search

asriz7777 / FXSCRIPTS-TEST-AUTOMATION

0 stars 1 forks source link

Vulnerability [null] : GET:/api/v1/abac/project/{projectId}/add-abac-rules #105

Open asriz7777 opened 5 years ago

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac

Run Id : 8a8080f6695ba6ee01695c1932e37290

Job : Default

Env : Default

Category : null

Tags : null

Severity : null

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MjM2Y2NlMjgtYzc5Zi00Mzg2LTk1ZjMtYmIwNTc1NzM2NWUw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Fri, 08 Mar 2019 06:59:26 GMT]}

Endpoint : http://13.56.210.25/api/v1/abac/project/None/add-abac-rules

Request :

Response :
{ "requestId" : "None", "requestTime" : "2019-03-08T06:59:26.747+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : null, "value" : "No Resources found." } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }

Logs :
Assertion [@StatusCode == 401 OR @StatusCode == 403 OR @Response.errors == true] resolved-to [200 == 401 OR 200 == 403 OR true == true] result [Passed] --- FX Bot ---

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac

Run Id : 8a80808d698f0d6701698fd9c69b23cb

Job : Default

Env : Default

Category : ABAC_Level1

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZjM3NmQ3NTctYjYwZC00NmZhLWI1MDItZDhiYjc1MzZkYTFm; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:28 GMT]}

Endpoint : http://13.56.210.25/api/v1/abac/project/None/add-abac-rules

Request :

Response :
{ "requestId" : "None", "requestTime" : "2019-03-18T08:11:28.612+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : null, "value" : "No Resources found." } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }

Logs :
2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : URL [http://13.56.210.25/api/v1/abac/batch] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : Method [POST] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : Request [[ { "createBody" : "cxuHRXwq", "createEndpoint" : "cxuHRXwq", "createUserAuth" : "cxuHRXwq", "createdBy" : "", "createdDate" : "", "deleteEndpoint" : "cxuHRXwq", "enumValues" : "cxuHRXwq", "generatorId" : "cxuHRXwq", "id" : "", "inactive" : false, "initScriptName" : "cxuHRXwq", "lock" : false, "modifiedBy" : "", "modifiedDate" : "", "resourceName" : "cxuHRXwq", "scripts" : [ { "body" : "cxuHRXwq", "deleteEndPoint" : "cxuHRXwq", "endpoint" : "cxuHRXwq", "resourceName" : "cxuHRXwq", "scriptName" : "cxuHRXwq", "scriptType" : "cxuHRXwq", "sequence" : "706155053", "userAuth" : "cxuHRXwq", "validationScript" : false } ], "typeThreeCreateEndpoint" : "cxuHRXwq", "validations" : [ { "body" : "cxuHRXwq", "endpoint" : "cxuHRXwq", "inactive" : false, "lock" : false, "path" : "cxuHRXwq", "userAuth" : "cxuHRXwq", "validationType" : "cxuHRXwq" } ], "version" : "" } ]] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:11:27.432+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Resource name or key already exists." } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MjJlOTlmNzMtMjA1Ny00Mjg1LWIwNjctNmM5ZGI1MjZhOTlh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:27 GMT]}] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : StatusCode [200] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : Time [1134] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac] : Size [210] 2019-03-18 08:11:27 ERROR [null] : Assertion [@StatusCode == 200 AND @Response.errors == false] resolved-to [200 == 200 AND true == false] result [Failed] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MjJlOTlmNzMtMjA1Ny00Mjg1LWIwNjctNmM5ZGI1MjZhOTlh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:27 GMT]}] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MjJlOTlmNzMtMjA1Ny00Mjg1LWIwNjctNmM5ZGI1MjZhOTlh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:27 GMT]}] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MjJlOTlmNzMtMjA1Ny00Mjg1LWIwNjctNmM5ZGI1MjZhOTlh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:27 GMT]}] 2019-03-18 08:11:27 DEBUG [ArrayAbacResourceCreateUserAInitAbac_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MjJlOTlmNzMtMjA1Ny00Mjg1LWIwNjctNmM5ZGI1MjZhOTlh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:27 GMT]}] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : URL [http://13.56.210.25/api/v1/abac/project/None/add-abac-rules] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : Method [GET] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : Request [] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQy8vdXNlckNAbWV0bGFicy5pbzpvcmcxMjM0JA==]}] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:11:28.612+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : null, "value" : "No Resources found." } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZjM3NmQ3NTctYjYwZC00NmZhLWI1MDItZDhiYjc1MzZkYTFm; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:28 GMT]}] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : StatusCode [200] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : Time [1174] 2019-03-18 08:11:28 DEBUG [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : Size [195] 2019-03-18 08:11:28 INFO [ApiV1AbacProjectProjectidAddAbacRulesGetUseraCreateArrayabacresourceUsercDisallowAbac] : Assertion [@StatusCode == 401 OR @StatusCode == 403 OR @Response.errors == true] resolved-to [200 == 401 OR 200 == 403 OR true == true] result [Passed] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : URL [http://13.56.210.25/api/v1/abac/] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : Method [DELETE] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : Request [null] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : Response [{ "timestamp" : "2019-03-18T08:11:29.823+0000", "status" : 405, "error" : "Method Not Allowed", "message" : "Request method 'DELETE' not supported", "path" : "/api/v1/abac/" }] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : Response-Headers [{Allow=[GET, PUT, POST], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NDAzMDU1MzQtNzFjZS00Y2NjLWEyMjYtNjY0YTdmMTU3OTc0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:29 GMT]}] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : StatusCode [405] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : Time [1187] 2019-03-18 08:11:29 DEBUG [ApiV1AbacIdDeleteArrayabacresourceAbstractAbac] : Size [159] 2019-03-18 08:11:29 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [405 == 200] result [Failed]

--- FX Bot ---