# DAST - OWASP ZAP baseline
**Fecha:** 2026-06-03 14:49:01
**Proyecto:** `/Users/oq/Developer/multi-php-docker/php-prod/sasis`
**Objetivo:** `http://127.0.0.1:8088`
## Arranque de servidor PHP
```bash
docker run -d --rm --name security-php-1780519741 -p 8088:8000 -v "/Users/oq/Developer/multi-php-docker/php-prod/sasis:/app" -w /app php:8.2-cli php -S 0.0.0.0:8000 -t /app/api
```
**Estado arranque:** `0`
```text
480391f10706beaf9b31f48c6be250c62441d7ef3a83ee382db0c3633affed35
```
## Health check local
```bash
curl -i --max-time 10 http://127.0.0.1:8088/
```
**Estado:** `0`
```text
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 282 0 282 0 0 10250 0 --:--:-- --:--:-- --:--:-- 10444
HTTP/1.1 200 OK
Host: 127.0.0.1:8088
Date: Wed, 03 Jun 2026 20:49:09 GMT
Connection: close
X-Powered-By: PHP/8.2.31
Content-type: text/html; charset=UTF-8
Fatal error: Uncaught Error: Class "mysqli" not found in /app/api/classes/conexion/Conexion.php:29
Stack trace:
#0 /app/api/index.php(4): Conexion->__construct()
#1 {main}
thrown in /app/api/classes/conexion/Conexion.php on line 29
```
## ZAP baseline
```bash
docker run --rm --network host ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://127.0.0.1:8088 -I
```
**Estado:** `0`
```text
Using the Automation Framework
Total of 3 URLs
PASS: Vulnerable JS Library (Powered by Retire.js) [10003]
PASS: In Page Banner Information Leak [10009]
PASS: Cookie No HttpOnly Flag [10010]
PASS: Cookie Without Secure Flag [10011]
PASS: Re-examine Cache-control Directives [10015]
PASS: Cross-Domain JavaScript Source File Inclusion [10017]
PASS: Content-Type Header Missing [10019]
PASS: Information Disclosure - Debug Error Messages [10023]
PASS: Information Disclosure - Sensitive Information in URL [10024]
PASS: Information Disclosure - Sensitive Information in HTTP Referrer Header [10025]
PASS: HTTP Parameter Override [10026]
PASS: Information Disclosure - Suspicious Comments [10027]
PASS: Off-site Redirect [10028]
PASS: Cookie Poisoning [10029]
PASS: User Controllable Charset [10030]
PASS: User Controllable HTML Element Attribute (Potential XSS) [10031]
PASS: Viewstate [10032]
PASS: Directory Browsing [10033]
PASS: Heartbleed OpenSSL Vulnerability (Indicative) [10034]
PASS: Strict-Transport-Security Header [10035]
PASS: HTTP Server Response Header [10036]
PASS: X-Backend-Server Header Information Leak [10039]
PASS: Secure Pages Include Mixed Content [10040]
PASS: HTTP to HTTPS Insecure Transition in Form Post [10041]
PASS: HTTPS to HTTP Insecure Transition in Form Post [10042]
PASS: User Controllable JavaScript Event (XSS) [10043]
PASS: Big Redirect Detected (Potential Sensitive Information Leak) [10044]
PASS: Retrieved from Cache [10050]
PASS: X-ChromeLogger-Data (XCOLD) Header Information Leak [10052]
PASS: Cookie without SameSite Attribute [10054]
PASS: CSP [10055]
PASS: X-Debug-Token Information Leak [10056]
PASS: Username Hash Found [10057]
PASS: X-AspNet-Version Response Header [10061]
PASS: PII Disclosure [10062]
PASS: Timestamp Disclosure [10096]
PASS: Hash Disclosure [10097]
PASS: Cross-Domain Misconfiguration [10098]
PASS: Source Code Disclosure [10099]
PASS: Weak Authentication Method [10105]
PASS: Reverse Tabnabbing [10108]
PASS: Modern Web Application [10109]
PASS: Dangerous JS Functions [10110]
PASS: Authentication Request Identified [10111]
PASS: Session Management Response Identified [10112]
PASS: Verification Request Identified [10113]
