search

asriz7777 / FXSCRIPTS-TEST-AUTOMATION

0 stars 1 forks source link

Vulnerability [Hijack_Level1] : POST:/api/v1/orgs/users/addMemberToOrg #397

Open asriz7777 opened 5 years ago

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1

Run Id : 8a808011699a990101699ab0f9761b20

Job : Default

Env : Default

Category : Hijack_Level1

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVkMjFlOGQtNmFkZC00YzAxLWJlZTAtOGMxYWU1NDQzZGY3; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:38 GMT]}

Endpoint : http://13.56.210.25/api/v1/orgs/users/addMemberToOrg

Request :
{ "confirmPassword" : "T7Ge2DVg", "createdBy" : "", "createdDate" : "", "email" : "noelia.kemmer@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "T7Ge2DVg", "orgId" : "T7Ge2DVg", "orgRole" : "WRITE", "password" : "T7Ge2DVg", "username" : "fredy.schoen", "version" : "" }

Response :
{ "requestId" : "None", "requestTime" : "2019-03-20T10:41:38.418+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }

Logs :
2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : Request [{ "billingEmail" : "Yivuixhc", "company" : "Welch, Welch and Welch", "createdBy" : "", "createdDate" : "", "description" : "Yivuixhc", "id" : "", "inactive" : false, "location" : "Yivuixhc", "modifiedBy" : "", "modifiedDate" : "", "name" : "Yivuixhc", "orgPlan" : "TEAM", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:41:36.618+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs" }] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWNjY2RkOTYtMzNhZC00ODZmLWFjNmEtMjNjNTA4NmVkMGJk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:36 GMT]}] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : StatusCode [403] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : Time [653] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1] : Size [121] 2019-03-20 10:41:36 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWNjY2RkOTYtMzNhZC00ODZmLWFjNmEtMjNjNTA4NmVkMGJk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:36 GMT]}] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWNjY2RkOTYtMzNhZC00ODZmLWFjNmEtMjNjNTA4NmVkMGJk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:36 GMT]}] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWNjY2RkOTYtMzNhZC00ODZmLWFjNmEtMjNjNTA4NmVkMGJk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:36 GMT]}] 2019-03-20 10:41:36 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWNjY2RkOTYtMzNhZC00ODZmLWFjNmEtMjNjNTA4NmVkMGJk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:36 GMT]}] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : Request [{ "confirmPassword" : "oDxUU0Cg", "createdBy" : "", "createdDate" : "", "email" : "annamarie.gutmann@hotmail.com", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "oDxUU0Cg", "orgId" : "", "orgRole" : "WRITE", "password" : "oDxUU0Cg", "username" : "collin.greenfelder", "version" : "" }] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : Response [{ "requestId" : "None", "requestTime" : "2019-03-20T10:41:37.777+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjA3YzU3ODMtZGY4ZC00ZGQwLWFiNTUtNjQ4YjM3YTdhNjkw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:37 GMT]}] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : StatusCode [200] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : Time [661] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1] : Size [190] 2019-03-20 10:41:37 INFO [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [200 == 200 OR 200 == 201] result [Passed] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjA3YzU3ODMtZGY4ZC00ZGQwLWFiNTUtNjQ4YjM3YTdhNjkw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:37 GMT]}] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjA3YzU3ODMtZGY4ZC00ZGQwLWFiNTUtNjQ4YjM3YTdhNjkw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:37 GMT]}] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjA3YzU3ODMtZGY4ZC00ZGQwLWFiNTUtNjQ4YjM3YTdhNjkw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:37 GMT]}] 2019-03-20 10:41:37 DEBUG [MemberCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjA3YzU3ODMtZGY4ZC00ZGQwLWFiNTUtNjQ4YjM3YTdhNjkw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:37 GMT]}] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Method [POST] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Request [{ "confirmPassword" : "T7Ge2DVg", "createdBy" : "", "createdDate" : "", "email" : "noelia.kemmer@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "T7Ge2DVg", "orgId" : "T7Ge2DVg", "orgRole" : "WRITE", "password" : "T7Ge2DVg", "username" : "fredy.schoen", "version" : "" }] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Response [{ "requestId" : "None", "requestTime" : "2019-03-20T10:41:38.418+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVkMjFlOGQtNmFkZC00YzAxLWJlZTAtOGMxYWU1NDQzZGY3; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:38 GMT]}] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : StatusCode [200] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Time [513] 2019-03-20 10:41:38 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Size [190] 2019-03-20 10:41:38 ERROR [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : URL [http://13.56.210.25/api/v1/orgs/None] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Method [DELETE] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Request [null] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Response [{ "timestamp" : "2019-03-20T10:41:38.983+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs/None" }] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MWY3MzA3ZGUtNjg0OC00ZmRkLTk0OTUtNDNkNjI0NDk0M2Q1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:38 GMT]}] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : StatusCode [403] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Time [557] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Size [126] 2019-03-20 10:41:39 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [403 == 200] result [Failed] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : URL [http://13.56.210.25/api/v1/orgs/] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Method [DELETE] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request [null] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response [{ "timestamp" : "2019-03-20T10:41:39.511+0000", "status" : 405, "error" : "Method Not Allowed", "message" : "Request method 'DELETE' not supported", "path" : "/api/v1/orgs/" }] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response-Headers [{Allow=[GET, POST], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MGQ5ZTUwMWEtMDAxYy00Mjc2LTg1NTMtNTQwNzY0ZjM3NjJm; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:39 GMT]}] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : StatusCode [405] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Time [527] 2019-03-20 10:41:39 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Size [159] 2019-03-20 10:41:39 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [405 == 200] result [Failed]

