dradis-acunetix 3.6.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +11 -0
- data/.rspec +2 -0
- data/CHANGELOG.md +3 -0
- data/CONTRIBUTING.md +3 -0
- data/Gemfile +23 -0
- data/LICENSE +339 -0
- data/README.md +27 -0
- data/Rakefile +2 -0
- data/dradis-acunetix.gemspec +35 -0
- data/lib/acunetix/report_item.rb +165 -0
- data/lib/acunetix/scan.rb +93 -0
- data/lib/dradis-acunetix.rb +9 -0
- data/lib/dradis/plugins/acunetix.rb +12 -0
- data/lib/dradis/plugins/acunetix/engine.rb +9 -0
- data/lib/dradis/plugins/acunetix/field_processor.rb +25 -0
- data/lib/dradis/plugins/acunetix/gem_version.rb +19 -0
- data/lib/dradis/plugins/acunetix/importer.rb +62 -0
- data/lib/dradis/plugins/acunetix/version.rb +13 -0
- data/lib/tasks/thorfile.rb +25 -0
- data/spec/dradis-acunetix_spec.rb +109 -0
- data/spec/fixtures/files/code-pre.acunetix.xml +1732 -0
- data/spec/fixtures/files/commas-format.acunetix.xml +105 -0
- data/spec/fixtures/files/simple.acunetix.xml +1691 -0
- data/spec/fixtures/files/testphp.vulnweb.com.export.acunetix.xml +23976 -0
- data/spec/models/acunetix/scan_spec.rb +74 -0
- data/spec/spec_helper.rb +10 -0
- data/templates/evidence.fields +7 -0
- data/templates/evidence.sample +12 -0
- data/templates/evidence.template +16 -0
- data/templates/report_item.fields +18 -0
- data/templates/report_item.sample +151 -0
- data/templates/report_item.template +59 -0
- data/templates/scan.fields +12 -0
- data/templates/scan.sample +15 -0
- data/templates/scan.template +16 -0
- metadata +171 -0
|
@@ -0,0 +1,1732 @@
|
|
|
1
|
+
<?xml version="1.0"?>
|
|
2
|
+
<ScanGroup ExportedOn="23/10/2014, 11:44">
|
|
3
|
+
<Scan>
|
|
4
|
+
<Name><![CDATA[Scan Thread 1 ( http://testphp.vulnweb.com:80/ )]]></Name>
|
|
5
|
+
<ShortName><![CDATA[Scan Thread 1]]></ShortName>
|
|
6
|
+
<StartURL><![CDATA[http://testphp.vulnweb.com:80/]]></StartURL>
|
|
7
|
+
<StartTime><![CDATA[7/10/2014, 11:56:03]]></StartTime>
|
|
8
|
+
<FinishTime><![CDATA[7/10/2014, 15:20:55]]></FinishTime>
|
|
9
|
+
<ScanTime><![CDATA[3 hours, 24 minutes]]></ScanTime>
|
|
10
|
+
<Aborted><![CDATA[False]]></Aborted>
|
|
11
|
+
<Responsive><![CDATA[True]]></Responsive>
|
|
12
|
+
<Banner><![CDATA[nginx/1.4.1]]></Banner>
|
|
13
|
+
<Os><![CDATA[Unknown]]></Os>
|
|
14
|
+
<WebServer><![CDATA[nginx]]></WebServer>
|
|
15
|
+
<Technologies><![CDATA[PHP]]></Technologies>
|
|
16
|
+
<Crawler StartUrl="http://testphp.vulnweb.com/">
|
|
17
|
+
<LoginSequence>
|
|
18
|
+
</LoginSequence>
|
|
19
|
+
<Cookies>
|
|
20
|
+
<Variable Name="login" Type="Cookie">
|
|
21
|
+
</Variable>
|
|
22
|
+
<Variable Name="mycookie" Type="Cookie">
|
|
23
|
+
</Variable>
|
|
24
|
+
</Cookies>
|
|
25
|
+
<SiteFiles>
|
|
26
|
+
<SiteFile id="1">
|
|
27
|
+
<Name/>
|
|
28
|
+
<URL>/</URL>
|
|
29
|
+
<FullURL>http://testphp.vulnweb.com/</FullURL>
|
|
30
|
+
<Inputs>
|
|
31
|
+
<Variable Name="Host" Type="HTTP Header">
|
|
32
|
+
</Variable>
|
|
33
|
+
</Inputs>
|
|
34
|
+
<Variations>
|
|
35
|
+
<Variation>
|
|
36
|
+
<URL>http://testphp.vulnweb.com/</URL>
|
|
37
|
+
<PostData><![CDATA[]]></PostData>
|
|
38
|
+
</Variation>
|
|
39
|
+
</Variations>
|
|
40
|
+
</SiteFile>
|
|
41
|
+
<SiteFile id="2">
|
|
42
|
+
<Name>search.php</Name>
|
|
43
|
+
<URL>/search.php</URL>
|
|
44
|
+
<FullURL>http://testphp.vulnweb.com/search.php</FullURL>
|
|
45
|
+
<Inputs>
|
|
46
|
+
<Variable Name="test" Type="URL encoded GET">
|
|
47
|
+
</Variable>
|
|
48
|
+
<Variable Name="goButton" Type="URL encoded POST">
|
|
49
|
+
</Variable>
|
|
50
|
+
<Variable Name="goButton" Type="URL encoded POST">
|
|
51
|
+
</Variable>
|
|
52
|
+
<Variable Name="test" Type="URL encoded GET">
|
|
53
|
+
</Variable>
|
|
54
|
+
<Variable Name="searchFor" Type="URL encoded POST">
|
|
55
|
+
</Variable>
|
|
56
|
+
</Inputs>
|
|
57
|
+
<Variations>
|
|
58
|
+
<Variation>
|
|
59
|
+
<URL>http://testphp.vulnweb.com/search.php?test=query</URL>
|
|
60
|
+
<PostData><![CDATA[goButton=go&searchFor=]]></PostData>
|
|
61
|
+
</Variation>
|
|
62
|
+
<Variation>
|
|
63
|
+
<URL>http://testphp.vulnweb.com/search.php?test=query</URL>
|
|
64
|
+
<PostData><![CDATA[goButton=go&searchFor=the]]></PostData>
|
|
65
|
+
</Variation>
|
|
66
|
+
</Variations>
|
|
67
|
+
</SiteFile>
|
|
68
|
+
<SiteFile id="3">
|
|
69
|
+
<Name>hpp</Name>
|
|
70
|
+
<URL>/hpp/</URL>
|
|
71
|
+
<FullURL>http://testphp.vulnweb.com/hpp/</FullURL>
|
|
72
|
+
<Inputs>
|
|
73
|
+
<Variable Name="pp" Type="URL encoded GET">
|
|
74
|
+
</Variable>
|
|
75
|
+
</Inputs>
|
|
76
|
+
<Variations>
|
|
77
|
+
<Variation>
|
|
78
|
+
<URL>http://testphp.vulnweb.com/hpp/?pp=12</URL>
|
|
79
|
+
<PostData><![CDATA[]]></PostData>
|
|
80
|
+
</Variation>
|
|
81
|
+
</Variations>
|
|
82
|
+
</SiteFile>
|
|
83
|
+
<SiteFile id="4">
|
|
84
|
+
