asriz7777
commented
5 years ago Project : NET BANKING APP
Job : Default
Env : Default
Region : FXLabs/US_WEST_1
Result : fail
Status Code : 200
Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MWQ1YmE5ODEtYThjMy00M2Q3LTkyNzctZDU2YTliN2FhZWM0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 16:25:57 GMT]}
Endpoint : http://54.215.136.217/api/v1/branches/8a80805668757e1b0168b9549a962a4f
Request :
Response :
{
"requestId" : "None",
"requestTime" : "2019-02-04T16:25:58.274+0000",
"errors" : false,
"messages" : [ ],
"data" : {
"id" : "8a80805668757e1b0168b9549a962a4f",
"createdBy" : "8a8080ef675086770167508ce8d30000",
"createdDate" : "2019-02-04T16:25:56.118+0000",
"modifiedBy" : "8a8080ef675086770167508ce8d30000",
"modifiedDate" : "2019-02-04T16:25:56.118+0000",
"version" : null,
"inactive" : false,
"access" : "IrP7arKW",
"atmAtBranch" : "IrP7arKW",
"branchName" : "IrP7arKW",
"branchMediatedServiceName" : "IrP7arKW",
"branchType" : "IrP7arKW",
"customerSegment" : "IrP7arKW",
"faxNumber" : "IrP7arKW"
},
"totalPages" : 0,
"totalElements" : 0
}
Logs :
Assertion [@StatusCode == 401 OR @StatusCode == 403 OR @Response.errors == true] resolved-to [200 == 401 OR 200 == 403 OR false == true] result [Failed]
--- FX Bot ---
Project : NET BANKING APP
Job : Default
Env : Default
Category : ABAC_Level1
Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]
Severity : Major
Region : FXLabs/US_WEST_1
Result : fail
Status Code : 200
Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YzkxMTFiYzItOTJmNS00ODgyLTg0OGMtMDJmNWUwMDU1MWEx; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 15:22:37 GMT]}
Endpoint : http://54.215.136.217/api/v1/branches/8a80805668757e1b0168b91aa08e2984
Request :
Response :
{ "requestId" : "None", "requestTime" : "2019-02-04T15:22:38.549+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "8a80805668757e1b0168b91aa08e2984", "createdBy" : "8a8080ef675086770167508ce8d30000", "createdDate" : "2019-02-04T15:22:36.558+0000", "modifiedBy" : "8a8080ef675086770167508ce8d30000", "modifiedDate" : "2019-02-04T15:22:36.558+0000", "version" : null, "inactive" : false, "access" : "fGlojQyN", "atmAtBranch" : "fGlojQyN", "branchName" : "fGlojQyN", "branchMediatedServiceName" : "fGlojQyN", "branchType" : "fGlojQyN", "customerSegment" : "fGlojQyN", "faxNumber" : "fGlojQyN" }, "totalPages" : 0, "totalElements" : 0 }
Logs :
2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : URL [http://54.215.136.217/api/v1/branches] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : Method [POST] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : Request [{ "access" : "fGlojQyN", "atmAtBranch" : "fGlojQyN", "branchMediatedServiceName" : "fGlojQyN", "branchName" : "fGlojQyN", "branchType" : "fGlojQyN", "createdBy" : "", "createdDate" : "", "customerSegment" : "fGlojQyN", "faxNumber" : "fGlojQyN", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "version" : "" }] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic YWRtaW5AbmV0YmFua2luZy5pbzphZG1pbjEyMyQ=]}] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : Response [{ "requestId" : "None", "requestTime" : "2019-02-04T15:22:36.567+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "8a80805668757e1b0168b91aa08e2984", "createdBy" : "8a8080ef675086770167508ce8d30000", "createdDate" : "2019-02-04T15:22:36.558+0000", "modifiedBy" : "8a8080ef675086770167508ce8d30000", "modifiedDate" : "2019-02-04T15:22:36.558+0000", "version" : null, "inactive" : false, "access" : "fGlojQyN", "atmAtBranch" : "fGlojQyN", "branchName" : "fGlojQyN", "branchMediatedServiceName" : "fGlojQyN", "branchType" : "fGlojQyN", "customerSegment" : "fGlojQyN", "faxNumber" : "fGlojQyN" }, "totalPages" : 0, "totalElements" : 0 }] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YTQ2MGNjNWMtMTBiMC00ZDc5LTliZDAtOGNiMzhhZDM5NzUz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 