--- FX Bot ---

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1

Run Id : 8a808011699a990101699ab3901a2277

Job : Default

Env : Default

Category : Hijack_Level1

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NzkzMjFmYTktYThhNy00YzVjLThiODgtNWUxYzdmMmFkNGNm; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:27 GMT]}

Endpoint : http://13.56.210.25/api/v1/orgs/users/addMemberToOrg

Request :
{ "confirmPassword" : "eu5CRxNz", "createdBy" : "", "createdDate" : "", "email" : "murl.lakin@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "eu5CRxNz", "orgId" : "eu5CRxNz", "orgRole" : "WRITE", "password" : "eu5CRxNz", "username" : "davin.parker", "version" : "" }

Response :
{ "requestId" : "None", "requestTime" : "2019-03-20T10:44:28.466+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }

Logs :
2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : Request [{ "billingEmail" : "rcxbBYFm", "company" : "Ryan-Ryan", "createdBy" : "", "createdDate" : "", "description" : "rcxbBYFm", "id" : "", "inactive" : false, "location" : "rcxbBYFm", "modifiedBy" : "", "modifiedDate" : "", "name" : "rcxbBYFm", "orgPlan" : "TEAM", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:44:27.030+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs" }] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjFhMGNjZTEtM2Y2NS00YTNjLTgzOTYtZWY0NjA4MWJjNWY0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : StatusCode [403] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : Time [460] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1] : Size [121] 2019-03-20 10:44:27 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjFhMGNjZTEtM2Y2NS00YTNjLTgzOTYtZWY0NjA4MWJjNWY0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjFhMGNjZTEtM2Y2NS00YTNjLTgzOTYtZWY0NjA4MWJjNWY0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjFhMGNjZTEtM2Y2NS00YTNjLTgzOTYtZWY0NjA4MWJjNWY0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjFhMGNjZTEtM2Y2NS00YTNjLTgzOTYtZWY0NjA4MWJjNWY0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : Request [{ "confirmPassword" : "BTkMEgJ0", "createdBy" : "", "createdDate" : "", "email" : "octavia.metz@yahoo.com", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "BTkMEgJ0", "orgId" : "", "orgRole" : "WRITE", "password" : "BTkMEgJ0", "username" : "rhiannon.considine", "version" : "" }] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : Response [{ "requestId" : "None", "requestTime" : "2019-03-20T10:44:27.665+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDBiZTNkODgtM2NiZS00YWY3LWFlNjctZTc2NTBmNGU4NjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : StatusCode [200] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : Time [437] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1] : Size [190] 2019-03-20 10:44:27 INFO [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [200 == 200 OR 200 == 201] result [Passed] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDBiZTNkODgtM2NiZS00YWY3LWFlNjctZTc2NTBmNGU4NjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDBiZTNkODgtM2NiZS00YWY3LWFlNjctZTc2NTBmNGU4NjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDBiZTNkODgtM2NiZS00YWY3LWFlNjctZTc2NTBmNGU4NjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:27 DEBUG [MemberCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDBiZTNkODgtM2NiZS00YWY3LWFlNjctZTc2NTBmNGU4NjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:26 GMT]}] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Method [POST] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Request [{ "confirmPassword" : "eu5CRxNz", "createdBy" : "", "createdDate" : "", "email" : "murl.lakin@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "eu5CRxNz", "orgId" : "eu5CRxNz", "orgRole" : "WRITE", "password" : "eu5CRxNz", "username" : "davin.parker", "version" : "" }] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Response [{ "requestId" : "None", "requestTime" : "2019-03-20T10:44:28.466+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NzkzMjFmYTktYThhNy00YzVjLThiODgtNWUxYzdmMmFkNGNm; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:27 GMT]}] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : StatusCode [200] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Time [653] 2019-03-20 10:44:28 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Size [190] 2019-03-20 10:44:28 ERROR [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : URL [http://13.56.210.25/api/v1/orgs/None] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Method [DELETE] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Request [null] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Response [{ "timestamp" : "2019-03-20T10:44:29.134+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs/None" }] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=OGQ1N2YxOTUtOGFiZi00NDgxLWE4MGMtNDFhN2I5MGQyMzVh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:28 GMT]}] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : StatusCode [403] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Time [662] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Size [126] 2019-03-20 10:44:29 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [403 == 200] result [Failed] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : URL [http://13.56.210.25/api/v1/orgs/] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Method [DELETE] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request [null] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response [{ "timestamp" : "2019-03-20T10:44:29.797+0000", "status" : 405, "error" : "Method Not Allowed", "message" : "Request method 'DELETE' not supported", "path" : "/api/v1/orgs/" }] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response-Headers [{Allow=[GET, POST], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NTI5ZWJjZDMtMDZkMi00YTQ0LWJhMDgtZjg0MzNlNzVhZTYw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:28 GMT]}] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : StatusCode [405] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Time [663] 2019-03-20 10:44:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Size [159] 2019-03-20 10:44:29 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [405 == 200] result [Failed]

