search

rishdang / skipfish

Automatically exported from code.google.com/p/skipfish
Apache License 2.0
0 stars 0 forks source link

False positives for PUT request #40

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
I'm using version 1.25 beta. The server I'm testing is treating a PUT
request as a GET request and hence SkipFisk reports this a PUT issue. Is
there some way Skipfish can be improved to avoid false positives for PUT
(by testing if the PUT actually put a file there)?

Original issue reported on code.google.com by hansfn@gmail.com on 25 Mar 2010 at 10:46

GoogleCodeExporter commented 8 years ago 
Actually, skipfish only complains about PUT if the request is treated 
*differently* 
from GET: the response must be HTTP 2xx *and* the returned page must be 
different 
than for GET.

The reason it does the check this way is because it may not always be possible 
to 
reliably verify the outcome of PUT; for example, the server may be only 
configured to 
return certain types of files.

Please let me know if you're observing something else, or if you see an obvious 
case 
where this check fails for some other reason?

Original comment by lcam...@gmail.com on 25 Mar 2010 at 11:32

GoogleCodeExporter commented 8 years ago 
Ping?

Original comment by lcam...@gmail.com on 28 Mar 2010 at 5:41

GoogleCodeExporter commented 8 years ago 
Sorry about the late feedback. I now understand why skipfish see a different 
result
when using PUT and GET. The URL in question is a PHP search script that is 
fetching
the search term from $_GET or $_POST. A PUT request doesn't populate $_GET or 
$_POST,
and hence the returned page is different. It's a false positive, but not 
something
skipfish easily can fix, I guess. You can close the bug.

Thx for your time and effort.

Original comment by hansfn@gmail.com on 30 Mar 2010 at 7:52

GoogleCodeExporter commented 8 years ago 
Yeah, sounds like something that is relatively unlikely to occur elsewhere - 
well, if 
it is a common script, we could try to account for it specifically? Is this 
something 
developed in house, or available publicly and used by others?

Original comment by lcam...@gmail.com on 30 Mar 2010 at 8:29

GoogleCodeExporter commented 8 years ago 
The search script is part of PivotX. You should be able to see "PUT request 
accepted"
problem by running 

./skipfish -o pivotx.net -I /search/ http://pivotx.net/search/

Maybe be mod_rewrite is causing the problem?

http://pivotx.net/search/whatever is equal to 
http://pivotx.net/index.php?q=whatever

Original comment by hansfn@gmail.com on 30 Mar 2010 at 10:30

GoogleCodeExporter commented 8 years ago 
Here too: http://skipfish.vps.leoschabel.de/dfglfa/

It's Joomla.

Original comment by leoscha...@gmail.com on 3 Apr 2010 at 6:01