<Name>params.php</Name>
|
|
85
|
+
<URL>/hpp/params.php</URL>
|
|
86
|
+
<FullURL>http://testphp.vulnweb.com/hpp/params.php</FullURL>
|
|
87
|
+
<Inputs>
|
|
88
|
+
<Variable Name="p" Type="URL encoded GET">
|
|
89
|
+
</Variable>
|
|
90
|
+
<Variable Name="p" Type="URL encoded GET">
|
|
91
|
+
</Variable>
|
|
92
|
+
<Variable Name="aaaa/" Type="URL encoded GET">
|
|
93
|
+
</Variable>
|
|
94
|
+
<Variable Name="aaaa/" Type="URL encoded GET">
|
|
95
|
+
</Variable>
|
|
96
|
+
<Variable Name="aaaa/" Type="URL encoded GET">
|
|
97
|
+
</Variable>
|
|
98
|
+
<Variable Name="aaaa/" Type="URL encoded GET">
|
|
99
|
+
</Variable>
|
|
100
|
+
</Inputs>
|
|
101
|
+
<Variations>
|
|
102
|
+
<Variation>
|
|
103
|
+
<URL>http://testphp.vulnweb.com/hpp/params.php?aaaa/=1</URL>
|
|
104
|
+
<PostData><![CDATA[]]></PostData>
|
|
105
|
+
</Variation>
|
|
106
|
+
<Variation>
|
|
107
|
+
<URL>http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12</URL>
|
|
108
|
+
<PostData><![CDATA[]]></PostData>
|
|
109
|
+
</Variation>
|
|
110
|
+
</Variations>
|
|
111
|
+
</SiteFile>
|
|
112
|
+
<SiteFile id="5">
|
|
113
|
+
<Name>index.php</Name>
|
|
114
|
+
<URL>/hpp/index.php</URL>
|
|
115
|
+
<FullURL>http://testphp.vulnweb.com/hpp/index.php</FullURL>
|
|
116
|
+
<Inputs>
|
|
117
|
+
<Variable Name="pp" Type="URL encoded GET">
|
|
118
|
+
</Variable>
|
|
119
|
+
</Inputs>
|
|
120
|
+
<Variations>
|
|
121
|
+
<Variation>
|
|
122
|
+
<URL>http://testphp.vulnweb.com/hpp/index.php?pp=12</URL>
|
|
123
|
+
<PostData><![CDATA[]]></PostData>
|
|
124
|
+
</Variation>
|
|
125
|
+
</Variations>
|
|
126
|
+
</SiteFile>
|
|
127
|
+
<SiteFile id="6">
|
|
128
|
+
<Name>test.php</Name>
|
|
129
|
+
<URL>/hpp/test.php</URL>
|
|
130
|
+
<FullURL>http://testphp.vulnweb.com/hpp/test.php</FullURL>
|
|
131
|
+
<Inputs>
|
|
132
|
+
</Inputs>
|
|
133
|
+
<Variations>
|
|
134
|
+
</Variations>
|
|
135
|
+
</SiteFile>
|
|
136
|
+
<SiteFile id="7">
|
|
137
|
+
<Name>cart.php</Name>
|
|
138
|
+
<URL>/cart.php</URL>
|
|
139
|
+
<FullURL>http://testphp.vulnweb.com/cart.php</FullURL>
|
|
140
|
+
<Inputs>
|
|
141
|
+
<Variable Name="addcart" Type="URL encoded POST">
|
|
142
|
+
</Variable>
|
|
143
|
+
<Variable Name="addcart" Type="URL encoded POST">
|
|
144
|
+
</Variable>
|
|
145
|
+
</Inputs>
|
|
146
|
+
<Variations>
|
|
147
|
+
<Variation>
|
|
148
|
+
<URL>http://testphp.vulnweb.com/cart.php</URL>
|
|
149
|
+
<PostData><![CDATA[addcart=3&price=986]]></PostData>
|
|
150
|
+
</Variation>
|
|
151
|
+
<Variation>
|
|
152
|
+
<URL>http://testphp.vulnweb.com/cart.php</URL>
|
|
153
|
+
<PostData><![CDATA[addcart=2&price=800]]></PostData>
|
|
154
|
+
</Variation>
|
|
155
|
+
<Variation>
|
|
156
|
+
<URL>http://testphp.vulnweb.com/cart.php</URL>
|
|
157
|
+
<PostData><![CDATA[addcart=4&price=1000]]></PostData>
|
|
158
|
+
</Variation>
|
|
159
|
+
</Variations>
|
|
160
|
+
</SiteFile>
|
|
161
|
+
<SiteFile id="8">
|
|
162
|
+
<Name>index.php</Name>
|
|
163
|
+
<URL>/index.php</URL>
|
|
164
|
+
<FullURL>http://testphp.vulnweb.com/index.php</FullURL>
|
|
165
|
+
<Inputs>
|
|
166
|
+
</Inputs>
|
|
167
|
+
<Variations>
|
|
168
|
+
</Variations>
|
|
169
|
+
</SiteFile>
|
|
170
|
+
<SiteFile id="9">
|
|
171
|
+
<Name>login.php</Name>
|
|
172
|
+
<URL>/login.php</URL>
|
|
173
|
+
<FullURL>http://testphp.vulnweb.com/login.php</FullURL>
|
|
174
|
+
<Inputs>
|
|
175
|
+
</Inputs>
|
|
176
|
+
<Variations>
|
|
177
|
+
</Variations>
|
|
178
|
+
</SiteFile>
|
|
179
|
+
<SiteFile id="10">
|
|
180
|
+
<Name>style.css</Name>
|
|
181
|
+
<URL>/style.css</URL>
|
|
182
|
+
<FullURL>http://testphp.vulnweb.com/style.css</FullURL>
|
|
183
|
+
<Inputs>
|
|
184
|
+
</Inputs>
|
|
185
|
+
<Variations>
|
|
186
|
+
</Variations>
|
|
187
|
+
</SiteFile>
|
|
188
|
+
<SiteFile id="11">
|
|
189
|
+
<Name>artists.php</Name>
|
|
190
|
+
<URL>/artists.php</URL>
|
|
191
|
+
<FullURL>http://testphp.vulnweb.com/artists.php</FullURL>
|
|
192
|
+
<Inputs>
|
|
193
|
+
<Variable Name="artist" Type="URL encoded GET">
|
|
194
|
+
</Variable>
|
|
195
|
+
</Inputs>
|
|
196
|
+
<Variations>
|
|
197
|
+
<Variation>
|
|
198
|
+
<URL>http://testphp.vulnweb.com/artists.php?artist=1</URL>
|
|
199
|
+
<PostData><![CDATA[]]></PostData>
|
|
200
|
+
</Variation>
|
|
201
|
+
<Variation>
|
|
202
|
+
<URL>http://testphp.vulnweb.com/artists.php?artist=2</URL>
|
|
203
|
+
<PostData><![CDATA[]]></PostData>
|
|
204
|
+
</Variation>
|
|
205
|
+
<Variation>
|
|
206
|
+
<URL>http://testphp.vulnweb.com/artists.php?artist=3</URL>
|
|
207
|
+
<PostData><![CDATA[]]></PostData>
|
|
208
|
+
</Variation>
|
|
209
|
+
</Variations>
|
|
210
|
+
</SiteFile>
|
|
211
|
+
<SiteFile id="12">
|
|
212
|
+
<Name>privacy.php</Name>
|
|
213
|
+
<URL>/privacy.php</URL>
|
|
214
|
+
<FullURL>http://testphp.vulnweb.com/privacy.php</FullURL>