15:22:36 GMT]}] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : StatusCode [200] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : Time [1408] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac] : Size [578] 2019-02-04 03:22:36 INFO [null] : Assertion [@StatusCode == 200 AND @Response.errors == false] resolved-to [200 == 200 AND false == false] result [Passed] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YTQ2MGNjNWMtMTBiMC00ZDc5LTliZDAtOGNiMzhhZDM5NzUz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 15:22:36 GMT]}] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YTQ2MGNjNWMtMTBiMC00ZDc5LTliZDAtOGNiMzhhZDM5NzUz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 15:22:36 GMT]}] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YTQ2MGNjNWMtMTBiMC00ZDc5LTliZDAtOGNiMzhhZDM5NzUz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 15:22:36 GMT]}] 2019-02-04 03:22:36 DEBUG [BranchCreateUserAInitAbac_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YTQ2MGNjNWMtMTBiMC00ZDc5LTliZDAtOGNiMzhhZDM5NzUz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 15:22:36 GMT]}] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : URL [http://54.215.136.217/api/v1/branches/8a80805668757e1b0168b91aa08e2984] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : Method [GET] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : Request [] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckNAb25saW5lc3VwcG9ydC5pbzphZG1pbjEyMyQ=]}] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : Response [{ "requestId" : "None", "requestTime" : "2019-02-04T15:22:38.549+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "8a80805668757e1b0168b91aa08e2984", "createdBy" : "8a8080ef675086770167508ce8d30000", "createdDate" : "2019-02-04T15:22:36.558+0000", "modifiedBy" : "8a8080ef675086770167508ce8d30000", "modifiedDate" : "2019-02-04T15:22:36.558+0000", "version" : null, "inactive" : false, "access" : "fGlojQyN", "atmAtBranch" : "fGlojQyN", "branchName" : "fGlojQyN", "branchMediatedServiceName" : "fGlojQyN", "branchType" : "fGlojQyN", "customerSegment" : "fGlojQyN", "faxNumber" : "fGlojQyN" }, "totalPages" : 0, "totalElements" : 0 }] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YzkxMTFiYzItOTJmNS00ODgyLTg0OGMtMDJmNWUwMDU1MWEx; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 15:22:37 GMT]}] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : StatusCode [200] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : Time [1969] 2019-02-04 03:22:38 DEBUG [ApiV1BranchesIdGetBranchUsercDisallowAbac] : Size [578] 2019-02-04 03:22:38 ERROR [ApiV1BranchesIdGetBranchUsercDisallowAbac] : Assertion [@StatusCode == 401 OR @StatusCode == 403 OR @Response.errors == true] resolved-to [200 == 401 OR 200 == 403 OR false == true] result [Failed] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : URL [http://54.215.136.217/api/v1/branches/8a80805668757e1b0168b91aa08e2984] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : Method [DELETE] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : Request [null] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic YWRtaW5AbmV0YmFua2luZy5pbzphZG1pbjEyMyQ=]}] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : Response [{ "requestId" : "None", "requestTime" : "2019-02-04T15:22:40.782+0000", "errors" : false, "messages" : [ ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NTgzOTA4YzMtNmQ4My00YjdlLWIzNTUtNDU1NWEwMzU4MTgz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 04 Feb 2019 15:22:40 GMT]}] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : StatusCode [200] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : Time [2252] 2019-02-04 03:22:40 DEBUG [ApiV1BranchesIdDeleteAbstractAbac] : Size [139] 2019-02-04 03:22:40 INFO [null] : Assertion [@StatusCode == 200] resolved-to [200 == 200] result [Passed]
--- FX Bot ---