asriz7777 / FXSCRIPTS-TEST-AUTOMATION

0 stars 1 forks source link

Vulnerability [ABAC_Level3] : GET:/api/v1/skills/id #293

Open asriz7777 opened 5 years ago

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1SkillsIdGetSkilluserbDisallowAbact3

Run Id : 8a80808d698f0d6701698fd9c69b23cb

Job : Default

Env : Default

Category : ABAC_Level3

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MzgyY2UwNGYtMzRhNy00OTcxLWI0ZDEtNmI4YTMxNmJhNDlj; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:51 GMT]}

Endpoint : http://13.56.210.25/api/v1/skills/8a808085698f12b501698fdb5859067c

Request :

Response :
{ "requestId" : "None", "requestTime" : "2019-03-18T08:11:51.689+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "8a808085698f12b501698fdb5859067c", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:11:50.745+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:11:50.745+0000", "version" : null, "inactive" : false, "org" : { "id" : "8a808085698f12b501698fdb53c60677", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:11:49.574+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:11:49.574+0000", "version" : null, "inactive" : false, "name" : "nPLRJphO" }, "name" : "YommPJaP", "description" : "YommPJaP", "skillType" : "ANALYTICS", "key" : "YommPJaP", "accessKey" : "YommPJaP", "secretKey" : "YommPJaP", "host" : "YommPJaP", "prop1" : "YommPJaP", "prop2" : "YommPJaP", "prop3" : "YommPJaP", "prop4" : "YommPJaP", "prop5" : "YommPJaP", "opts" : [ ] }, "totalPages" : 0, "totalElements" : 0 }