|
|
215
|
+
<Inputs>
|
|
216
|
+
</Inputs>
|
|
217
|
+
<Variations>
|
|
218
|
+
</Variations>
|
|
219
|
+
</SiteFile>
|
|
220
|
+
<SiteFile id="13">
|
|
221
|
+
<Name>userinfo.php</Name>
|
|
222
|
+
<URL>/userinfo.php</URL>
|
|
223
|
+
<FullURL>http://testphp.vulnweb.com/userinfo.php</FullURL>
|
|
224
|
+
<Inputs>
|
|
225
|
+
<Variable Name="pass" Type="URL encoded POST">
|
|
226
|
+
</Variable>
|
|
227
|
+
<Variable Name="pass" Type="URL encoded POST">
|
|
228
|
+
</Variable>
|
|
229
|
+
<Variable Name="uname" Type="URL encoded POST">
|
|
230
|
+
</Variable>
|
|
231
|
+
</Inputs>
|
|
232
|
+
<Variations>
|
|
233
|
+
<Variation>
|
|
234
|
+
<URL>http://testphp.vulnweb.com/userinfo.php</URL>
|
|
235
|
+
<PostData><![CDATA[pass=g00dPa%24%24w0rD&uname=xgwkrkop]]></PostData>
|
|
236
|
+
</Variation>
|
|
237
|
+
</Variations>
|
|
238
|
+
</SiteFile>
|
|
239
|
+
<SiteFile id="14">
|
|
240
|
+
<Name>guestbook.php</Name>
|
|
241
|
+
<URL>/guestbook.php</URL>
|
|
242
|
+
<FullURL>http://testphp.vulnweb.com/guestbook.php</FullURL>
|
|
243
|
+
<Inputs>
|
|
244
|
+
<Variable Name="name" Type="URL encoded POST">
|
|
245
|
+
</Variable>
|
|
246
|
+
<Variable Name="name" Type="URL encoded POST">
|
|
247
|
+
</Variable>
|
|
248
|
+
<Variable Name="name" Type="URL encoded POST">
|
|
249
|
+
</Variable>
|
|
250
|
+
<Variable Name="name" Type="URL encoded POST">
|
|
251
|
+
</Variable>
|
|
252
|
+
<Variable Name="name" Type="URL encoded POST">
|
|
253
|
+
</Variable>
|
|
254
|
+
</Inputs>
|
|
255
|
+
<Variations>
|
|
256
|
+
<Variation>
|
|
257
|
+
<URL>http://testphp.vulnweb.com/guestbook.php</URL>
|
|
258
|
+
<PostData><![CDATA[name=anonymous%20user&submit=add%20message&text=1]]></PostData>
|
|
259
|
+
</Variation>
|
|
260
|
+
</Variations>
|
|
261
|
+
</SiteFile>
|
|
262
|
+
<SiteFile id="15">
|
|
263
|
+
<Name>categories.php</Name>
|
|
264
|
+
<URL>/categories.php</URL>
|
|
265
|
+
<FullURL>http://testphp.vulnweb.com/categories.php</FullURL>
|
|
266
|
+
<Inputs>
|
|
267
|
+
</Inputs>
|
|
268
|
+
<Variations>
|
|
269
|
+
</Variations>
|
|
270
|
+
</SiteFile>
|
|
271
|
+
<SiteFile id="16">
|
|
272
|
+
<Name>Flash</Name>
|
|
273
|
+
<URL>/Flash/</URL>
|
|
274
|
+
<FullURL>http://testphp.vulnweb.com/Flash/</FullURL>
|
|
275
|
+
<Inputs>
|
|
276
|
+
</Inputs>
|
|
277
|
+
<Variations>
|
|
278
|
+
</Variations>
|
|
279
|
+
</SiteFile>
|
|
280
|
+
<SiteFile id="17">
|
|
281
|
+
<Name>add.swf</Name>
|
|
282
|
+
<URL>/Flash/add.swf</URL>
|
|
283
|
+
<FullURL>http://testphp.vulnweb.com/Flash/add.swf</FullURL>
|
|
284
|
+
<Inputs>
|
|
285
|
+
</Inputs>
|
|
286
|
+
<Variations>
|
|
287
|
+
</Variations>
|
|
288
|
+
</SiteFile>
|
|
289
|
+
<SiteFile id="18">
|
|
290
|
+
<Name>add.fla</Name>
|
|
291
|
+
<URL>/Flash/add.fla</URL>
|
|
292
|
+
<FullURL>http://testphp.vulnweb.com/Flash/add.fla</FullURL>
|
|
293
|
+
<Inputs>
|
|
294
|
+
</Inputs>
|
|
295
|
+
<Variations>
|
|
296
|
+
</Variations>
|
|
297
|
+
</SiteFile>
|
|
298
|
+
<SiteFile id="19">
|
|
299
|
+
<Name>AJAX</Name>
|
|
300
|
+
<URL>/AJAX/</URL>
|
|
301
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/</FullURL>
|
|
302
|
+
<Inputs>
|
|
303
|
+
</Inputs>
|
|
304
|
+
<Variations>
|
|
305
|
+
</Variations>
|
|
306
|
+
</SiteFile>
|
|
307
|
+
<SiteFile id="20">
|
|
308
|
+
<Name>index.php</Name>
|
|
309
|
+
<URL>/AJAX/index.php</URL>
|
|
310
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/index.php</FullURL>
|
|
311
|
+
<Inputs>
|
|
312
|
+
</Inputs>
|
|
313
|
+
<Variations>
|
|
314
|
+
</Variations>
|
|
315
|
+
</SiteFile>
|
|
316
|
+
<SiteFile id="21">
|
|
317
|
+
<Name>infotitle.php</Name>
|
|
318
|
+
<URL>/AJAX/infotitle.php</URL>
|
|
319
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/infotitle.php</FullURL>
|
|
320
|
+
<Inputs>
|
|
321
|
+
<Variable Name="id" Type="URL encoded POST">
|
|
322
|
+
</Variable>
|
|
323
|
+
</Inputs>
|
|
324
|
+
<Variations>
|
|
325
|
+
<Variation>
|
|
326
|
+
<URL>http://testphp.vulnweb.com/AJAX/infotitle.php</URL>
|
|
327
|
+
<PostData><![CDATA[id=1]]></PostData>
|
|
328
|
+
</Variation>
|
|
329
|
+
<Variation>
|
|
330
|
+
<URL>http://testphp.vulnweb.com/AJAX/infotitle.php</URL>
|
|
331
|
+
<PostData><![CDATA[id=2]]></PostData>
|
|
332
|
+
</Variation>
|
|
333
|
+
<Variation>
|
|
334
|
+
<URL>http://testphp.vulnweb.com/AJAX/infotitle.php</URL>
|
|
335
|
+
<PostData><![CDATA[id=3]]></PostData>
|
|
336
|
+
</Variation>
|
|
337
|
+
</Variations>
|
|
338
|
+
</SiteFile>
|
|
339
|
+
<SiteFile id="22">
|
|
340
|
+
<Name>artists.php</Name>
|
|
341
|
+
<URL>/AJAX/artists.php</URL>
|
|
342
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/artists.php</FullURL>
|
|
343
|
+
<Inputs>
|
|
344
|
+
</Inputs>
|
|
345
|
+
<Variations>
|
|
346
|
+
</Variations>
|
|
347
