search

wapiti-scanner / wapiti

Web vulnerability scanner written in Python3
https://github.com/wapiti-scanner/wapiti
GNU General Public License v2.0
1.15k stars 176 forks source link

Swagger parsing issue - KeyError #586

Closed devl00p closed 4 months ago

devl00p commented 5 months ago

When testing on a known vulnerable web app:

$ wapiti -u https://pentest-ground.com:9000/ --swagger https://pentest-ground.com:9000/openapi.yaml -v2 -m all --flush-session 

     __      __               .__  __  .__________
    /  \    /  \_____  ______ |__|/  |_|__\_____  \
    \   \/\/   /\__  \ \____ \|  \   __\  | _(__  <
     \        /  / __ \|  |_> >  ||  | |  |/       \
      \__/\  /  (____  /   __/|__||__| |__/______  /
           \/        \/|__|                      \/
Wapiti 3.1.8 (wapiti-scanner.github.io)
Traceback (most recent call last):
  File "/home/devloop/travaux/wapiti-code/wapiti3/bin/wapiti", line 8, in <module>
    sys.exit(wapiti_asyncio_wrapper())
             ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/devloop/travaux/wapiti-code/wapiti3/lib64/python3.11/site-packages/wapitiCore/main/wapiti.py", line 489, in wapiti_asyncio_wrapper
    asyncio.run(wapiti_main())
  File "/usr/lib64/python3.11/asyncio/runners.py", line 190, in run
    return runner.run(main)
           ^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/asyncio/base_events.py", line 654, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/home/devloop/travaux/wapiti-code/wapiti3/lib64/python3.11/site-packages/wapitiCore/main/wapiti.py", line 196, in wapiti_main
    for request in swagger.get_requests():
                   ^^^^^^^^^^^^^^^^^^^^^^
  File "/home/devloop/travaux/wapiti-code/wapiti3/lib64/python3.11/site-packages/wapitiCore/parsers/swagger.py", line 376, in get_requests
    return self._create_request(self.routes)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/devloop/travaux/wapiti-code/wapiti3/lib64/python3.11/site-packages/wapitiCore/parsers/swagger.py", line 339, in _create_request
    header[param['name']] = self.AUTOFILL_VALUES[param['type']]
                                                 ~~~~~^^^^^^^^
KeyError: 'type'