Auditing Web Application developped with Oracle Application Express (APEX)

[Rassoul105]

Hi Tasos, I want to audit a Web Application Based using Arachni. I lunch the scan who during 2Hours and only 3 issues are discovered. Her the format of Apex Application URL: 192.168.3.8:8080/apex/f?p=101:LOGIN:11155982314610 I don't know if Arachni can or no audit an Apex web application ?

[Rassoul105]

Note: All issues are related to the server and not to the Oracle Apex Web Application.

[Zapotek]

Hello,

I'm not sure how I can help, you haven't mentioned any problems with the scan, are you seeing something that leads you to believe there's a problem?

Cheers

[Rassoul105]

Hi Zapotek, The problm is that : After configuring the HTTP Network settings section for a profil, when i run Scan wish credentials (login and password to acces as admin to the web application) the result of scan is the same that when i run scan with no credentials. I don't see anywhere in the report that indicate if Arachni is or not logged (if arachni create a session for further scan) into the web application during the scan.

Thank.

[Zapotek]

How are you configuring Arachni to login? Also, what type of authentication does the application use?

[Rassoul105]

I reedit the scan default profil and : in the plugins -- extra functionality section i first enable the autoLogin plugin and configure the Options as: url: http://192.168.3.8:8080/apex/f?p=101:LOGIN:9383308052510::::: (the url login that contains login form form parameter to submit: p_t01=myLogin&p_t02=myPassword (where p_t01=username_field & p_t02= password_field for the inputs name for form login). the pattern: Login succes And finally i create new scan using the default profil and configure the target as: http://192.168.3.8:8080/apex/f?p=101 (the url to acces the apex web application).

After running scan i get the following errors:

