search

OWASP / Serverless-Goat

OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws
GNU Affero General Public License v3.0
319 stars 95 forks source link

covert function failed #9

Closed mendickxiao closed 5 years ago

mendickxiao commented 5 years ago

Build the owasp-serverless-goat by the AWS Serverless Application Repository https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:761130837472:applications~serverless-goat, but when I want to do the covert, it is failed. I meet this issue before. So I get the code directly from master branch, I still found this issue again.

https://8bxg013urf.execute-api.us-east-1.amazonaws.com/api/convert?document_url=https%3A%2F%2Ffoobar%3B+cat+%2Fvar%2Ftask%2Findex.js+%23

{"message":"Forbidden"}

0xh0b0 commented 5 years ago

Please try to completely remove serverlessrepo-serverless-goat CloudFormation stack from your account and deploy it again from application repository.

mendickxiao commented 5 years ago

I deploy it again and I found the request is not sent to Lambda, it is blocked by somewhere else, but I don't know the details.

https://unfnqzim4m.execute-api.us-east-1.amazonaws.com/api/convert?document_url=https%3A%2F%2Fwww.puresec.io%2Fhubfs%2Fdocument.doc

I got the error message: {"message":"Forbidden"}

mendickxiao commented 5 years ago

Get the resource failed. https://unfnqzim4m.execute-api.us-east-1.amazonaws.com/favicon.ico

mendickxiao commented 5 years ago

I find the reason, I need to deploy the API manually, please close the ticket. On the API Gateway dashboard choose Resources, click Actions and choose Deploy API. Before your first deployment the only response you'll get is the {"message":"Forbidden"}.

mathangi28 commented 3 years ago

@mendickxiao i am getting the same error , can you please guide me