|
+
</SiteFile>
|
|
348
|
+
<SiteFile id="23">
|
|
349
|
+
<Name>infoartist.php</Name>
|
|
350
|
+
<URL>/AJAX/infoartist.php</URL>
|
|
351
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/infoartist.php</FullURL>
|
|
352
|
+
<Inputs>
|
|
353
|
+
<Variable Name="id" Type="URL encoded GET">
|
|
354
|
+
</Variable>
|
|
355
|
+
</Inputs>
|
|
356
|
+
<Variations>
|
|
357
|
+
<Variation>
|
|
358
|
+
<URL>http://testphp.vulnweb.com/AJAX/infoartist.php?id=1</URL>
|
|
359
|
+
<PostData><![CDATA[]]></PostData>
|
|
360
|
+
</Variation>
|
|
361
|
+
<Variation>
|
|
362
|
+
<URL>http://testphp.vulnweb.com/AJAX/infoartist.php?id=2</URL>
|
|
363
|
+
<PostData><![CDATA[]]></PostData>
|
|
364
|
+
</Variation>
|
|
365
|
+
<Variation>
|
|
366
|
+
<URL>http://testphp.vulnweb.com/AJAX/infoartist.php?id=3</URL>
|
|
367
|
+
<PostData><![CDATA[]]></PostData>
|
|
368
|
+
</Variation>
|
|
369
|
+
</Variations>
|
|
370
|
+
</SiteFile>
|
|
371
|
+
<SiteFile id="24">
|
|
372
|
+
<Name>titles.php</Name>
|
|
373
|
+
<URL>/AJAX/titles.php</URL>
|
|
374
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/titles.php</FullURL>
|
|
375
|
+
<Inputs>
|
|
376
|
+
</Inputs>
|
|
377
|
+
<Variations>
|
|
378
|
+
</Variations>
|
|
379
|
+
</SiteFile>
|
|
380
|
+
<SiteFile id="25">
|
|
381
|
+
<Name>showxml.php</Name>
|
|
382
|
+
<URL>/AJAX/showxml.php</URL>
|
|
383
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/showxml.php</FullURL>
|
|
384
|
+
<Inputs>
|
|
385
|
+
<Variable Name="text/xml" Type="Custom POST">
|
|
386
|
+
</Variable>
|
|
387
|
+
<Variable Name="xml.node:name" Type="XML">
|
|
388
|
+
</Variable>
|
|
389
|
+
<Variable Name="xml.node:name" Type="XML">
|
|
390
|
+
</Variable>
|
|
391
|
+
<Variable Name="xml.node:name" Type="XML">
|
|
392
|
+
</Variable>
|
|
393
|
+
<Variable Name="xml.node:name" Type="XML">
|
|
394
|
+
</Variable>
|
|
395
|
+
</Inputs>
|
|
396
|
+
<Variations>
|
|
397
|
+
<Variation>
|
|
398
|
+
<URL>http://testphp.vulnweb.com/AJAX/showxml.php</URL>
|
|
399
|
+
<PostData><![CDATA[<xml><node name="nodename1">nodetext1</node><node name="nodename2">nodetext2</node></xml>]]></PostData>
|
|
400
|
+
</Variation>
|
|
401
|
+
</Variations>
|
|
402
|
+
</SiteFile>
|
|
403
|
+
<SiteFile id="26">
|
|
404
|
+
<Name>styles.css</Name>
|
|
405
|
+
<URL>/AJAX/styles.css</URL>
|
|
406
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/styles.css</FullURL>
|
|
407
|
+
<Inputs>
|
|
408
|
+
</Inputs>
|
|
409
|
+
<Variations>
|
|
410
|
+
</Variations>
|
|
411
|
+
</SiteFile>
|
|
412
|
+
<SiteFile id="27">
|
|
413
|
+
<Name>infocateg.php</Name>
|
|
414
|
+
<URL>/AJAX/infocateg.php</URL>
|
|
415
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/infocateg.php</FullURL>
|
|
416
|
+
<Inputs>
|
|
417
|
+
<Variable Name="id" Type="URL encoded GET">
|
|
418
|
+
</Variable>
|
|
419
|
+
</Inputs>
|
|
420
|
+
<Variations>
|
|
421
|
+
<Variation>
|
|
422
|
+
<URL>http://testphp.vulnweb.com/AJAX/infocateg.php?id=1</URL>
|
|
423
|
+
<PostData><![CDATA[]]></PostData>
|
|
424
|
+
</Variation>
|
|
425
|
+
<Variation>
|
|
426
|
+
<URL>http://testphp.vulnweb.com/AJAX/infocateg.php?id=2</URL>
|
|
427
|
+
<PostData><![CDATA[]]></PostData>
|
|
428
|
+
</Variation>
|
|
429
|
+
<Variation>
|
|
430
|
+
<URL>http://testphp.vulnweb.com/AJAX/infocateg.php?id=3</URL>
|
|
431
|
+
<PostData><![CDATA[]]></PostData>
|
|
432
|
+
</Variation>
|
|
433
|
+
</Variations>
|
|
434
|
+
</SiteFile>
|
|
435
|
+
<SiteFile id="28">
|
|
436
|
+
<Name>categories.php</Name>
|
|
437
|
+
<URL>/AJAX/categories.php</URL>
|
|
438
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/categories.php</FullURL>
|
|
439
|
+
<Inputs>
|
|
440
|
+
</Inputs>
|
|
441
|
+
<Variations>
|
|
442
|
+
</Variations>
|
|
443
|
+
</SiteFile>
|
|
444
|
+
<SiteFile id="29">
|
|
445
|
+
<Name>htaccess.conf</Name>
|
|
446
|
+
<URL>/AJAX/htaccess.conf</URL>
|
|
447
|
+
<FullURL>http://testphp.vulnweb.com/AJAX/htaccess.conf</FullURL>
|
|
448
|
+
<Inputs>
|
|
449
|
+
</Inputs>
|
|
450
|
+
<Variations>
|
|
451
|
+
</Variations>
|
|
452
|
+
</SiteFile>
|
|
453
|
+
<SiteFile id="30">
|
|
454
|
+
<Name>disclaimer.php</Name>
|
|
455
|
+
<URL>/disclaimer.php</URL>
|
|
456
|
+
<FullURL>http://testphp.vulnweb.com/disclaimer.php</FullURL>
|
|
457
|
+
<Inputs>
|
|
458
|
+
</Inputs>
|
|
459
|
+
<Variations>
|
|
460
|
+
</Variations>
|
|
461
|
+
</SiteFile>
|
|
462
|
+
<SiteFile id="31">
|
|
463
|
+
<Name>images</Name>
|
|
464
|
+
<URL>/images/</URL>
|
|
465
|
+
<FullURL>http://testphp.vulnweb.com/images/</FullURL>
|
|
466
|
+
<Inputs>
|
|
467
|
+
</Inputs>
|
|
468
|
+
<Variations>
|
|
469
|
+
</Variations>
|
|
470
|
+
</SiteFile>
|
|
471
|
+
<SiteFile id="32">
|
|
472
|
+
<Name>Mod_Rewrite_Shop</Name>
|
|
473
|
+
<URL>/Mod_Rewrite_Shop/</URL>
|
|
474