2016-07-04 13:03:32 +0000 --------------------------------------------------------------------------------
ENV:
---
ALLUSERSPROFILE: C:\ProgramData
APPDATA: C:\Users\egov-c1057\AppData\Roaming
ARACHNI_FRAMEWORK_LOGDIR: C:\arachni-1.4-0.5.10-windows-x86_64\system\\logs\framework
ARACHNI_WEBUI_LOGDIR: C:\arachni-1.4-0.5.10-windows-x86_64\system\\logs\webui
BUNDLE_BIN_PATH: C:/arachni-1.4-0.5.10-windows-x86_64/system/ruby/lib/ruby/gems/2.2.0/gems/bundler-1.10.6/bin/bundle
BUNDLE_GEMFILE: C:/arachni-1.4-0.5.10-windows-x86_64/system/arachni-ui-web/Gemfile
BUNDLE_ORIG_MANPATH: C:/arachni-1.4-0.5.10-windows-x86_64/system/ruby/lib/ruby/gems/2.2.0/gems/kramdown-1.4.1/man
CommonProgramFiles: C:\Program Files\Common Files
CommonProgramFiles(x86): C:\Program Files (x86)\Common Files
CommonProgramW6432: C:\Program Files\Common Files
COMPUTERNAME: EGOV-C1057
ComSpec: C:\windows\system32\cmd.exe
ENV_ROOT: C:\arachni-1.4-0.5.10-windows-x86_64\system\
ENV_RUBY_BIN: C:\arachni-1.4-0.5.10-windows-x86_64\system\ruby\bin
ENV_WEBUI_BIN: C:\arachni-1.4-0.5.10-windows-x86_64\system\arachni-ui-web\bin
ENV_WEBUI_ROOT: C:\arachni-1.4-0.5.10-windows-x86_64\system\arachni-ui-web
FP_NO_HOST_CHECK: 'NO'
GEM_HOME: C:/arachni-1.4-0.5.10-windows-x86_64/system/ruby/lib/ruby/gems/2.2.0
GEM_PATH: C:/arachni-1.4-0.5.10-windows-x86_64/system/ruby/lib/ruby/gems/2.2.0;C:/Users/egov-c1057/.gem/ruby/2.2.0
HOME: C:/Users/egov-c1057
HOMEDRIVE: 'C:'
HOMEPATH: "\\Users\\egov-c1057"
java JDK: C:\Program Files\Java\jdk1.8.0_91\bin
LOCALAPPDATA: C:\Users\egov-c1057\AppData\Local
LOGONSERVER: "\\\\EGOV-C1057"
MANPATH: C:/arachni-1.4-0.5.10-windows-x86_64/system/ruby/lib/ruby/gems/2.2.0/gems/kramdown-1.4.1/man
MOZ_PLUGIN_PATH: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\
NUMBER_OF_PROCESSORS: '4'
OnlineServices: Online Services
OS: Windows_NT
Path: C:/arachni-1.4-0.5.10-windows-x86_64/system/ruby/lib/ruby/gems/2.2.0/bin;C:\arachni-1.4-0.5.10-windows-x86_64\system\ruby\bin;C:\oraclexe\app\oracle\product\11.2.0\server\bin;;C:\ProgramData\Oracle\Java\javapath;c:\Program
  Files (x86)\Intel\iCLS Client\;c:\Program Files\Intel\iCLS Client\;C:\windows\system32;C:\windows;C:\windows\System32\Wbem;C:\windows\System32\WindowsPowerShell\v1.0\;c:\Program
  Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\;C:\Program Files\Intel\Intel(R)
  Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine
  Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program
  Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\OpenCL
  SDK\2.0\bin\x86;C:\Program Files (x86)\Intel\OpenCL SDK\2.0\bin\x64;C:\Program Files
  (x86)\Scripts\;C:\Program Files (x86)\;C:\Program Files (x86)\Nmap;C:\Program Files
  (x86)\w3af
pathExists: '0 '
PATHEXT: ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC"
PCBRAND: s
Platform: BNB
PROCESSOR_ARCHITECTURE: AMD64
PROCESSOR_IDENTIFIER: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
PROCESSOR_LEVEL: '6'
PROCESSOR_REVISION: 2a07
ProgramData: C:\ProgramData
ProgramFiles: C:\Program Files
ProgramFiles(x86): C:\Program Files (x86)
ProgramW6432: C:\Program Files
PROMPT: "$P$G"
PSModulePath: C:\windows\system32\WindowsPowerShell\v1.0\Modules\
PTSMInstallPath_X86: c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security
  Manager\
PUBLIC: C:\Users\Public
RACK_ENV: development
RAILS_ENV: production
RUBYLIB: C:/arachni-1.4-0.5.10-windows-x86_64/system/ruby/lib/ruby/gems/2.2.0/gems/bundler-1.10.6/lib
RUBYOPT: "-rbundler/setup"
SESSIONNAME: Console
SystemDrive: 'C:'
SystemRoot: C:\windows
TEMP: C:\Users\EGOV-C~2\AppData\Local\Temp
TMP: C:\Users\EGOV-C~2\AppData\Local\Temp
USER: egov-c1057
USERDOMAIN: EGOV-C1057
USERNAME: egov-c1057
USERPROFILE: C:\arachni-1.4-0.5.10-windows-x86_64\system\home
VBOX_MSI_INSTALL_PATH: C:\Program Files\Oracle\VirtualBox\
windir: C:\windows
windows_tracing_flags: '3'
windows_tracing_logfile: C:\BVTBin\Tests\installpackage\csilogfile.log
