Open workfast108 opened 7 years ago
dzonerzy
commented
7 years ago To me this seems something wrong inside sended data, please can you use port 80 instead of 443 and capture a packet with a request stream? I need to analyze if the request is valid or something goes wrong
Best, Daniele
workfast108
commented
7 years ago Dear Daniele,
Thank You for your Prompt response, and sorry that i reply late. Regarding the Issue i talk about, I was able to solve it by using port 80, and removing --ssl" , but the problem now is that there is not really sign of progress on fuzzing ,, after 3 hours of Fuzzing the process stay is one place. the screenshot on the "How to Use" Page of the code shows that there should be a progress, but in this case there is none.
I have attached the screenshot for information regarding to what am trying to explain. "No Progress in scanning"
Warm Regards
dzonerzy
commented
7 years ago Hi,
Thank you for the answer! from the screenshot i notice that during the statistics calculation HTTP code 302 is shown to me this seems like a infinite redirect, are you sure that the site serve its content over HTTP without redirecting to HTTPS? Please let me know!
Regards, Daniele
workfast108
commented
7 years ago Hi Daniele,
Actually the web application, serve all it content via or over HTTPS, that is 443" but if you remember in my former screenshot the ssl issue" and numerous errors output when i use the 443 or --ssl command as recommended by you., so when you now suggest that i should use port "80" that is why i switch to this last method you are seeing above,by using port 80, and as you can see it..., in the latest screenshot, it looks like the request with stay just like that forever. i suggest you can look into this by checking the fuzzier tool against , any websites that uses "HTTPS or SSL ", because most websites this days are in this category.
Best Regards Dere Sewa.
dzonerzy
commented
7 years ago Hi Dere,
As you suggested i tried with some HTTPS sites and they worked fine, so this may be a issue related to your python version or the specific site you're are testing, did you try to use the server ip instead of the domain name while fuzzing?
Regards, Daniele
workfast108
commented
7 years ago Hi Daniele, It is ok, i will try with the server ip today instead of the domain name as you just said, but concerning the Python version i don't think that should be an issue, am actually using Kali Linux , Probably the latest version, and the python version is 2.7 i supposed, many other tools that recommend version 2.6 or 2.7 are working, so i don't see that as an issue with your fuzzing tool, i will try with server IP and with both port 443 and --ssl and also with port 80 , and see the outcome , i will revert back to you as soon as possible. Once again Thnx for your time. and thnx for your contribution to the security community.
Best Regards Dere Sewa.
workfast108
commented
7 years ago Hi Daniele, Please can you tell me which "python version" you are using? i mean when you run your test? i have used server ip" to run the fuzzing tool , it categorically says "ssl certificate Error" so i think maybe probably the issue has to do with the python version, but all other tools that i actually install in my Kali linux from github actually recommend version 2.7, and that is the version i have in my Kali linux. Kindly lemme know which version of python you are using.
Warm Regards Dere Sewa.
dzonerzy
commented
7 years ago Hi Dere,
I'm using Python 2.7.11, your ssl certificate error may be an issue related to the server certificate since i disabled the certificate checking inside the code, maybe it's self signed? Did you try with site using valid certificate (green lock)? Let me know.
[UPDATE] I noticed that from python version 2.9 httplib enabled certificate checking, i added a check to force disable this feature, please update your PyJFAPI version and try again.
Regards, Daniele
workfast108
commented
7 years ago Hi Daniele,
First and Foremost , thank you for your time that you have been spending resolving this issues.. regarding the Fuzzer, I finally got it working on another websites, although i still don't know what is the matter with the former website that i have been working on for long, it still fail to get fuzzed , i use your new update tool, it worked for a new website that i try to fuzz. and the both website have valid certificate , with "green lock", i have Proxy both of them through or via , Burp suite Pro, it confirm that both websites have valid certificate. Now My new question is, How do i know if i have encounter an issue..,i mean security flaw? or how do i confirm there is a vulnerability ? any particular Http code will show up.., to confirm this, or any error statement on the Fuzzing console or terminal to confirm this? If there is anyway to include IDOR(Insecure direct Object reference) testing, and rate limiting too,. in your next update version, But for now Kindly let me know what to look for to confirm there is an issue in the web application that i am testing when using the Fuzzer.
Warm Regards Dere Sewa
workfast108
commented
7 years ago Hi Daniele
Just in addition to the request i made earlier , how do you see it if you can make the windows version of your fuzzer tool? since python also run on windows, maybe it can be more stable. actually the linux version is working in Kali linux, just that sometimes Error shows up, but it do reconnect afterwards,.also as i ask in my former request. I will like to know how to confirm that the Fuzzer encounter a vulnerability ,? so that i can maker a proof of concept my finding. or the POC issue the issue discovered by too fuzzer. am waiting for your response. warm regards. Dere Sewa
Hello Daniele,
Thank you for your prompt response the last time, regarding the issue that i reported, I have some other issues while running you API Fuzzer tool, Actually I got my input into your FUzzer tools via Burp suite.., the JSON Parameters I placed into request.txt file look good, but i don't know where the error is coming from each time i run the Fuzzer,, I also want to ask if all the headers and and cookies needed to be placed into the request.txt file.,? Although i try with the instruction you gave below the code
, and i tried , also by including all the headers and cookies , i got the same Error response, i don't know if am doing anything wrong, I have attached the screen of the request file and the error from the Fuzzer.,
another question is request.txt file should be placed inside PyJFAPI folder or inside PyJFuzz, ? although i try to put it in both .,the tool return the same error. I also tried with different request i got the same here.
Kindly look into it and see where the issue is coming from.
Warm Regards Dere Sewa.