search

asriz7777 / FXSCRIPTS-TEST-AUTOMATION

0 stars 1 forks source link

Vulnerability [Hijack_Level1] : POST:/api/v1/users/org-add #423

Open asriz7777 opened 5 years ago

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1

Run Id : 8a808011699a990101699ab0f9761b20

Job : Default

Env : Default

Category : Hijack_Level1

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 400

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=Mzc5NTVlM2MtYjE3ZC00OTM5LWI5NDgtOTU4YTk4MGJhZGFk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:56 GMT]}

Endpoint : http://13.56.210.25/api/v1/users/org-add

Request :
{ "createdBy" : "", "createdDate" : "", "forceResetPwd" : false, "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "org" : "", "orgRole" : "WRITE", "status" : "ACTIVE", "userType" : "DEFAULT", "users" : "", "version" : "" }

Response :
{ "timestamp" : "2019-03-20T10:41:56.510+0000", "status" : 400, "error" : "Bad Request", "message" : "JSON parse error: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value (''); nested exception is com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('')\n at [Source: (PushbackInputStream); line: 9, column: 11] (through reference chain: com.fxlabs.fxt.dto.users.OrgUsers[\"org\"])", "path" : "/api/v1/users/org-add" }

Logs :
2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/users/enterprise-sign-up] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : Request [{ "accountNonExpired" : false, "accountNonLocked" : false, "company" : "Ernser and Sons", "createdBy" : "", "createdDate" : "", "credentialsNonExpired" : false, "email" : "dario.labadie@yahoo.com", "enabled" : false, "id" : "", "inactive" : false, "jobTitle" : "District Supervisor", "location" : "0m8HfCPx", "modifiedBy" : "", "modifiedDate" : "", "name" : "0m8HfCPx", "password" : "0m8HfCPx", "username" : "lance.shanahan", "version" : "" }] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:41:53.035+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/users/enterprise-sign-up" }] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZmQ1MGMyM2EtMDM5Zi00NzFkLWFiOWQtZGNlNjIzOWFmNTUw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:52 GMT]}] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : StatusCode [403] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : Time [491] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1] : Size [141] 2019-03-20 10:41:53 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZmQ1MGMyM2EtMDM5Zi00NzFkLWFiOWQtZGNlNjIzOWFmNTUw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:52 GMT]}] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZmQ1MGMyM2EtMDM5Zi00NzFkLWFiOWQtZGNlNjIzOWFmNTUw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:52 GMT]}] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZmQ1MGMyM2EtMDM5Zi00NzFkLWFiOWQtZGNlNjIzOWFmNTUw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:52 GMT]}] 2019-03-20 10:41:53 DEBUG [UsersCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZmQ1MGMyM2EtMDM5Zi00NzFkLWFiOWQtZGNlNjIzOWFmNTUw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:52 GMT]}] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : Request [{ "billingEmail" : "UKVML6AG", "company" : "Breitenberg, Breitenberg and Breitenberg", "createdBy" : "", "createdDate" : "", "description" : "UKVML6AG", "id" : "", "inactive" : false, "location" : "UKVML6AG", "modifiedBy" : "", "modifiedDate" : "", "name" : "UKVML6AG", "orgPlan" : "TEAM", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:41:53.793+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs" }] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MGU4NmQ5NWItMDYzMS00MGExLWFiNDgtZDNlZmVkODRhZjg1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:53 GMT]}] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : StatusCode [403] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : Time [702] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1] : Size [121] 2019-03-20 10:41:53 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MGU4NmQ5NWItMDYzMS00MGExLWFiNDgtZDNlZmVkODRhZjg1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:53 GMT]}] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MGU4NmQ5NWItMDYzMS00MGExLWFiNDgtZDNlZmVkODRhZjg1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:53 GMT]}] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MGU4NmQ5NWItMDYzMS00MGExLWFiNDgtZDNlZmVkODRhZjg1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:53 GMT]}] 2019-03-20 10:41:53 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MGU4NmQ5NWItMDYzMS00MGExLWFiNDgtZDNlZmVkODRhZjg1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:53 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/users/addUserToOrg] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : Request [{ "createdBy" : "", "createdDate" : "", "forceResetPwd" : false, "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "org" : "", "orgRole" : "ADMIN", "status" : "INACTIVE", "userType" : "MANAGED", "users" : "", "version" : "" }] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:41:54.343+0000", "status" : 400, "error" : "Bad Request", "message" : "JSON parse error: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value (''); nested exception is com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('')\n at [Source: (PushbackInputStream); line: 9, column: 11] (through reference chain: com.fxlabs.fxt.dto.users.OrgUsers[\"org\"])", "path" : "/api/v1/users/addUserToOrg" }] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZjY5MGE3MmEtNzA3YS00ZmRlLWI2ZDgtOTEwODcwMDczODVl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : StatusCode [400] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : Time [547] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1] : Size [729] 2019-03-20 10:41:54 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [400 == 200 OR 400 == 201] result [Failed] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZjY5MGE3MmEtNzA3YS00ZmRlLWI2ZDgtOTEwODcwMDczODVl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZjY5MGE3MmEtNzA3YS00ZmRlLWI2ZDgtOTEwODcwMDczODVl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZjY5MGE3MmEtNzA3YS00ZmRlLWI2ZDgtOTEwODcwMDczODVl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgUsersCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZjY5MGE3MmEtNzA3YS00ZmRlLWI2ZDgtOTEwODcwMDczODVl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : Method [POST] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : Request [{ "billingEmail" : "2xZsLm8r", "company" : "Breitenberg Group", "createdBy" : "", "createdDate" : "", "description" : "2xZsLm8r", "id" : "", "inactive" : false, "location" : "2xZsLm8r", "modifiedBy" : "", "modifiedDate" : "", "name" : "2xZsLm8r", "orgPlan" : "TEAM", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:41:54.893+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs" }] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVmM2UxNTEtMzQ1MC00Y2JmLTk1MmItY2NhOGNiOGMzMjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : StatusCode [403] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : Time [480] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1] : Size [121] 2019-03-20 10:41:54 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVmM2UxNTEtMzQ1MC00Y2JmLTk1MmItY2NhOGNiOGMzMjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVmM2UxNTEtMzQ1MC00Y2JmLTk1MmItY2NhOGNiOGMzMjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVmM2UxNTEtMzQ1MC00Y2JmLTk1MmItY2NhOGNiOGMzMjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:54 DEBUG [OrgCreateUserAInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVmM2UxNTEtMzQ1MC00Y2JmLTk1MmItY2NhOGNiOGMzMjBk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:54 GMT]}] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : URL [http://13.56.210.25/api/v1/users/enterprise-sign-up] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : Method [POST] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : Request [{ "accountNonExpired" : false, "accountNonLocked" : false, "company" : "Cronin-Cronin", "createdBy" : "", "createdDate" : "", "credentialsNonExpired" : false, "email" : "odell.douglas@hotmail.com", "enabled" : false, "id" : "", "inactive" : false, "jobTitle" : "District Education Facilitator", "location" : "xPEvt9RI", "modifiedBy" : "", "modifiedDate" : "", "name" : "xPEvt9RI", "password" : "xPEvt9RI", "username" : "jesse.stroman", "version" : "" }] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:41:55.887+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/users/enterprise-sign-up" }] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=N2YwZThhZWMtY2FlNC00YjdiLWE0ZjktOGYxZWExZTdlMmMy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:55 GMT]}] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : StatusCode [403] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : Time [660] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1] : Size [141] 2019-03-20 10:41:55 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=N2YwZThhZWMtY2FlNC00YjdiLWE0ZjktOGYxZWExZTdlMmMy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:55 GMT]}] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=N2YwZThhZWMtY2FlNC00YjdiLWE0ZjktOGYxZWExZTdlMmMy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:55 GMT]}] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=N2YwZThhZWMtY2FlNC00YjdiLWE0ZjktOGYxZWExZTdlMmMy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:55 GMT]}] 2019-03-20 10:41:55 DEBUG [UsersCreateUserAInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=N2YwZThhZWMtY2FlNC00YjdiLWE0ZjktOGYxZWExZTdlMmMy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:55 GMT]}] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : URL [http://13.56.210.25/api/v1/users/org-add] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Method [POST] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Request [{ "createdBy" : "", "createdDate" : "", "forceResetPwd" : false, "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "org" : "", "orgRole" : "WRITE", "status" : "ACTIVE", "userType" : "DEFAULT", "users" : "", "version" : "" }] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Response [{ "timestamp" : "2019-03-20T10:41:56.510+0000", "status" : 400, "error" : "Bad Request", "message" : "JSON parse error: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value (''); nested exception is com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('')\n at [Source: (PushbackInputStream); line: 9, column: 11] (through reference chain: com.fxlabs.fxt.dto.users.OrgUsers[\"org\"])", "path" : "/api/v1/users/org-add" }] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=Mzc5NTVlM2MtYjE3ZC00OTM5LWI5NDgtOTU4YTk4MGJhZGFk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:56 GMT]}] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : StatusCode [400] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Time [622] 2019-03-20 10:41:56 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Size [724] 2019-03-20 10:41:56 ERROR [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [400 == 401 OR 400 == 403] result [Failed] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : URL [http://13.56.210.25/api/v1/orgs/] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Method [DELETE] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request [null] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response [{ "timestamp" : "2019-03-20T10:41:57.088+0000", "status" : 405, "error" : "Method Not Allowed", "message" : "Request method 'DELETE' not supported", "path" : "/api/v1/orgs/" }] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response-Headers [{Allow=[GET, POST], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=Njc2NzdiODYtMGU5MS00OWQ0LWIxMDMtYThkODBiZWY5Yzhk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:41:56 GMT]}] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : StatusCode [405] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Time [577] 2019-03-20 10:41:57 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Size [159] 2019-03-20 10:41:57 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [405 == 200] result [Failed]