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/</FullURL>
|
|
475
|
+
<Inputs>
|
|
476
|
+
</Inputs>
|
|
477
|
+
<Variations>
|
|
478
|
+
</Variations>
|
|
479
|
+
</SiteFile>
|
|
480
|
+
<SiteFile id="33">
|
|
481
|
+
<Name>images</Name>
|
|
482
|
+
<URL>/Mod_Rewrite_Shop/images/</URL>
|
|
483
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/</FullURL>
|
|
484
|
+
<Inputs>
|
|
485
|
+
</Inputs>
|
|
486
|
+
<Variations>
|
|
487
|
+
</Variations>
|
|
488
|
+
</SiteFile>
|
|
489
|
+
<SiteFile id="34">
|
|
490
|
+
<Name>index.php</Name>
|
|
491
|
+
<URL>/Mod_Rewrite_Shop/index.php</URL>
|
|
492
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/index.php</FullURL>
|
|
493
|
+
<Inputs>
|
|
494
|
+
</Inputs>
|
|
495
|
+
<Variations>
|
|
496
|
+
</Variations>
|
|
497
|
+
</SiteFile>
|
|
498
|
+
<SiteFile id="35">
|
|
499
|
+
<Name>rate.php</Name>
|
|
500
|
+
<URL>/Mod_Rewrite_Shop/rate.php</URL>
|
|
501
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/rate.php</FullURL>
|
|
502
|
+
<Inputs>
|
|
503
|
+
<Variable Name="id" Type="URL encoded GET">
|
|
504
|
+
</Variable>
|
|
505
|
+
</Inputs>
|
|
506
|
+
<Variations>
|
|
507
|
+
</Variations>
|
|
508
|
+
</SiteFile>
|
|
509
|
+
<SiteFile id="36">
|
|
510
|
+
<Name>details.php</Name>
|
|
511
|
+
<URL>/Mod_Rewrite_Shop/details.php</URL>
|
|
512
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/details.php</FullURL>
|
|
513
|
+
<Inputs>
|
|
514
|
+
<Variable Name="id" Type="URL encoded GET">
|
|
515
|
+
</Variable>
|
|
516
|
+
</Inputs>
|
|
517
|
+
<Variations>
|
|
518
|
+
</Variations>
|
|
519
|
+
</SiteFile>
|
|
520
|
+
<SiteFile id="37">
|
|
521
|
+
<Name>buy.php</Name>
|
|
522
|
+
<URL>/Mod_Rewrite_Shop/buy.php</URL>
|
|
523
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/buy.php</FullURL>
|
|
524
|
+
<Inputs>
|
|
525
|
+
<Variable Name="id" Type="URL encoded GET">
|
|
526
|
+
</Variable>
|
|
527
|
+
</Inputs>
|
|
528
|
+
<Variations>
|
|
529
|
+
</Variations>
|
|
530
|
+
</SiteFile>
|
|
531
|
+
<SiteFile id="38">
|
|
532
|
+
<Name>.htaccess</Name>
|
|
533
|
+
<URL>/Mod_Rewrite_Shop/.htaccess</URL>
|
|
534
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/.htaccess</FullURL>
|
|
535
|
+
<Inputs>
|
|
536
|
+
</Inputs>
|
|
537
|
+
<Variations>
|
|
538
|
+
</Variations>
|
|
539
|
+
</SiteFile>
|
|
540
|
+
<SiteFile id="39">
|
|
541
|
+
<Name>Details</Name>
|
|
542
|
+
<URL>/Mod_Rewrite_Shop/Details</URL>
|
|
543
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details</FullURL>
|
|
544
|
+
<Inputs>
|
|
545
|
+
</Inputs>
|
|
546
|
+
<Variations>
|
|
547
|
+
</Variations>
|
|
548
|
+
</SiteFile>
|
|
549
|
+
<SiteFile id="40">
|
|
550
|
+
<Name>color-printer</Name>
|
|
551
|
+
<URL>/Mod_Rewrite_Shop/Details/color-printer</URL>
|
|
552
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer</FullURL>
|
|
553
|
+
<Inputs>
|
|
554
|
+
</Inputs>
|
|
555
|
+
<Variations>
|
|
556
|
+
</Variations>
|
|
557
|
+
</SiteFile>
|
|
558
|
+
<SiteFile id="41">
|
|
559
|
+
<Name>3</Name>
|
|
560
|
+
<URL>/Mod_Rewrite_Shop/Details/color-printer/3/</URL>
|
|
561
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/</FullURL>
|
|
562
|
+
<Inputs>
|
|
563
|
+
</Inputs>
|
|
564
|
+
<Variations>
|
|
565
|
+
</Variations>
|
|
566
|
+
</SiteFile>
|
|
567
|
+
<SiteFile id="42">
|
|
568
|
+
<Name>web-camera-a4tech</Name>
|
|
569
|
+
<URL>/Mod_Rewrite_Shop/Details/web-camera-a4tech</URL>
|
|
570
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech</FullURL>
|
|
571
|
+
<Inputs>
|
|
572
|
+
</Inputs>
|
|
573
|
+
<Variations>
|
|
574
|
+
</Variations>
|
|
575
|
+
</SiteFile>
|
|
576
|
+
<SiteFile id="43">
|
|
577
|
+
<Name>2</Name>
|
|
578
|
+
<URL>/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/</URL>
|
|
579
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/</FullURL>
|
|
580
|
+
<Inputs>
|
|
581
|
+
</Inputs>
|
|
582
|
+
<Variations>
|
|
583
|
+
</Variations>
|
|
584
|
+
</SiteFile>
|
|
585
|
+
<SiteFile id="44">
|
|
586
|
+
<Name>network-attached-storage-dlink</Name>
|
|
587
|
+
<URL>/Mod_Rewrite_Shop/Details/network-attached-storage-dlink</URL>
|
|
588
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink</FullURL>
|
|
589
|
+
<Inputs>
|
|
590
|
+
</Inputs>
|
|
591
|
+
<Variations>
|
|
592
|
+
</Variations>
|
|
593
|
+
</SiteFile>
|
|
594
|
+
<SiteFile id="45">
|
|
595
|
+
<Name>1</Name>
|
|
596
|
+
<URL>/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/</URL>
|
|
597
|
+
<FullURL>http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/</FullURL>
|
|
598
|
+
<Inputs>
|
|
599
|
+
</Inputs>
|
|
600
|
+
<Variations>
|
|
601
|
+
</Variations>
|
|
602
|
+
</SiteFile>
|
|
603
|
+
<SiteFile id="46">
|
|
604
|
+
<Name>secured</Name>
|
|
605
|
+
<URL>/secured/</URL>
|
|
606
|
+
