Closed zahedmohammed closed 5 years ago
Project : bizpay
Job : Default
Env : Default
Category : ABAC_Level1
Tags : [FX Top 10 - API Vulnerability]
Severity : Major
Region : FXLabs/US_WEST_1
Result : fail
Status Code : 301
Headers : {Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/refund/?amount=]}
Endpoint : http://api.bizpay.co.uk/v1.25/charges/refund/?amount=
Request : { "id" : "", "gateway" : "worldpay", "label" : "yeftyWIX", "default" : false, "show" : false }
Response :
Logs : 2019-01-21 06:16:26 DEBUG [null] : URL [http://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl] 2019-01-21 06:16:26 DEBUG [null] : Method [POST] 2019-01-21 06:16:26 DEBUG [null] : Request [{ "id" : "", "gateway" : "worldpay", "label" : "olA9cHEH", "default" : false, "show" : false }] 2019-01-21 06:16:26 DEBUG [null] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckFAYml6cGF5LmNvLnVrOnVzZXJB]}] 2019-01-21 06:16:26 DEBUG [null] : Response [
] 2019-01-21 06:16:26 DEBUG [null] : Response-Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [null] : StatusCode [301] 2019-01-21 06:16:26 DEBUG [null] : Time [519] 2019-01-21 06:16:26 DEBUG [null] : Size [178] 2019-01-21 06:16:26 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [301 == 200 OR 301 == 201] result [Failed] 2019-01-21 06:16:26 DEBUG [PostChargeMethodCreateUserAInitAbac_Headers] : Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [PostChargeMethodCreateUserAInitAbac_Headers] : Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [PostChargeMethodCreateUserAInitAbac_Headers[2]] : Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [PostChargeMethodCreateUserAInitAbac_Headers[2]] : Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : URL [http://api.bizpay.co.uk/v1.25/charges/refund/?amount=] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Method [PUT] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Request [{ "id" : "", "gateway" : "worldpay", "label" : "yeftyWIX", "default" : false, "show" : false }] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckJAYml6cGF5LmNvLnVrOnVzZXJC]}] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Response [
] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Response-Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/refund/?amount=]}] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : StatusCode [301] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Time [555] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Size [178] 2019-01-21 06:16:26 ERROR [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Assertion [@StatusCode == 401 OR @StatusCode == 403 OR @Response.errors == true] resolved-to [301 == 401 OR 301 == 403 OR == true] result [Failed] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : URL [http://api.bizpay.co.uk/v1.25/charges/methods/] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Method [DELETE] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Request [null] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckFAYml6cGF5LmNvLnVrOnVzZXJB]}] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Response [
] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Response-Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:29 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/]}] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : StatusCode [301] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Time [625] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Size [178] 2019-01-21 06:16:27 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [301 == 200] result [Failed]
--- FX Bot ---
Project : bizpay
Job : Default
Env : Default
Category : ABAC_Level1
Tags : [FX Top 10 - API Vulnerability]
Severity : Major
Region : FXLabs/US_WEST_1
Result : fail
Status Code : 301
Headers : {Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/refund/?amount=]}
Endpoint : http://api.bizpay.co.uk/v1.25/charges/refund/?amount=
Request :
{ "id" : "", "gateway" : "worldpay", "label" : "yeftyWIX", "default" : false, "show" : false }
Response :
301 Moved Permanently
Logs :
2019-01-21 06:16:26 DEBUG [null] : URL [http://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl] 2019-01-21 06:16:26 DEBUG [null] : Method [POST] 2019-01-21 06:16:26 DEBUG [null] : Request [{ "id" : "", "gateway" : "worldpay", "label" : "olA9cHEH", "default" : false, "show" : false }] 2019-01-21 06:16:26 DEBUG [null] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckFAYml6cGF5LmNvLnVrOnVzZXJB]}] 2019-01-21 06:16:26 DEBUG [null] : Response [
301 Moved Permanently
] 2019-01-21 06:16:26 DEBUG [null] : Response-Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [null] : StatusCode [301] 2019-01-21 06:16:26 DEBUG [null] : Time [519] 2019-01-21 06:16:26 DEBUG [null] : Size [178] 2019-01-21 06:16:26 ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [301 == 200 OR 301 == 201] result [Failed] 2019-01-21 06:16:26 DEBUG [PostChargeMethodCreateUserAInitAbac_Headers] : Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [PostChargeMethodCreateUserAInitAbac_Headers] : Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [PostChargeMethodCreateUserAInitAbac_Headers[2]] : Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [PostChargeMethodCreateUserAInitAbac_Headers[2]] : Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/?customer_id=cfQRBjjl]}] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : URL [http://api.bizpay.co.uk/v1.25/charges/refund/?amount=] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Method [PUT] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Request [{ "id" : "", "gateway" : "worldpay", "label" : "yeftyWIX", "default" : false, "show" : false }] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckJAYml6cGF5LmNvLnVrOnVzZXJC]}] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Response [
301 Moved Permanently
] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Response-Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:28 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/refund/?amount=]}] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : StatusCode [301] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Time [555] 2019-01-21 06:16:26 DEBUG [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Size [178] 2019-01-21 06:16:26 ERROR [ChargesRefundIdAmountAmountPutUserbDisallowAbac] : Assertion [@StatusCode == 401 OR @StatusCode == 403 OR @Response.errors == true] resolved-to [301 == 401 OR 301 == 403 OR == true] result [Failed] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : URL [http://api.bizpay.co.uk/v1.25/charges/methods/] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Method [DELETE] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Request [null] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckFAYml6cGF5LmNvLnVrOnVzZXJB]}] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Response [
301 Moved Permanently
] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Response-Headers [{Server=[nginx], Date=[Mon, 21 Jan 2019 06:16:29 GMT], Content-Type=[text/html], Content-Length=[178], Connection=[keep-alive], Location=[https://api.bizpay.co.uk/v1.25/charges/methods/]}] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : StatusCode [301] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Time [625] 2019-01-21 06:16:27 DEBUG [ChargesMethodsIdDeleteAbstractAbac] : Size [178] 2019-01-21 06:16:27 ERROR [null] : Assertion [@StatusCode == 200] resolved-to [301 == 200] result [Failed]
--- FX Bot ---