PASS: Script Served From Malicious Domain (polyfill) [10115]
PASS: ZAP is Out of Date [10116]
PASS: Absence of Anti-CSRF Tokens [10202]
PASS: Private IP Disclosure [2]
PASS: Session ID in URL Rewrite [3]
PASS: Script Passive Scan Rules [50001]
PASS: Stats Passive Scan Rule [50003]
PASS: Insecure JSF ViewState [90001]
PASS: Java Serialization Object [90002]
PASS: Sub Resource Integrity Attribute Missing [90003]
PASS: Charset Mismatch [90011]
PASS: Application Error Disclosure [90022]
PASS: WSDL File Detection [90030]
PASS: Loosely Scoped Cookie [90033]
WARN-NEW: Missing Anti-clickjacking Header [10020] x 1
http://127.0.0.1:8088 (200 OK)
WARN-NEW: X-Content-Type-Options Header Missing [10021] x 1
http://127.0.0.1:8088 (200 OK)
WARN-NEW: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] x 1
http://127.0.0.1:8088 (200 OK)
WARN-NEW: Content Security Policy (CSP) Header Not Set [10038] x 2
http://127.0.0.1:8088 (200 OK)
http://127.0.0.1:8088/robots.txt (404 Not Found)
WARN-NEW: Storable and Cacheable Content [10049] x 3
http://127.0.0.1:8088 (200 OK)
http://127.0.0.1:8088/robots.txt (404 Not Found)
http://127.0.0.1:8088/sitemap.xml (404 Not Found)
WARN-NEW: Permissions Policy Header Not Set [10063] x 3
http://127.0.0.1:8088 (200 OK)
http://127.0.0.1:8088/robots.txt (404 Not Found)
http://127.0.0.1:8088/sitemap.xml (404 Not Found)
WARN-NEW: Cross-Origin-Embedder-Policy Header Missing or Invalid [90004] x 3
http://127.0.0.1:8088 (200 OK)
http://127.0.0.1:8088 (200 OK)
http://127.0.0.1:8088 (200 OK)
FAIL-NEW: 0 FAIL-INPROG: 0 WARN-NEW: 7 WARN-INPROG: 0 INFO: 0 IGNORE: 0 PASS: 60
```
## Logs del servidor PHP
```text
[Wed Jun 3 20:49:04 2026] PHP 8.2.31 Development Server (http://0.0.0.0:8000) started
[Wed Jun 3 20:49:09 2026] 142.250.114.82:31263 Accepted
[Wed Jun 3 20:49:09 2026] 142.250.114.82:31263 [200]: GET / - Uncaught Error: Class "mysqli" not found in /app/api/classes/conexion/Conexion.php:29
Stack trace:
#0 /app/api/index.php(4): Conexion->__construct()
#1 {main}
thrown in /app/api/classes/conexion/Conexion.php on line 29
[Wed Jun 3 20:49:09 2026] 142.250.114.82:31263 Closing
[Wed Jun 3 20:53:58 2026] 172.17.0.1:63494 Accepted
[Wed Jun 3 20:53:58 2026] 172.17.0.1:63494 [200]: GET / - Uncaught Error: Class "mysqli" not found in /app/api/classes/conexion/Conexion.php:29
Stack trace:
#0 /app/api/index.php(4): Conexion->__construct()
#1 {main}
thrown in /app/api/classes/conexion/Conexion.php on line 29
[Wed Jun 3 20:53:58 2026] 172.17.0.1:63494 Closing
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63510 Accepted
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63514 Accepted
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63522 Accepted
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63510 [200]: GET / - Uncaught Error: Class "mysqli" not found in /app/api/classes/conexion/Conexion.php:29
Stack trace:
#0 /app/api/index.php(4): Conexion->__construct()
#1 {main}
thrown in /app/api/classes/conexion/Conexion.php on line 29
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63510 Closing
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63514 [404]: GET /robots.txt - No such file or directory
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63522 [404]: GET /sitemap.xml - No such file or directory
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63514 Closing
[Wed Jun 3 20:53:59 2026] 172.17.0.1:63522 Closing
```