wapiti-scanner / wapiti

Web vulnerability scanner written in Python3
https://github.com/wapiti-scanner/wapiti
GNU General Public License v2.0
1.15k stars 176 forks source link

Attack JSON body of HTTP requests #585

Closed devl00p closed 4 months ago

devl00p commented 5 months ago

Can now find vulnerabilities by injecting payloads in JSON data:

---
SQL Injection in https://juice-shop.herokuapp.com/rest/user/login via injection in the parameter email
Evil request:
    POST /rest/user/login HTTP/1.1
    host: juice-shop.herokuapp.com
    connection: keep-alive
    user-agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0
    accept-language: en-US
    accept-encoding: gzip, deflate, br
    accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    content-type: application/json
    referer: https://juice-shop.herokuapp.com/
    content-length: 76
    Content-Type: application/json

    {"email": "test@test.com' AND 23=23 AND '59'='59", "password": "Password1!"}
---

Display and serialization of requests with application/json content-type was already supported (persister use a special key name called __RAW__) so no additional work was made for that.

As the path to the vulnerable JSON entry can be long, the dot notation is used:

json

codecov[bot] commented 5 months ago

Codecov Report

Attention: Patch coverage is 75.20000% with 31 lines in your changes are missing coverage. Please review.

:exclamation: No coverage uploaded for pull request base (master@dec4f26). Click here to learn what that means.

Files Patch % Lines
wapitiCore/attack/attack.py 81.94% 13 Missing :warning:
wapitiCore/attack/mod_log4shell.py 38.46% 8 Missing :warning:
wapitiCore/net/intercepting_explorer.py 20.00% 8 Missing :warning:
wapitiCore/attack/mod_csrf.py 50.00% 2 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #585 +/- ## ========================================= Coverage ? 79.79% ========================================= Files ? 118 Lines ? 9984 Branches ? 0 ========================================= Hits ? 7967 Misses ? 2017 Partials ? 0 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.