Clicking on Submit button for a Post API, Popup displayed Status code token value, refer screenshot attached.

flipkart-incubator / Astra

Automated Security Testing For REST API's

Apache License 2.0

2.49k stars 396 forks source link

Clicking on Submit button for a Post API, Popup displayed Status code token value, refer screenshot attached. #81

Open ArjunReddyD opened 5 years ago

ArjunReddyD commented 5 years ago

Terminal Logs

/usr/local/lib/python2.7/site-packages/pymongo/topology.py:149: UserWarning: MongoClient opened before fork. Create MongoClient only after forking. See PyMongo's documentation for details: http://api.mongodb.org/python/current/faq.html#is-pymongo-fork-safe
  "MongoClient opened before fork. Create MongoClient only "
[+]http://pre-prod.hbfxlabs.com/core/api/v1/hbfx-insta-authentication/user/login is vulnerable to cross domain attack  
[+]http://pre-prod.hbfxlabs.com/core/api/v1/hbfx-insta-authentication/user/login is vulnerable to broken Authentication and session management

astra terminal

astra 2018-12-06 16-30-04

sagarpo commented 5 years ago

@ArjunReddyD That means scan has been started successfully

ArjunReddyD commented 5 years ago

You mean the Status popup?

ArjunReddyD commented 5 years ago

Yesterday I tested Medical_App_Login API, and it's still in "In Progress" Status. Nothing in Terminal as well. same logs as yesterday. Refer above images of Terminal.

astra in progress

sagarpo commented 5 years ago

@ArjunReddyD Can you share the log file(/logs/scan.log).

ArjunReddyD commented 5 years ago

scan.log file is empty.

sagarpo commented 5 years ago

@ArjunReddyD Since you are using Docker, log file will be found at /app/logs/scan.log. Please share that file with us.

ArjunReddyD commented 5 years ago

I managed to get Container logs. am not sure how to navigate to this path /app/logs/scan.log. Any source link to view a docker scan.log file will be helpful.

https://gist.github.com/ArjunReddyD/270337ee2499105c2eed8e9e5a957682#file-gistfile1-txt

ArjunReddyD commented 5 years ago

@sagarpo any updates on this issue?

sagarpo commented 5 years ago

@ArjunReddyD you can get a shell and access the file. You can read this for more information: https://ma.ttias.be/get-shell-running-docker-container/

sagarpo commented 5 years ago

@ArjunReddyD Are you able to extract the log?