{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "FlawStrike",
          "fullName": "FlawStrike DAST Orchestrator (ZAP, sqlmap, Nuclei, Nikto)",
          "informationUri": "https://owasp.org/Top10/",
          "version": "1.0.0",
          "rules": [
            {
              "id": "A03:2021",
              "name": "Injection",
              "shortDescription": {
                "text": "A03:2021 - Injection"
              },
              "helpUri": "https://owasp.org/Top10/",
              "help": {
                "text": "Use parameterised queries / prepared statements and an allow-list input validation; contextually output-encode to stop XSS. Never build queries or markup from raw user input."
              },
              "properties": {
                "category": "owasp-top-10-2021"
              }
            },
            {
              "id": "A05:2021",
              "name": "SecurityMisconfiguration",
              "shortDescription": {
                "text": "A05:2021 - Security Misconfiguration"
              },
              "helpUri": "https://owasp.org/Top10/",
              "help": {
                "text": "Harden defaults: remove sample apps, disable directory listing, set security headers, restrict HTTP methods, and keep configuration under review."
              },
              "properties": {
                "category": "owasp-top-10-2021"
              }
            },
            {
              "id": "A06:2021",
              "name": "VulnerableandOutdatedComponents",
              "shortDescription": {
                "text": "A06:2021 - Vulnerable and Outdated Components"
              },
              "helpUri": "https://owasp.org/Top10/",
              "help": {
                "text": "Inventory all components and versions, remove unused dependencies, and patch known-vulnerable software promptly against a CVE feed."
              },
              "properties": {
                "category": "owasp-top-10-2021"
              }
            }
          ]
        }
      },
      "invocations": [
        {
          "executionSuccessful": true,
          "endTimeUtc": null,
          "properties": {
            "target": "https://app.example.com",
            "tools": [
              "zap",
              "sqlmap",
              "nuclei",
              "nikto"
            ],
            "durationSeconds": 742.0,
            "toolRuns": {
              "zap": {
                "status": "success",
                "duration_seconds": 300.0,
                "findings": 1
              },
              "sqlmap": {
                "status": "success",
                "duration_seconds": 300.0,
                "findings": 1
              },
              "nuclei": {
                "status": "success",
                "duration_seconds": 300.0,
                "findings": 1
              },
              "nikto": {
                "status": "success",
                "duration_seconds": 300.0,
                "findings": 1
              }
            }
          }
        }
      ],
      "results": [
        {
          "ruleId": "A03:2021",
          "level": "error",
          "message": {
            "text": "SQL Injection at https://app.example.com/search — parameter 'q' — reported by sqlmap, zap"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "https://app.example.com/search"
                },
                "region": {
                  "snippet": {
                    "text": "q"
                  }
                }
              }
            }
          ],
          "partialFingerprints": {
            "findingId": "9c19fe1f-699d-4b4c-8785-80c23f3732c6"
          },
          "properties": {
            "security-severity": "9.5",
            "severity": "critical",
            "riskRating": "High",
            "confidence": "high",
            "owaspCategory": "A03:2021 - Injection",
            "cwe": "CWE-89",
            "foundBy": [
              "sqlmap",
              "zap"
            ],
            "confirmations": 2,
            "httpMethod": "GET",
            "parameter": "q",
            "evidence": "Demo data: boolean-based blind injection in the q parameter."
          }
        },
        {
          "ruleId": "A03:2021",
          "level": "error",
          "message": {
            "text": "Cross Site Scripting (Reflected) at https://app.example.com/profile — parameter 'name' — reported by zap"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "https://app.example.com/profile"
                },
                "region": {
                  "snippet": {
                    "text": "name"
                  }
                }
              }
            }
          ],
          "partialFingerprints": {
            "findingId": "3fb3ded1-7509-4d79-b728-3e98ce6e3e3b"
          },
          "properties": {
            "security-severity": "8.0",
            "severity": "high",
            "riskRating": "High",
            "confidence": "medium",
            "owaspCategory": "A03:2021 - Injection",
            "cwe": "CWE-79",
            "foundBy": [
              "zap"
            ],
            "confirmations": 1,
            "httpMethod": "GET",
            "parameter": "name",
            "evidence": "Demo data: the name parameter is reflected without encoding."