<FullURL>http://testphp.vulnweb.com/secured/</FullURL>
|
|
607
|
+
<Inputs>
|
|
608
|
+
</Inputs>
|
|
609
|
+
<Variations>
|
|
610
|
+
</Variations>
|
|
611
|
+
</SiteFile>
|
|
612
|
+
<SiteFile id="47">
|
|
613
|
+
<Name>newuser.php</Name>
|
|
614
|
+
<URL>/secured/newuser.php</URL>
|
|
615
|
+
<FullURL>http://testphp.vulnweb.com/secured/newuser.php</FullURL>
|
|
616
|
+
<Inputs>
|
|
617
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
618
|
+
</Variable>
|
|
619
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
620
|
+
</Variable>
|
|
621
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
622
|
+
</Variable>
|
|
623
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
624
|
+
</Variable>
|
|
625
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
626
|
+
</Variable>
|
|
627
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
628
|
+
</Variable>
|
|
629
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
630
|
+
</Variable>
|
|
631
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
632
|
+
</Variable>
|
|
633
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
634
|
+
</Variable>
|
|
635
|
+
<Variable Name="signup" Type="URL encoded POST">
|
|
636
|
+
</Variable>
|
|
637
|
+
</Inputs>
|
|
638
|
+
<Variations>
|
|
639
|
+
<Variation>
|
|
640
|
+
<URL>http://testphp.vulnweb.com/secured/newuser.php</URL>
|
|
641
|
+
<PostData><![CDATA[signup=signup&uaddress=3137%20Laguna%20Street&ucc=4111111111111111&uemail=sample%40email.tst&upass=g00dPa%24%24w0rD&upass2=g00dPa%24%24w0rD&uphone=555-666-0606&urname=murdtvwl&uuname=bsyoxcby]]></PostData>
|
|
642
|
+
</Variation>
|
|
643
|
+
</Variations>
|
|
644
|
+
</SiteFile>
|
|
645
|
+
<SiteFile id="48">
|
|
646
|
+
<Name>index.php</Name>
|
|
647
|
+
<URL>/secured/index.php</URL>
|
|
648
|
+
<FullURL>http://testphp.vulnweb.com/secured/index.php</FullURL>
|
|
649
|
+
<Inputs>
|
|
650
|
+
</Inputs>
|
|
651
|
+
<Variations>
|
|
652
|
+
</Variations>
|
|
653
|
+
</SiteFile>
|
|
654
|
+
<SiteFile id="49">
|
|
655
|
+
<Name>office.htm</Name>
|
|
656
|
+
<URL>/secured/office.htm</URL>
|
|
657
|
+
<FullURL>http://testphp.vulnweb.com/secured/office.htm</FullURL>
|
|
658
|
+
<Inputs>
|
|
659
|
+
</Inputs>
|
|
660
|
+
<Variations>
|
|
661
|
+
</Variations>
|
|
662
|
+
</SiteFile>
|
|
663
|
+
<SiteFile id="50">
|
|
664
|
+
<Name>style.css</Name>
|
|
665
|
+
<URL>/secured/style.css</URL>
|
|
666
|
+
<FullURL>http://testphp.vulnweb.com/secured/style.css</FullURL>
|
|
667
|
+
<Inputs>
|
|
668
|
+
</Inputs>
|
|
669
|
+
<Variations>
|
|
670
|
+
</Variations>
|
|
671
|
+
</SiteFile>
|
|
672
|
+
<SiteFile id="51">
|
|
673
|
+
<Name>phpinfo.php</Name>
|
|
674
|
+
<URL>/secured/phpinfo.php</URL>
|
|
675
|
+
<FullURL>http://testphp.vulnweb.com/secured/phpinfo.php</FullURL>
|
|
676
|
+
<Inputs>
|
|
677
|
+
<Variable Name="" Type="URL encoded GET">
|
|
678
|
+
</Variable>
|
|
679
|
+
</Inputs>
|
|
680
|
+
<Variations>
|
|
681
|
+
<Variation>
|
|
682
|
+
<URL>http://testphp.vulnweb.com/secured/phpinfo.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000</URL>
|
|
683
|
+
<PostData><![CDATA[]]></PostData>
|
|
684
|
+
</Variation>
|
|
685
|
+
<Variation>
|
|
686
|
+
<URL>http://testphp.vulnweb.com/secured/phpinfo.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42</URL>
|
|
687
|
+
<PostData><![CDATA[]]></PostData>
|
|
688
|
+
</Variation>
|
|
689
|
+
<Variation>
|
|
690
|
+
<URL>http://testphp.vulnweb.com/secured/phpinfo.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42</URL>
|
|
691
|
+
<PostData><![CDATA[]]></PostData>
|
|
692
|
+
</Variation>
|
|
693
|
+
</Variations>
|
|
694
|
+
</SiteFile>
|
|
695
|
+
<SiteFile id="52">
|
|
696
|
+
<Name>database_connect.php</Name>
|
|
697
|
+
<URL>/secured/database_connect.php</URL>
|
|
698
|
+
<FullURL>http://testphp.vulnweb.com/secured/database_connect.php</FullURL>
|
|
699
|
+
<Inputs>
|
|
700
|
+
</Inputs>
|
|
701
|
+
<Variations>
|
|
702
|
+
</Variations>
|
|
703
|
+
</SiteFile>
|
|
704
|
+
<SiteFile id="53">
|
|
705
|
+
<Name>office_files</Name>
|
|
706
|
+
<URL>/secured/office_files</URL>
|
|
707
|
+
<FullURL>http://testphp.vulnweb.com/secured/office_files</FullURL>
|
|
708
|
+
<Inputs>
|
|
709
|
+
</Inputs>
|
|
710
|
+
<Variations>
|
|
711
|
+
</Variations>
|
|
712
|
+
</SiteFile>
|
|
713
|
+
<SiteFile id="54">
|
|
714
|
+
<Name>filelist.xml</Name>
|
|
715
|
+
<URL>/secured/office_files/filelist.xml</URL>
|
|
716
|
+
<FullURL>http://testphp.vulnweb.com/secured/office_files/filelist.xml</FullURL>
|
|
717
|
+
<Inputs>
|
|
718
|
+
</Inputs>
|
|
719
|
+
<Variations>
|
|
720
|
+
</Variations>
|
|
721
|
+
</SiteFile>
|
|
722
|
+
<SiteFile id="55">
|
|
723
|
+
<Name>sendcommand.php</Name>
|
|
724
|
+
<URL>/sendcommand.php</URL>
|
|
725
|
+
<FullURL>http://testphp.vulnweb.com/sendcommand.php</FullURL>