--- FX Bot ---

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1

Run Id : 8a808011699a990101699ab3901a2277

Job : Default

Env : Default

Category : Hijack_Level1

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 400

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDVjMTk4MjMtOTA0ZC00YjY1LThmZTAtOWEyZTRjMzE1ZDg1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:56 GMT]}

Endpoint : http://13.56.210.25/api/v1/users/org-add

Request :
{ "createdBy" : "", "createdDate" : "", "forceResetPwd" : false, "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "org" : "", "orgRole" : "WRITE", "status" : "ACTIVE", "userType" : "DEFAULT", "users" : "", "version" : "" }

Response :
{ "timestamp" : "2019-03-20T10:44:57.382+0000", "status" : 400, "error" : "Bad Request", "message" : "JSON parse error: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value (''); nested exception is com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('')\n at [Source: (PushbackInputStream); line: 9, column: 11] (through reference chain: com.fxlabs.fxt.dto.users.OrgUsers[\"org\"])", "path" : "/api/v1/users/org-add" }

Logs :
2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/users/enterprise-sign-up] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : Request [{ "accountNonExpired" : false, "accountNonLocked" : false, "company" : "Kris-Kris", "createdBy" : "", "createdDate" : "", "credentialsNonExpired" : false, "email" : "olin.bartell@hotmail.com", "enabled" : false, "id" : "", "inactive" : false, "jobTitle" : "Product Planner", "location" : "WU3Y5wmy", "modifiedBy" : "", "modifiedDate" : "", "name" : "WU3Y5wmy", "password" : "WU3Y5wmy", "username" : "barry.gutmann", "version" : "" }] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:44:51.030+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/users/enterprise-sign-up" }] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjkyYWQ1YmQtZTA4Zi00NDdiLWE3M2UtMjUxYTM5MzhkN2I0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:50 GMT]}] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : StatusCode [403] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : Time [1056] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1] : Size [141] 2019-03-20 10:44:51 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjkyYWQ1YmQtZTA4Zi00NDdiLWE3M2UtMjUxYTM5MzhkN2I0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:50 GMT]}] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjkyYWQ1YmQtZTA4Zi00NDdiLWE3M2UtMjUxYTM5MzhkN2I0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:50 GMT]}] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjkyYWQ1YmQtZTA4Zi00NDdiLWE3M2UtMjUxYTM5MzhkN2I0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:50 GMT]}] 2019-03-20 10:44:51 DEBUG [UsersCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YjkyYWQ1YmQtZTA4Zi00NDdiLWE3M2UtMjUxYTM5MzhkN2I0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:50 GMT]}] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : Request [{ "billingEmail" : "eIIjE76M", "company" : "Emmerich and Sons", "createdBy" : "", "createdDate" : "", "description" : "eIIjE76M", "id" : "", "inactive" : false, "location" : "eIIjE76M", "modifiedBy" : "", "modifiedDate" : "", "name" : "eIIjE76M", "orgPlan" : "TEAM", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:44:52.112+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs" }] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWM2ZmZiNTItYTFkMC00NDYzLWI4NjUtOTAwOTdkOWYxZWFh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:51 GMT]}] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : StatusCode [403] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : Time [1024] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1] : Size [121] 2019-03-20 10:44:52 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWM2ZmZiNTItYTFkMC00NDYzLWI4NjUtOTAwOTdkOWYxZWFh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:51 GMT]}] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWM2ZmZiNTItYTFkMC00NDYzLWI4NjUtOTAwOTdkOWYxZWFh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:51 GMT]}] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWM2ZmZiNTItYTFkMC00NDYzLWI4NjUtOTAwOTdkOWYxZWFh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:51 GMT]}] 2019-03-20 10:44:52 DEBUG [OrgCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWM2ZmZiNTItYTFkMC00NDYzLWI4NjUtOTAwOTdkOWYxZWFh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:51 GMT]}] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : URL [http://13.56.210.25/api/v1/users/addUserToOrg] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : Method [POST] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : Request [{ "createdBy" : "", "createdDate" : "", "forceResetPwd" : false, "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "org" : "", "orgRole" : "ADMIN", "status" : "INACTIVE", "userType" : "MANAGED", "users" : "", "version" : "" }] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:44:53.150+0000", "status" : 400, "error" : "Bad Request", "message" : "JSON parse error: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value (''); nested exception is com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('')\n at [Source: (PushbackInputStream); line: 9, column: 11] (through reference chain: com.fxlabs.fxt.dto.users.OrgUsers[\"org\"])", "path" : "/api/v1/users/addUserToOrg" }] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVkNzdmYzAtOTU3NS00MTYwLThjMzAtNmE2YmE4Y2M4NzMw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:52 GMT]}] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : StatusCode [400] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : Time [1046] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1] : Size [729] 2019-03-20 10:44:53 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [400 == 200 OR 400 == 201] result [Failed] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVkNzdmYzAtOTU3NS00MTYwLThjMzAtNmE2YmE4Y2M4NzMw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:52 GMT]}] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVkNzdmYzAtOTU3NS00MTYwLThjMzAtNmE2YmE4Y2M4NzMw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:52 GMT]}] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVkNzdmYzAtOTU3NS00MTYwLThjMzAtNmE2YmE4Y2M4NzMw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:52 GMT]}] 2019-03-20 10:44:53 DEBUG [OrgUsersCreateUserBInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTVkNzdmYzAtOTU3NS00MTYwLThjMzAtNmE2YmE4Y2M4NzMw; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:52 GMT]}] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : Method [POST] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : Request [{ "billingEmail" : "CE7pC56e", "company" : "Cummerata-Cummerata", "createdBy" : "", "createdDate" : "", "description" : "CE7pC56e", "id" : "", "inactive" : false, "location" : "CE7pC56e", "modifiedBy" : "", "modifiedDate" : "", "name" : "CE7pC56e", "orgPlan" : "TEAM", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:44:54.302+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/orgs" }] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZWVmNTA1MTMtMmYwNS00MzUwLWE1NWItYjJkZTZkMzJlMmVh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:53 GMT]}] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : StatusCode [403] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : Time [1095] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1] : Size [121] 2019-03-20 10:44:54 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZWVmNTA1MTMtMmYwNS00MzUwLWE1NWItYjJkZTZkMzJlMmVh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:53 GMT]}] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZWVmNTA1MTMtMmYwNS00MzUwLWE1NWItYjJkZTZkMzJlMmVh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:53 GMT]}] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZWVmNTA1MTMtMmYwNS00MzUwLWE1NWItYjJkZTZkMzJlMmVh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:53 GMT]}] 2019-03-20 10:44:54 DEBUG [OrgCreateUserAInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZWVmNTA1MTMtMmYwNS00MzUwLWE1NWItYjJkZTZkMzJlMmVh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:53 GMT]}] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : URL [http://13.56.210.25/api/v1/users/enterprise-sign-up] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : Method [POST] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : Request [{ "accountNonExpired" : false, "accountNonLocked" : false, "company" : "Tremblay, Tremblay and Tremblay", "createdBy" : "", "createdDate" : "", "credentialsNonExpired" : false, "email" : "ken.rosenbaum@gmail.com", "enabled" : false, "id" : "", "inactive" : false, "jobTitle" : "Healthcare