          }
        },
        {
          "ruleId": "A05:2021",
          "level": "error",
          "message": {
            "text": "Exposed Configuration File at https://app.example.com/config.bak — reported by nuclei"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "https://app.example.com/config.bak"
                }
              }
            }
          ],
          "partialFingerprints": {
            "findingId": "bbbf748b-1a8e-4eb4-87aa-10ba2590a9b7"
          },
          "properties": {
            "security-severity": "8.0",
            "severity": "high",
            "riskRating": "High",
            "confidence": "high",
            "owaspCategory": "A05:2021 - Security Misconfiguration",
            "cwe": "CWE-538",
            "foundBy": [
              "nuclei"
            ],
            "confirmations": 1,
            "httpMethod": "GET",
            "evidence": "Demo data: a backup configuration file is publicly readable."
          }
        },
        {
          "ruleId": "A05:2021",
          "level": "warning",
          "message": {
            "text": "Content Security Policy Header Not Set at https://app.example.com/ — reported by zap, nikto"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "https://app.example.com/"
                }
              }
            }
          ],
          "partialFingerprints": {
            "findingId": "60d0f681-e6c2-4e41-96ad-cb3caf9515d8"
          },
          "properties": {
            "security-severity": "5.5",
            "severity": "medium",
            "riskRating": "Medium",
            "confidence": "high",
            "owaspCategory": "A05:2021 - Security Misconfiguration",
            "cwe": "CWE-693",
            "foundBy": [
              "zap",
              "nikto"
            ],
            "confirmations": 2,
            "httpMethod": "GET",
            "evidence": "Demo data: the response has no Content-Security-Policy header."
          }
        },
        {
          "ruleId": "A06:2021",
          "level": "warning",
          "message": {
            "text": "Outdated Server Software at https://app.example.com/ — reported by nikto"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "https://app.example.com/"
                }
              }
            }
          ],
          "partialFingerprints": {
            "findingId": "73ac3d22-a6dc-418c-a79a-66f6a2c5aaff"
          },
          "properties": {
            "security-severity": "5.5",
            "severity": "medium",
            "riskRating": "Medium",
            "confidence": "medium",
            "owaspCategory": "A06:2021 - Vulnerable and Outdated Components",
            "cwe": "CWE-1104",
            "foundBy": [
              "nikto"
            ],
            "confirmations": 1,
            "httpMethod": "GET",
            "evidence": "Demo data: the Server header reports an old version."
          }
        },
        {
          "ruleId": "A05:2021",
          "level": "note",
          "message": {
            "text": "Cookie Without Secure Flag at https://app.example.com/login — reported by zap"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "https://app.example.com/login"
                }
              }
            }
          ],
          "partialFingerprints": {
            "findingId": "ecdb0f0e-cb21-452a-b34b-0382a7356b7d"
          },
          "properties": {
            "security-severity": "3.0",
            "severity": "low",
            "riskRating": "Low",
            "confidence": "high",
            "owaspCategory": "A05:2021 - Security Misconfiguration",
            "cwe": "CWE-614",
            "foundBy": [
              "zap"
            ],
            "confirmations": 1,
            "httpMethod": "GET",
            "evidence": "Demo data: the session cookie is set without the Secure flag."
          }
        },
        {
          "ruleId": "A05:2021",
          "level": "note",
          "message": {
            "text": "Server Version Disclosure at https://app.example.com/ — reported by nikto"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "https://app.example.com/"
                }
              }
            }
          ],
          "partialFingerprints": {
            "findingId": "a6ce99d6-beeb-4a18-8e87-9c149b50f7a0"
          },
          "properties": {
            "security-severity": "1.0",
            "severity": "info",
            "riskRating": "Low",
            "confidence": "medium",
            "owaspCategory": "A05:2021 - Security Misconfiguration",
            "cwe": "CWE-200",
            "foundBy": [
              "nikto"
            ],
            "confirmations": 1,
            "httpMethod": "GET",
            "evidence": "Demo data: the Server header discloses version details."
          }
        }
      ]
    }
  ]
}