Logs :
2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : Method [POST] 2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : Request [{ "billingEmail" : "nPLRJphO", "company" : "Morar, Morar and Morar", "createdBy" : "", "createdDate" : "", "description" : "nPLRJphO", "id" : "", "inactive" : false, "location" : "nPLRJphO", "modifiedBy" : "", "modifiedDate" : "", "name" : "nPLRJphO", "orgPlan" : "FREE", "orgType" : "TEAM", "version" : "" }] 2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:11:49.575+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "8a808085698f12b501698fdb53c60677", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:11:49.574+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:11:49.574+0000", "version" : null, "inactive" : false, "name" : "nPLRJphO", "description" : "nPLRJphO", "orgType" : "ENTERPRISE", "billingEmail" : "nPLRJphO", "company" : "Morar, Morar and Morar", "location" : "nPLRJphO", "orgPlan" : "ENTERPRISE" }, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NzQ4YTMwNjMtNDI2Yi00MjJlLWFjMmMtMmFjN2UzMWJjNjI1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:48 GMT]}] 2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : StatusCode [200] 2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : Time [990] 2019-03-18 08:11:49 DEBUG [ OrgCreateUserAInitAbact3] : Size [566] 2019-03-18 08:11:49 INFO [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [200 == 200 OR 200 == 201] result [Passed] 2019-03-18 08:11:49 DEBUG [OrgCreateUserAInitAbact3_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NzQ4YTMwNjMtNDI2Yi00MjJlLWFjMmMtMmFjN2UzMWJjNjI1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:48 GMT]}] 2019-03-18 08:11:49 DEBUG [OrgCreateUserAInitAbact3_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NzQ4YTMwNjMtNDI2Yi00MjJlLWFjMmMtMmFjN2UzMWJjNjI1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:48 GMT]}] 2019-03-18 08:11:49 DEBUG [OrgCreateUserAInitAbact3_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NzQ4YTMwNjMtNDI2Yi00MjJlLWFjMmMtMmFjN2UzMWJjNjI1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:48 GMT]}] 2019-03-18 08:11:49 DEBUG [OrgCreateUserAInitAbact3_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NzQ4YTMwNjMtNDI2Yi00MjJlLWFjMmMtMmFjN2UzMWJjNjI1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:48 GMT]}] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : URL [http://13.56.210.25/api/v1/skills] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : Method [POST] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : Request [{ "accessKey" : "YommPJaP", "createdBy" : "", "createdDate" : "", "description" : "YommPJaP", "host" : "YommPJaP", "id" : "", "inactive" : false, "key" : "YommPJaP", "modifiedBy" : "", "modifiedDate" : "", "name" : "YommPJaP", "org" : { "id" : "8a808085698f12b501698fdb53c60677", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:11:49.574+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:11:49.574+0000", "version" : null, "inactive" : false, "name" : "nPLRJphO", "description" : "nPLRJphO", "orgType" : "ENTERPRISE", "billingEmail" : "nPLRJphO", "company" : "Morar, Morar and Morar", "location" : "nPLRJphO", "orgPlan" : "ENTERPRISE" }, "prop1" : "YommPJaP", "prop2" : "YommPJaP", "prop3" : "YommPJaP", "prop4" : "YommPJaP", "prop5" : "YommPJaP", "secretKey" : "YommPJaP", "skillType" : "ANALYTICS", "version" : "" }] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:11:50.749+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "8a808085698f12b501698fdb5859067c", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:11:50.745+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:11:50.745+0000", "version" : null, "inactive" : false, "org" : { "id" : "8a808085698f12b501698fdb53c60677", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:11:49.574+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:11:49.574+0000", "version" : null, "inactive" : false, "name" : "nPLRJphO" }, "name" : "YommPJaP", "description" : "YommPJaP", "skillType" : "ANALYTICS", "key" : "YommPJaP", "accessKey" : "YommPJaP", "secretKey" : "YommPJaP", "host" : "YommPJaP", "prop1" : "YommPJaP", "prop2" : "YommPJaP", "prop3" : "YommPJaP", "prop4" : "YommPJaP", "prop5" : "YommPJaP", "opts" : null }, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MDhiM2VhZmYtMmZjOS00ZTcwLTg3ZTAtNTI4OGI1MWEyOWE2; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:50 GMT]}] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : StatusCode [200] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : Time [1098] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3] : Size [933] 2019-03-18 08:11:50 INFO [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [200 == 200 OR 200 == 201] result [Passed] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MDhiM2VhZmYtMmZjOS00ZTcwLTg3ZTAtNTI4OGI1MWEyOWE2; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:50 GMT]}] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MDhiM2VhZmYtMmZjOS00ZTcwLTg3ZTAtNTI4OGI1MWEyOWE2; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:50 GMT]}] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MDhiM2VhZmYtMmZjOS00ZTcwLTg3ZTAtNTI4OGI1MWEyOWE2; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:50 GMT]}] 2019-03-18 08:11:50 DEBUG [SkillCreateUserAInitAbact3_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MDhiM2VhZmYtMmZjOS00ZTcwLTg3ZTAtNTI4OGI1MWEyOWE2; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:50 GMT]}] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : URL [http://13.56.210.25/api/v1/skills/8a808085698f12b501698fdb5859067c] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : Method [GET] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : Request [] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:11:51.689+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "8a808085698f12b501698fdb5859067c", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:11:50.745+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:11:50.745+0000", "version" : null, "inactive" : false, "org" : { "id" : "8a808085698f12b501698fdb53c60677", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:11:49.574+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:11:49.574+0000", "version" : null, "inactive" : false, "name" : "nPLRJphO" }, "name" : "YommPJaP", "description" : "YommPJaP", "skillType" : "ANALYTICS", "key" : "YommPJaP", "accessKey" : "YommPJaP", "secretKey" : "YommPJaP", "host" : "YommPJaP", "prop1" : "YommPJaP", "prop2" : "YommPJaP", "prop3" : "YommPJaP", "prop4" : "YommPJaP", "prop5" : "YommPJaP", "opts" : [ ] }, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MzgyY2UwNGYtMzRhNy00OTcxLWI0ZDEtNmI4YTMxNmJhNDlj; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:51 GMT]}] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : StatusCode [200] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : Time [963] 2019-03-18 08:11:51 DEBUG [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : Size [931] 2019-03-18 08:11:51 ERROR [ApiV1SkillsIdGetSkilluserbDisallowAbact3] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : URL [http://13.56.210.25/api/v1/skills/8a808085698f12b501698fdb5859067c] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : Method [DELETE] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : Request [null] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:11:52.693+0000", "errors" : false, "messages" : [ ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZmQzNmRlZjItMDcxYi00ZjU4LWJiM2YtNjk0OTgzNjlmMzcz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:52 GMT]}] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : StatusCode [200] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : Time [1014] 2019-03-18 08:11:52 DEBUG [ApiV1SkillsIdDeleteSkillabact3] : Size [139] 2019-03-18 08:11:52 INFO [null] : Assertion [@StatusCode == 200] resolved-to [200 == 200] result [Passed] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : URL [http://13.56.210.25/api/v1/orgs/] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : Method [DELETE] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : Request [null] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : Response [{ "timestamp" : "2019-03-18T08:11:53.853+0000", "status" : 405, "error" : "Method Not Allowed", "message" : "Request method 'DELETE' not supported", "path" : "/api/v1/orgs/" }] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : Response-Headers [{Allow=[GET, POST], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MzJkZDk5N2EtY2Y0My00MzQwLWFhYTctMDFjYTk1MzZhYjA3; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:11:53 GMT]}] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : StatusCode [405] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : Time [1109] 2019-03-18 08:11:53 DEBUG [ ApiV1OrgsIdDeleteAbact3] : Size [159] 2019-03-18 08:11:53 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [405 == 200] result [Failed]

--- FX Bot ---