-scripts/issues/17/comments","statuses_url":"https://api.github.com/repos/zaproxy/community-scripts/statuses/e17809d35f77de8f9c0a630e92eca7552906505c","head":{"label":"kingthorin:add_f5_bigip_cookie_internal_ip_passive","ref":"add_f5_bigip_cookie_internal_ip_passive","sha":"e17809d35f77de8f9c0a630e92eca7552906505c","user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"repo":{"id":28862786,"name":"community-scripts","full_name":"kingthorin/community-scripts","owner":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kingthorin/community-scripts","description":"A collection of ZAP scripts provided by the community - pull requests very welcome!","fork":true,"url":"https://api.github.com/repos/kingthorin/community-scripts","forks_url":"https://api.github.com/repos/kingthorin/community-scripts/forks","keys_url":"https://api.github.com/repos/kingthorin/community-scripts/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kingthorin/community-scripts/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kingthorin/community-scripts/teams","hooks_url":"https://api.github.com/repos/kingthorin/community-scripts/hooks","issue_events_url":"https://api.github.com/repos/kingthorin/community-scripts/issues/events{/number}","events_url":"https://api.github.com/repos/kingthorin/community-scripts/events","assignees_url":"https://api.github.com/repos/kingthorin/community-scripts/assignees{/user}","branches_url":"https://api.github.com/repos/kingthorin/community-scripts/branches{/branch}","tags_url":"https://api.github.com/repos/kingthorin/community-scripts/tags","blobs_url":"https://api.github.com/repos/kingthorin/community-scripts/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kingthorin/community-scripts/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kingthorin/community-scripts/git/refs{/sha}","trees_url":"https://api.github.com/repos/kingthorin/community-scripts/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kingthorin/community-scripts/statuses/{sha}","languages_url":"https://api.github.com/repos/kingthorin/community-scripts/languages","stargazers_url":"https://api.github.com/repos/kingthorin/community-scripts/stargazers","contributors_url":"https://api.github.com/repos/kingthorin/community-scripts/contributors","subscribers_url":"https://api.github.com/repos/kingthorin/community-scripts/subscribers","subscription_url":"https://api.github.com/repos/kingthorin/community-scripts/subscription","commits_url":"https://api.github.com/repos/kingthorin/community-scripts/commits{/sha}","git_commits_url":"https://api.github.com/repos/kingthorin/community-scripts/git/commits{/sha}","comments_url":"https://api.github.com/repos/kingthorin/community-scripts/comments{/number}","issue_comment_url":"https://api.github.com/repos/kingthorin/community-scripts/issues/comments{/number}","contents_url":"https://api.github.com/repos/kingthorin/community-scripts/contents/{+path}","compare_url":"https://api.github.com/repos/kingthorin/community-scripts/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kingthorin/community-scripts/merges","archive_url":"https://api.github.com/repos/kingthorin/community-scripts/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kingthorin/community-scripts/downloads","issues_url":"https://api.github.com/repos/kingthorin/community-scripts/issues{/number}","pulls_url":"https://api.github.com/repos/kingthorin/community-scripts/pulls{/number}","milestones_url":"https://api.github.com/repos/kingthorin/community-scripts/milestones{/number}","notifications_url":"https://api.github.com/repos/kingthorin/community-scripts/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kingthorin/community-scripts/labels{/name}","releases_url":"https://api.github.com/repos/kingthorin/community-scripts/releases{/id}","created_at":"2015-01-06T12:39:11Z","updated_at":"2015-01-06T12:39:12Z","pushed_at":"2015-08-15T16:50:21Z","git_url":"git://github.com/kingthorin/community-scripts.git","ssh_url":"git@github.com:kingthorin/community-scripts.git","clone_url":"https://github.com/kingthorin/community-scripts.git","svn_url":"https://github.com/kingthorin/community-scripts","homepage":null,"size":199,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"zaproxy:master","ref":"master","sha":"c03f05aa3e89293b5258fd116e0322a869758e0f","user":{"login":"zaproxy","id":6716868,"avatar_url":"https://avatars.githubusercontent.com/u/6716868?v=3","gravatar_id":"","url":"https://api.github.com/users/zaproxy","html_url":"https://github.com/zaproxy","followers_url":"https://api.github.com/users/zaproxy/followers","following_url":"https://api.github.com/users/zaproxy/following{/other_user}","gists_url":"https://api.github.com/users/zaproxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zaproxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaproxy/subscriptions","organizations_url":"https://api.github.com/users/zaproxy/orgs","repos_url":"https://api.github.com/users/zaproxy/repos","events_url":"https://api.github.com/users/zaproxy/events{/privacy}","received_events_url":"https://api.github.com/users/zaproxy/received_events","type":"Organization","site_admin":false},"repo":{"id":28714269,"name":"community-