|
|
726
|
+
<Inputs>
|
|
727
|
+
<Variable Name="cart_id" Type="URL encoded POST">
|
|
728
|
+
</Variable>
|
|
729
|
+
</Inputs>
|
|
730
|
+
<Variations>
|
|
731
|
+
</Variations>
|
|
732
|
+
</SiteFile>
|
|
733
|
+
<SiteFile id="56">
|
|
734
|
+
<Name>.idea</Name>
|
|
735
|
+
<URL>/.idea/</URL>
|
|
736
|
+
<FullURL>http://testphp.vulnweb.com/.idea/</FullURL>
|
|
737
|
+
<Inputs>
|
|
738
|
+
</Inputs>
|
|
739
|
+
<Variations>
|
|
740
|
+
</Variations>
|
|
741
|
+
</SiteFile>
|
|
742
|
+
<SiteFile id="57">
|
|
743
|
+
<Name>misc.xml</Name>
|
|
744
|
+
<URL>/.idea/misc.xml</URL>
|
|
745
|
+
<FullURL>http://testphp.vulnweb.com/.idea/misc.xml</FullURL>
|
|
746
|
+
<Inputs>
|
|
747
|
+
</Inputs>
|
|
748
|
+
<Variations>
|
|
749
|
+
</Variations>
|
|
750
|
+
</SiteFile>
|
|
751
|
+
<SiteFile id="58">
|
|
752
|
+
<Name>vcs.xml</Name>
|
|
753
|
+
<URL>/.idea/vcs.xml</URL>
|
|
754
|
+
<FullURL>http://testphp.vulnweb.com/.idea/vcs.xml</FullURL>
|
|
755
|
+
<Inputs>
|
|
756
|
+
</Inputs>
|
|
757
|
+
<Variations>
|
|
758
|
+
</Variations>
|
|
759
|
+
</SiteFile>
|
|
760
|
+
<SiteFile id="59">
|
|
761
|
+
<Name>workspace.xml</Name>
|
|
762
|
+
<URL>/.idea/workspace.xml</URL>
|
|
763
|
+
<FullURL>http://testphp.vulnweb.com/.idea/workspace.xml</FullURL>
|
|
764
|
+
<Inputs>
|
|
765
|
+
</Inputs>
|
|
766
|
+
<Variations>
|
|
767
|
+
</Variations>
|
|
768
|
+
</SiteFile>
|
|
769
|
+
<SiteFile id="60">
|
|
770
|
+
<Name>.name</Name>
|
|
771
|
+
<URL>/.idea/.name</URL>
|
|
772
|
+
<FullURL>http://testphp.vulnweb.com/.idea/.name</FullURL>
|
|
773
|
+
<Inputs>
|
|
774
|
+
</Inputs>
|
|
775
|
+
<Variations>
|
|
776
|
+
</Variations>
|
|
777
|
+
</SiteFile>
|
|
778
|
+
<SiteFile id="61">
|
|
779
|
+
<Name>scopes</Name>
|
|
780
|
+
<URL>/.idea/scopes/</URL>
|
|
781
|
+
<FullURL>http://testphp.vulnweb.com/.idea/scopes/</FullURL>
|
|
782
|
+
<Inputs>
|
|
783
|
+
</Inputs>
|
|
784
|
+
<Variations>
|
|
785
|
+
</Variations>
|
|
786
|
+
</SiteFile>
|
|
787
|
+
<SiteFile id="62">
|
|
788
|
+
<Name>scope_settings.xml</Name>
|
|
789
|
+
<URL>/.idea/scopes/scope_settings.xml</URL>
|
|
790
|
+
<FullURL>http://testphp.vulnweb.com/.idea/scopes/scope_settings.xml</FullURL>
|
|
791
|
+
<Inputs>
|
|
792
|
+
</Inputs>
|
|
793
|
+
<Variations>
|
|
794
|
+
</Variations>
|
|
795
|
+
</SiteFile>
|
|
796
|
+
<SiteFile id="63">
|
|
797
|
+
<Name>acuart.iml</Name>
|
|
798
|
+
<URL>/.idea/acuart.iml</URL>
|
|
799
|
+
<FullURL>http://testphp.vulnweb.com/.idea/acuart.iml</FullURL>
|
|
800
|
+
<Inputs>
|
|
801
|
+
</Inputs>
|
|
802
|
+
<Variations>
|
|
803
|
+
</Variations>
|
|
804
|
+
</SiteFile>
|
|
805
|
+
<SiteFile id="64">
|
|
806
|
+
<Name>modules.xml</Name>
|
|
807
|
+
<URL>/.idea/modules.xml</URL>
|
|
808
|
+
<FullURL>http://testphp.vulnweb.com/.idea/modules.xml</FullURL>
|
|
809
|
+
<Inputs>
|
|
810
|
+
</Inputs>
|
|
811
|
+
<Variations>
|
|
812
|
+
</Variations>
|
|
813
|
+
</SiteFile>
|
|
814
|
+
<SiteFile id="65">
|
|
815
|
+
<Name>encodings.xml</Name>
|
|
816
|
+
<URL>/.idea/encodings.xml</URL>
|
|
817
|
+
<FullURL>http://testphp.vulnweb.com/.idea/encodings.xml</FullURL>
|
|
818
|
+
<Inputs>
|
|
819
|
+
</Inputs>
|
|
820
|
+
<Variations>
|
|
821
|
+
</Variations>
|
|
822
|
+
</SiteFile>
|
|
823
|
+
<SiteFile id="66">
|
|
824
|
+
<Name>CVS</Name>
|
|
825
|
+
<URL>/CVS/</URL>
|
|
826
|
+
<FullURL>http://testphp.vulnweb.com/CVS/</FullURL>
|
|
827
|
+
<Inputs>
|
|
828
|
+
</Inputs>
|
|
829
|
+
<Variations>
|
|
830
|
+
</Variations>
|
|
831
|
+
</SiteFile>
|
|
832
|
+
<SiteFile id="67">
|
|
833
|
+
<Name>Entries.Log</Name>
|
|
834
|
+
<URL>/CVS/Entries.Log</URL>
|
|
835
|
+
<FullURL>http://testphp.vulnweb.com/CVS/Entries.Log</FullURL>
|
|
836
|
+
<Inputs>
|
|
837
|
+
</Inputs>
|
|
838
|
+
<Variations>
|
|
839
|
+
</Variations>
|
|
840
|
+
</SiteFile>
|
|
841
|
+
<SiteFile id="68">
|
|
842
|
+
<Name>Repository</Name>
|
|
843
|
+
<URL>/CVS/Repository</URL>
|
|
844
|
+
<FullURL>http://testphp.vulnweb.com/CVS/Repository</FullURL>
|
|
845
|
+
<Inputs>
|
|
846
|
+
</Inputs>
|
|
847
|
+
<Variations>
|
|
848
|
+
</Variations>
|
|
849
|
+
</SiteFile>
|
|
850
|
+
<SiteFile id="69">
|
|
851
|
+
<Name>Root</Name>
|
|
852
|
+
<URL>/CVS/Root</URL>
|
|
853
|
+
<FullURL>http://testphp.vulnweb.com/CVS/Root</FullURL>
|
|
854
|
+
<Inputs>
|
|
855
|
+
</Inputs>
|
|
856
|
+
<Variations>
|
|
857
|
+
</Variations>
|
|
858
|
+
</SiteFile>
|
|
859
|
+
<SiteFile id="70">
|
|
860
|
+
<Name>Entries</Name>
|
|
861
|
+
<URL>/CVS/Entries</URL>
|
|
862
|
+
<FullURL>http://testphp.vulnweb.com/CVS/Entries</FullURL>
|
|
863
|
+
<Inputs>
|
|
864
|
+
</Inputs>
|
|
865
|
+
<Variations>
|
|
866
|
+
</Variations>
|
|
867
|
+
</SiteFile>
|
|
868
|
+
<SiteFile id="71">
|
|
869
|
+
<Name>redir.php</Name>
|
|
870
|
+
<URL>/redir.php</URL>
|
|
871
