Blog - Timing Rule Splits/Changes & ZAP is Out of Date

Signed-off-by: kingthorin <[email protected]>

Author: kingthorin

site/content/blog/2025-07-21-timing-rule-changes/index.md

@@ -0,0 +1,57 @@
+---
+title: "Timing Related Scan Rule Changes"
+summary: >
+  Scan rules related to timing attacks have been split ore renamed.
+images:
+- https://www.zaproxy.org/blog/2025-07-21-timing-rule-changes/something.png
+type: post
+tags:
+- blog
+- browser
+date: "2025-07-21"
+authors:
+- thorin
+---
+
+### Time Based Scan Rule Changes
+
+We have recently implemented a number of [requested](https://github.com/zaproxy/zap-extensions/pull/4316) changes with regard to scan rules which perform time based attacks.
+
+![ZAPbot with Edge browser icon](images/blog-edge.png)
+
+These changes were made to provide users with greater flexibility in creating scan policies.
+In the last few years a number of changes have been implemented to address the potential for false positives.¹
+
+Here is a breakdown of what was changed:
+
+* The following Rules and Alerts were renamed to indicate that they're all Time Based (their IDs have stayed the same):
+    * [40019](/docs/alerts/40019/) - SQL Injection - MySQL
+    * [40020](/docs/alerts/40020/) - SQL Injection - Hypersonic
+    * [40021](/docs/alerts/40021/) - SQL Injection - Oracle*
+    * [40022](/docs/alerts/40022/) - SQL Injection - PostgreSQL
+    * [40024](/docs/alerts/40024/) - SQL Injection - SQLite* (This rule had contained code for union based SQLi attacks however it had been disabled for a long time. If further SQLite attacks are added in the future they will appear associated with rule ID 90038.)
+    * [40027](/docs/alerts/40027/) - SQL Injection - MsSQL
+* [40033](/docs/alerts/40033/) - NoSQL Injection  MongoDB - Timing attacks were previously split into rule [90039](/docs/alerts/90039/).
+* [90020](/docs/alerts/90020/) - Remote OS Command Injection - Time based attacks and Alerts were split into a separate rule with ID [90037](/docs/alerts/90037/).
+
+### New Passive Scan Rule - ZAP is Out of Date
+
+A new passive scan rule has been introduced which will Alert users when their version of ZAP is out-of-date. It's implementation is fairly simple:
+An [Alert](/docs/alerts/10116/) will be added for each host which is passively scanned. The Risk associated with the Alert will be as follows:
+For full (semantic versioned) releases:
+- Low: 1 minor version behind
+- Medium: 2 minors versions, 1 major version
+- High: 3+ minor versions, 2+ major versions
+
+For weekly (date versioned) releases:
+* Low: 1 year behind
+* Medium: 2 years behind
+* High: 3+ years behind
+
+This will help CI/CD users to know if they've fallen behind.
+
+---
+
+¹ Those marked with an asterisk (*) have not yet been updated to accommodate those improvements. 
+They currently leverage 'expensive' functions versus invoking dedicated sleep methods.
+The Time Based rules may also extend scan time, especially in cases where targets are highly vulnerable.