scripts","full_name":"zaproxy/community-scripts","owner":{"login":"zaproxy","id":6716868,"avatar_url":"https://avatars.githubusercontent.com/u/6716868?v=3","gravatar_id":"","url":"https://api.github.com/users/zaproxy","html_url":"https://github.com/zaproxy","followers_url":"https://api.github.com/users/zaproxy/followers","following_url":"https://api.github.com/users/zaproxy/following{/other_user}","gists_url":"https://api.github.com/users/zaproxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zaproxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaproxy/subscriptions","organizations_url":"https://api.github.com/users/zaproxy/orgs","repos_url":"https://api.github.com/users/zaproxy/repos","events_url":"https://api.github.com/users/zaproxy/events{/privacy}","received_events_url":"https://api.github.com/users/zaproxy/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/zaproxy/community-scripts","description":"A collection of ZAP scripts provided by the community - pull requests very welcome!","fork":false,"url":"https://api.github.com/repos/zaproxy/community-scripts","forks_url":"https://api.github.com/repos/zaproxy/community-scripts/forks","keys_url":"https://api.github.com/repos/zaproxy/community-scripts/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zaproxy/community-scripts/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zaproxy/community-scripts/teams","hooks_url":"https://api.github.com/repos/zaproxy/community-scripts/hooks","issue_events_url":"https://api.github.com/repos/zaproxy/community-scripts/issues/events{/number}","events_url":"https://api.github.com/repos/zaproxy/community-scripts/events","assignees_url":"https://api.github.com/repos/zaproxy/community-scripts/assignees{/user}","branches_url":"https://api.github.com/repos/zaproxy/community-scripts/branches{/branch}","tags_url":"https://api.github.com/repos/zaproxy/community-scripts/tags","blobs_url":"https://api.github.com/repos/zaproxy/community-scripts/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zaproxy/community-scripts/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zaproxy/community-scripts/git/refs{/sha}","trees_url":"https://api.github.com/repos/zaproxy/community-scripts/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zaproxy/community-scripts/statuses/{sha}","languages_url":"https://api.github.com/repos/zaproxy/community-scripts/languages","stargazers_url":"https://api.github.com/repos/zaproxy/community-scripts/stargazers","contributors_url":"https://api.github.com/repos/zaproxy/community-scripts/contributors","subscribers_url":"https://api.github.com/repos/zaproxy/community-scripts/subscribers","subscription_url":"https://api.github.com/repos/zaproxy/community-scripts/subscription","commits_url":"https://api.github.com/repos/zaproxy/community-scripts/commits{/sha}","git_commits_url":"https://api.github.com/repos/zaproxy/community-scripts/git/commits{/sha}","comments_url":"https://api.github.com/repos/zaproxy/community-scripts/comments{/number}","issue_comment_url":"https://api.github.com/repos/zaproxy/community-scripts/issues/comments{/number}","contents_url":"https://api.github.com/repos/zaproxy/community-scripts/contents/{+path}","compare_url":"https://api.github.com/repos/zaproxy/community-scripts/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zaproxy/community-scripts/merges","archive_url":"https://api.github.com/repos/zaproxy/community-scripts/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zaproxy/community-scripts/downloads","issues_url":"https://api.github.com/repos/zaproxy/community-scripts/issues{/number}","pulls_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls{/number}","milestones_url":"https://api.github.com/repos/zaproxy/community-scripts/milestones{/number}","notifications_url":"https://api.github.com/repos/zaproxy/community-scripts/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zaproxy/community-scripts/labels{/name}","releases_url":"https://api.github.com/repos/zaproxy/community-scripts/releases{/id}","created_at":"2015-01-02T13:39:26Z","updated_at":"2015-08-17T16:46:03Z","pushed_at":"2015-08-22T20:36:38Z","git_url":"git://github.com/zaproxy/community-scripts.git","ssh_url":"git@github.com:zaproxy/community-scripts.git","clone_url":"https://github.com/zaproxy/community-scripts.git","svn_url":"https://github.com/zaproxy/community-scripts","homepage":null,"size":669,"stargazers_count":94,"watchers_count":94,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":21,"mirror_url":null,"open_issues_count":6,"forks":21,"open_issues":6,"watchers":94,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/17"},"html":{"href":"https://github.com/zaproxy/community-scripts/pull/17"},"issue":{"href":"https://api.github.com/repos/zaproxy/community-scripts/issues/17"},"comments":{"href":"https://api.github.com/repos/zaproxy/community-scripts/issues/17/comments"},"review_comments":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/17/comments"},"review_comment":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/17/commits"},"statuses":{"href":"https://api.github.com/repos/zaproxy/community-scripts/statuses/e17809d35f77de8f9c0a630e92eca7552906505c"}}}}