_ORIGINAL_GEM_PATH: C:/arachni-1.4-0.5.10-windows-x86_64/system/ruby/lib/ruby/gems/2.2.0;C:/Users/egov-c1057/.gem/ruby/2.2.0
--------------------------------------------------------------------------------
OPTIONS:
---
audit:
  parameter_values: true
  exclude_vector_patterns: []
  include_vector_patterns: []
  link_templates: []
  links: true
  forms: true
  cookies: true
  headers: false
  with_both_http_methods: false
  cookies_extensively: false
  jsons: true
  xmls: true
  ui_forms: true
  ui_inputs: true
browser_cluster:
  local_storage: {}
  wait_for_elements: {}
  pool_size: 6
  job_timeout: 25
  worker_time_to_live: 100
  ignore_images: false
  screen_width: 1600
  screen_height: 1200
datastore:
  token: ad80d20c491ee509d28b8dbc1366cc8f
http:
  user_agent: Arachni/v1.4
  request_timeout: 10000
  request_redirect_limit: 5
  request_concurrency: 20
  request_queue_size: 100
  request_headers: {}
  response_max_size: 500000
  cookies: {}
input:
  values:
    "(?i-mx:name)": arachni_name
    "(?i-mx:user)": arachni_user
    "(?i-mx:usr)": arachni_user
    "(?i-mx:pass)": 5543!%arachni_secret
    "(?i-mx:txt)": arachni_text
    "(?i-mx:num)": '132'
    "(?i-mx:amount)": '100'
    "(?i-mx:mail)": arachni@email.gr
    "(?i-mx:account)": '12'
    "(?i-mx:id)": '1'
  default_values:
    name: arachni_name
    user: arachni_user
    usr: arachni_user
    pass: 5543!%arachni_secret
    txt: arachni_text
    num: '132'
    amount: '100'
    mail: arachni@email.gr
    account: '12'
    id: '1'
  without_defaults: true
  force: false
scope:
  redundant_path_patterns: {}
  dom_depth_limit: 5
  exclude_file_extensions: []
  exclude_path_patterns: []
  exclude_content_patterns: []
  include_path_patterns: []
  restrict_paths: []
  extend_paths: []
  url_rewrites: {}
  include_subdomains: false
  exclude_binaries: false
  https_only: false
session:
  check_url: 'http://192.168.3.8:8080/apex/f?p=101:14:9383308052510::NO:::'
  check_pattern: "(?-mix:login succes hihi)"
checks:
- code_injection
- code_injection_php_input_wrapper
- code_injection_timing
- csrf
- file_inclusion
- ldap_injection
- no_sql_injection
- no_sql_injection_differential
- os_cmd_injection
- os_cmd_injection_timing
- path_traversal
- response_splitting
- rfi
- session_fixation
- source_code_disclosure
- sql_injection
- sql_injection_differential
- sql_injection_timing
- trainer
- unvalidated_redirect
- unvalidated_redirect_dom
- xpath_injection
- xss
- xss_dom
- xss_dom_script_context
- xss_event
- xss_path
- xss_script_context
- xss_tag
- xxe
- allowed_methods
- backdoors
- backup_directories
- backup_files
- captcha
- common_admin_interfaces
- common_directories
- common_files
- cookie_set_for_parent_domain
- credit_card
- cvs_svn_users
- directory_listing
- emails
- form_upload
- hsts
- htaccess_limit
- html_objects
- http_only_cookies
- http_put
- insecure_client_access_policy
- insecure_cookies
- insecure_cors_policy
- insecure_cross_domain_policy_access
- insecure_cross_domain_policy_headers
- interesting_responses
- localstart_asp
- mixed_resource
- origin_spoof_access_restriction_bypass
- password_autocomplete
- private_ip
- ssn
- unencrypted_password_forms
- webdav
- x_frame_options
- xst
platforms: []
plugins:
  autologin:
    url: 'http://192.168.3.8:8080/apex/f?p=101:LOGIN:9383308052510:::::'
    parameters: p_t01=myLogin&p_t02=myPassword
    check: login succes hihi
  autothrottle: 
  discovery: 
  healthmap: 
  timing_attacks: 
  uniformity: 
no_fingerprinting: false
authorized_by: 
url: http://192.168.3.8:8080/apex/f?p=101
--------------------------------------------------------------------------------
[2016-07-04 13:03:32 +0000] The response did not match the verifier.

Thank.

[Zapotek]

I'd suggest that you try the CLI and enable --output-debug to get more information into the login process. Also, you said the pattern is Login succes but you've specified login succes, the check isn't case insensitive. And you've also made a typo when spelling success.