Supervisor", "location" : "7p3DxicG", "modifiedBy" : "", "modifiedDate" : "", "name" : "7p3DxicG", "password" : "7p3DxicG", "username" : "otilia.watsica", "version" : "" }] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : Response [{ "timestamp" : "2019-03-20T10:44:55.743+0000", "status" : 403, "error" : "Forbidden", "message" : "Forbidden", "path" : "/api/v1/users/enterprise-sign-up" }] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWViY2M1N2UtN2MxOC00YWYzLWJkM2ItMjcyNTZjOTRlMDJh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:55 GMT]}] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : StatusCode [403] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : Time [1200] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1] : Size [141] 2019-03-20 10:44:55 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [403 == 200 OR 403 == 201] result [Failed] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWViY2M1N2UtN2MxOC00YWYzLWJkM2ItMjcyNTZjOTRlMDJh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:55 GMT]}] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWViY2M1N2UtN2MxOC00YWYzLWJkM2ItMjcyNTZjOTRlMDJh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:55 GMT]}] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWViY2M1N2UtN2MxOC00YWYzLWJkM2ItMjcyNTZjOTRlMDJh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:55 GMT]}] 2019-03-20 10:44:55 DEBUG [UsersCreateUserAInitHijack1_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NWViY2M1N2UtN2MxOC00YWYzLWJkM2ItMjcyNTZjOTRlMDJh; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:55 GMT]}] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : URL [http://13.56.210.25/api/v1/users/org-add] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Method [POST] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Request [{ "createdBy" : "", "createdDate" : "", "forceResetPwd" : false, "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "org" : "", "orgRole" : "WRITE", "status" : "ACTIVE", "userType" : "DEFAULT", "users" : "", "version" : "" }] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Response [{ "timestamp" : "2019-03-20T10:44:57.382+0000", "status" : 400, "error" : "Bad Request", "message" : "JSON parse error: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value (''); nested exception is com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot construct instance of com.fxlabs.fxt.dto.base.NameDto (although at least one Creator exists): no String-argument constructor/factory method to deserialize from String value ('')\n at [Source: (PushbackInputStream); line: 9, column: 11] (through reference chain: com.fxlabs.fxt.dto.users.OrgUsers[\"org\"])", "path" : "/api/v1/users/org-add" }] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDVjMTk4MjMtOTA0ZC00YjY1LThmZTAtOWEyZTRjMzE1ZDg1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:56 GMT]}] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : StatusCode [400] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Time [1638] 2019-03-20 10:44:57 DEBUG [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Size [724] 2019-03-20 10:44:57 ERROR [ApiV1UsersOrgAddPostOrgusersuserbDisallowHijack1] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [400 == 401 OR 400 == 403] result [Failed] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : URL [http://13.56.210.25/api/v1/orgs/] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Method [DELETE] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request [null] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response [{ "timestamp" : "2019-03-20T10:44:58.524+0000", "status" : 405, "error" : "Method Not Allowed", "message" : "Request method 'DELETE' not supported", "path" : "/api/v1/orgs/" }] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Response-Headers [{Allow=[GET, POST], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=YzRjYjg0MzYtMzVlNS00MDE2LWE0MzUtZTFmZGRlNDc3YzQy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 20 Mar 2019 10:44:57 GMT]}] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : StatusCode [405] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Time [1140] 2019-03-20 10:44:58 DEBUG [ApiV1OrgsIdDeleteOrghijack1] : Size [159] 2019-03-20 10:44:58 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [405 == 200] result [Failed]

--- FX Bot ---