--- FX Bot ---

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1

Run Id : 8a808011699a990101699ab3901a2277

Job : Default

Env : Default

Category : Hijack_Level1

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZmI0YjY4YTUtY2Y5OS00NzE4LWEyYmItZTZkZDdjMWU4ZTk3; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:19 GMT]}

Endpoint : http://13.56.210.25/api/v1/orgs/users/addMemberToOrg

Request :
{ "confirmPassword" : "slhpBhPG", "createdBy" : "", "createdDate" : "", "email" : "allison.williamson@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "slhpBhPG", "orgId" : "slhpBhPG", "orgRole" : "WRITE", "password" : "slhpBhPG", "username" : "antone.will", "version" : "" }

Response :
{ "requestId" : "None", "requestTime" : "2019-03-20T10:45:19.420+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }

Logs :
2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : Request [{ "billingEmail" : "canS4shH", "company" : "Hodkiewicz-Hodkiewicz", "createdBy" : "", "createdDate" : "", "description" : "canS4shH", "id" : "", "inactive" : false, "location" : "canS4shH", "modifiedBy" : "", "modifiedDate" : "", "name" : "canS4shH", "orgPlan" : "TEAM", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:45:17.866+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs" }] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWJiOWRhYjYtZGI0Ni00YWU5LTk3MTItZTM0MmU4ZDFhYmYy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:17 GMT]}] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : StatusCode [403] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : Time [1016] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1] : Size [121] 2019-03-20 10:45:17 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWJiOWRhYjYtZGI0Ni00YWU5LTk3MTItZTM0MmU4ZDFhYmYy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:17 GMT]}] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWJiOWRhYjYtZGI0Ni00YWU5LTk3MTItZTM0MmU4ZDFhYmYy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:17 GMT]}] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWJiOWRhYjYtZGI0Ni00YWU5LTk3MTItZTM0MmU4ZDFhYmYy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:17 GMT]}] 2019-03-20 10:45:17 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWJiOWRhYjYtZGI0Ni00YWU5LTk3MTItZTM0MmU4ZDFhYmYy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:17 GMT]}] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : Request [{ "confirmPassword" : "FKisRVbN", "createdBy" : "", "createdDate" : "", "email" : "kieran.daugherty@hotmail.com", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "FKisRVbN", "orgId" : "", "orgRole" : "WRITE", "password" : "FKisRVbN", "username" : "paula.wehner", "version" : "" }] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : Response [{ "requestId" : "None", "requestTime" : "2019-03-20T10:45:18.843+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWJmYzRjZTUtMjdhYS00MDFhLTlhNWQtMGNmYjY5NzRlZjVj; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:18 GMT]}] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : StatusCode [200] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : Time [875] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1] : Size [190] 2019-03-20 10:45:18 INFO [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [200 == 200 OR 200 == 201] result [Passed] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWJmYzRjZTUtMjdhYS00MDFhLTlhNWQtMGNmYjY5NzRlZjVj; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:18 GMT]}] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWJmYzRjZTUtMjdhYS00MDFhLTlhNWQtMGNmYjY5NzRlZjVj; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:18 GMT]}] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWJmYzRjZTUtMjdhYS00MDFhLTlhNWQtMGNmYjY5NzRlZjVj; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:18 GMT]}] 2019-03-20 10:45:18 DEBUG [MemberCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YWJmYzRjZTUtMjdhYS00MDFhLTlhNWQtMGNmYjY5NzRlZjVj; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:18 GMT]}] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Method [POST] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Request [{ "confirmPassword" : "slhpBhPG", "createdBy" : "", "createdDate" : "", "email" : "allison.williamson@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "slhpBhPG", "orgId" : "slhpBhPG", "orgRole" : "WRITE", "password" : "slhpBhPG", "username" : "antone.will", "version" : "" }] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Response [{ "requestId" : "None", "requestTime" : "2019-03-20T10:45:19.420+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZmI0YjY4YTUtY2Y5OS00NzE4LWEyYmItZTZkZDdjMWU4ZTk3; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:19 GMT]}] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : StatusCode [200] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Time [469] 2019-03-20 10:45:19 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Size [190] 2019-03-20 10:45:19 ERROR [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : URL [http://13.56.210.25/api/v1/orgs/None] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Method [DELETE] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Request [null] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Response [{ "timestamp" : "2019-03-20T10:45:20.635+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs/None" }] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MDZmM2FhZWItOGY1YS00ZjQyLTliZmYtYThiYzg5ZDBiNGY0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:20 GMT]}] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : StatusCode [403] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Time [1192] 2019-03-20 10:45:20 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Size [126] 2019-03-20 10:45:20 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [403 == 200] result [Failed] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : URL [http://13.56.210.25/api/v1/orgs/] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Method [DELETE] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request [null] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response [{ "timestamp" : "2019-03-20T10:45:22.028+0000", "status" : 405, "error" : "Method Not Allowed", "message" : "Request method 'DELETE' not supported", "path" : "/api/v1/orgs/" }] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response-Headers [{Allow=[GET, POST], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ODYxNDFmN2QtZTE3Zi00MjNlLWE0Y2ItMjUzMWNmOGUzYzk4; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:45:21 GMT]}] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : StatusCode [405] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Time [1393] 2019-03-20 10:45:22 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Size [159] 2019-03-20 10:45:22 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [405 == 200] result [Failed]

--- FX Bot ---

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1

Run Id : 8a808011699a990101699ab3901a2277

Job : Default

Env : Default

Category : Hijack_Level1

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YTE3OTVkNmMtZjk1MC00YjRlLWIwMWEtYTgzN2ZkZWI2NmQ5; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:25 GMT]}

Endpoint : http://13.56.210.25/api/v1/orgs/users/addMemberToOrg

Request :
{ "confirmPassword" : "tEW3267x", "createdBy" : "", "createdDate" : "", "email" : "dino.cole@hotmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "tEW3267x", "orgId" : "tEW3267x", "orgRole" : "WRITE", "password" : "tEW3267x", "username" : "kellie.lebsack", "version" : "" }

Response :
{ "requestId" : "None", "requestTime" : "2019-03-20T10:46:26.387+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }

Logs :
2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : Request [{ "billingEmail" : "9z78Zog1", "company" : "Beer Group", "createdBy" : "", "createdDate" : "", "description" : "9z78Zog1", "id" : "", "inactive" : false, "location" : "9z78Zog1", "modifiedBy" : "", "modifiedDate" : "", "name" : "9z78Zog1", "orgPlan" : "TEAM", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:46:23.883+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs" }] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NjllZmFhZDEtZWRjZC00ZjIzLWFmNmItYjIyODA4NDkyMmZi; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:23 GMT]}] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : StatusCode [403] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : Time [1575] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1] : Size [121] 2019-03-20 10:46:23 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NjllZmFhZDEtZWRjZC00ZjIzLWFmNmItYjIyODA4NDkyMmZi; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:23 GMT]}] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NjllZmFhZDEtZWRjZC00ZjIzLWFmNmItYjIyODA4NDkyMmZi; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:23 GMT]}] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NjllZmFhZDEtZWRjZC00ZjIzLWFmNmItYjIyODA4NDkyMmZi; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:23 GMT]}] 2019-03-20 10:46:23 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NjllZmFhZDEtZWRjZC00ZjIzLWFmNmItYjIyODA4NDkyMmZi; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:23 GMT]}] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : Request [{ "confirmPassword" : "QyhAaMmn", "createdBy" : "", "createdDate" : "", "email" : "winifred.brekke@yahoo.com", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "QyhAaMmn", "orgId" : "", "orgRole" : "WRITE", "password" : "QyhAaMmn", "username" : "trevor.wintheiser", "version" : "" }] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : Response [{ "requestId" : "None", "requestTime" : "2019-03-20T10:46:24.796+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NDE3MTExNGEtNDQxYS00ODg0LTliY2QtMjUzMzY0ZmEwZjhk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:24 GMT]}] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : StatusCode [200] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : Time [798] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1] : Size [190] 2019-03-20 10:46:24 INFO [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [200 == 200 OR 200 == 201] result [Passed] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NDE3MTExNGEtNDQxYS00ODg0LTliY2QtMjUzMzY0ZmEwZjhk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:24 GMT]}] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NDE3MTExNGEtNDQxYS00ODg0LTliY2QtMjUzMzY0ZmEwZjhk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:24 GMT]}] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NDE3MTExNGEtNDQxYS00ODg0LTliY2QtMjUzMzY0ZmEwZjhk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:24 GMT]}] 2019-03-20 10:46:24 DEBUG [MemberCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NDE3MTExNGEtNDQxYS00ODg0LTliY2QtMjUzMzY0ZmEwZjhk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:24 GMT]}] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Method [POST] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Request [{ "confirmPassword" : "tEW3267x", "createdBy" : "", "createdDate" : "", "email" : "dino.cole@hotmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "tEW3267x", "orgId" : "tEW3267x", "orgRole" : "WRITE", "password" : "tEW3267x", "username" : "kellie.lebsack", "version" : "" }] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Response [{ "requestId" : "None", "requestTime" : "2019-03-20T10:46:26.387+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YTE3OTVkNmMtZjk1MC00YjRlLWIwMWEtYTgzN2ZkZWI2NmQ5; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:25 GMT]}] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : StatusCode [200] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Time [1488] 2019-03-20 10:46:26 DEBUG [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Size [190] 2019-03-20 10:46:26 ERROR [ApiV1OrgsUsersAddmembertoorgPostMemberuserbDisallowHijack1] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : URL [http://13.56.210.25/api/v1/orgs/None] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Method [DELETE] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Request [null] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Response [{ "timestamp" : "2019-03-20T10:46:28.077+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs/None" }] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjMzYWQ4NmItZmZhNi00YTAzLWI4MDYtODZiNDZkMjVhMWUx; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:27 GMT]}] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : StatusCode [403] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Time [1676] 2019-03-20 10:46:28 DEBUG [ApiV1OrgsRequestidDeleteMemberhijack1] : Size [126] 2019-03-20 10:46:28 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [403 == 200] result [Failed] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : URL [http://13.56.210.25/api/v1/orgs/] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Method [DELETE] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request [null] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response [{ "timestamp" : "2019-03-20T10:46:29.681+0000", "status" : 405, "error" : "Method Not Allowed", "message" : "Request method 'DELETE' not supported", "path" : "/api/v1/orgs/" }] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response-Headers [{Allow=[GET, POST], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=N2I2ODBlN2ItYWI5Ny00NzkxLWFhMDAtNjc3MzZhMjE0MjVl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:46:29 GMT]}] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : StatusCode [405] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Time [1603] 2019-03-20 10:46:29 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Size [159] 2019-03-20 10:46:29 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [405 == 200] result [Failed]

--- FX Bot ---