|
+
<FullURL>http://testphp.vulnweb.com/redir.php</FullURL>
|
|
872
|
+
<Inputs>
|
|
873
|
+
<Variable Name="r" Type="URL encoded GET">
|
|
874
|
+
</Variable>
|
|
875
|
+
</Inputs>
|
|
876
|
+
<Variations>
|
|
877
|
+
<Variation>
|
|
878
|
+
<URL>http://testphp.vulnweb.com/redir.php?r=http://www.eclectasy.com/Fractal-Explorer/index.html</URL>
|
|
879
|
+
<PostData><![CDATA[]]></PostData>
|
|
880
|
+
</Variation>
|
|
881
|
+
</Variations>
|
|
882
|
+
</SiteFile>
|
|
883
|
+
<SiteFile id="72">
|
|
884
|
+
<Name>_mmServerScripts</Name>
|
|
885
|
+
<URL>/_mmServerScripts/</URL>
|
|
886
|
+
<FullURL>http://testphp.vulnweb.com/_mmServerScripts/</FullURL>
|
|
887
|
+
<Inputs>
|
|
888
|
+
</Inputs>
|
|
889
|
+
<Variations>
|
|
890
|
+
</Variations>
|
|
891
|
+
</SiteFile>
|
|
892
|
+
<SiteFile id="73">
|
|
893
|
+
<Name>MMHTTPDB.php</Name>
|
|
894
|
+
<URL>/_mmServerScripts/MMHTTPDB.php</URL>
|
|
895
|
+
<FullURL>http://testphp.vulnweb.com/_mmServerScripts/MMHTTPDB.php</FullURL>
|
|
896
|
+
<Inputs>
|
|
897
|
+
<Variable Name="Type" Type="URL encoded POST">
|
|
898
|
+
</Variable>
|
|
899
|
+
</Inputs>
|
|
900
|
+
<Variations>
|
|
901
|
+
</Variations>
|
|
902
|
+
</SiteFile>
|
|
903
|
+
<SiteFile id="74">
|
|
904
|
+
<Name>mysql.php</Name>
|
|
905
|
+
<URL>/_mmServerScripts/mysql.php</URL>
|
|
906
|
+
<FullURL>http://testphp.vulnweb.com/_mmServerScripts/mysql.php</FullURL>
|
|
907
|
+
<Inputs>
|
|
908
|
+
</Inputs>
|
|
909
|
+
<Variations>
|
|
910
|
+
</Variations>
|
|
911
|
+
</SiteFile>
|
|
912
|
+
<SiteFile id="75">
|
|
913
|
+
<Name>comment.php</Name>
|
|
914
|
+
<URL>/comment.php</URL>
|
|
915
|
+
<FullURL>http://testphp.vulnweb.com/comment.php</FullURL>
|
|
916
|
+
<Inputs>
|
|
917
|
+
<Variable Name="aid" Type="URL encoded GET">
|
|
918
|
+
</Variable>
|
|
919
|
+
<Variable Name="aid" Type="URL encoded GET">
|
|
920
|
+
</Variable>
|
|
921
|
+
<Variable Name="pid" Type="URL encoded POST">
|
|
922
|
+
</Variable>
|
|
923
|
+
<Variable Name="comment" Type="URL encoded POST">
|
|
924
|
+
</Variable>
|
|
925
|
+
<Variable Name="comment" Type="URL encoded POST">
|
|
926
|
+
</Variable>
|
|
927
|
+
<Variable Name="comment" Type="URL encoded POST">
|
|
928
|
+
</Variable>
|
|
929
|
+
<Variable Name="comment" Type="URL encoded POST">
|
|
930
|
+
</Variable>
|
|
931
|
+
<Variable Name="comment" Type="URL encoded POST">
|
|
932
|
+
</Variable>
|
|
933
|
+
<Variable Name="comment" Type="URL encoded POST">
|
|
934
|
+
</Variable>
|
|
935
|
+
<Variable Name="comment" Type="URL encoded POST">
|
|
936
|
+
</Variable>
|
|
937
|
+
<Variable Name="comment" Type="URL encoded POST">
|
|
938
|
+
</Variable>
|
|
939
|
+
<Variable Name="name" Type="URL encoded GET">
|
|
940
|
+
</Variable>
|
|
941
|
+
<Variable Name="name" Type="URL encoded GET">
|
|
942
|
+
</Variable>
|
|
943
|
+
<Variable Name="aid" Type="URL encoded GET">
|
|
944
|
+
</Variable>
|
|
945
|
+
<Variable Name="pid" Type="URL encoded GET">
|
|
946
|
+
</Variable>
|
|
947
|
+
<Variable Name="aid" Type="URL encoded GET">
|
|
948
|
+
</Variable>
|
|
949
|
+
<Variable Name="aid" Type="URL encoded GET">
|
|
950
|
+
</Variable>
|
|
951
|
+
</Inputs>
|
|
952
|
+
<Variations>
|
|
953
|
+
<Variation>
|
|
954
|
+
<URL>http://testphp.vulnweb.com/comment.php</URL>
|
|
955
|
+
<PostData><![CDATA[comment=1&name=<your%20name%20here>&phpaction=echo%20%24_POST%5bcomment%5d;&Submit=Submit]]></PostData>
|
|
956
|
+
</Variation>
|
|
957
|
+
<Variation>
|
|
958
|
+
<URL>http://testphp.vulnweb.com/comment.php?aid=1</URL>
|
|
959
|
+
<PostData><![CDATA[]]></PostData>
|
|
960
|
+
</Variation>
|
|
961
|
+
<Variation>
|
|
962
|
+
<URL>http://testphp.vulnweb.com/comment.php?aid=2</URL>
|
|
963
|
+
<PostData><![CDATA[]]></PostData>
|
|
964
|
+
</Variation>
|
|
965
|
+
<Variation>
|
|
966
|
+
<URL>http://testphp.vulnweb.com/comment.php?aid=3</URL>
|
|
967
|
+
<PostData><![CDATA[]]></PostData>
|
|
968
|
+
</Variation>
|
|
969
|
+
<Variation>
|
|
970
|
+
<URL>http://testphp.vulnweb.com/comment.php?pid=1</URL>
|
|
971
|
+
<PostData><![CDATA[]]></PostData>
|
|
972
|
+
</Variation>
|
|
973
|
+
<Variation>
|
|
974
|
+
<URL>http://testphp.vulnweb.com/comment.php?pid=2</URL>
|
|
975
|
+
<PostData><![CDATA[]]></PostData>
|
|
976
|
+
</Variation>
|
|
977
|
+
<Variation>
|
|
978
|
+
<URL>http://testphp.vulnweb.com/comment.php?pid=3</URL>
|
|
979
|
+
<PostData><![CDATA[]]></PostData>
|
|
980
|
+
</Variation>
|
|
981
|
+
</Variations>
|
|
982
|
+
</SiteFile>
|
|
983
|
+
<SiteFile id="76">
|
|
984
|
+
<Name>wvstests</Name>
|
|
985
|
+
<URL>/wvstests/</URL>
|
|
986
|
+
<FullURL>http://testphp.vulnweb.com/wvstests/</FullURL>
|
|
987
|
+
<Inputs>
|
|
988
|
+
</Inputs>
|
|
989
|
+
<Variations>
|
|
990
|
+
</Variations>
|
|
991
|
+
</SiteFile>
|
|
992
|
+
<SiteFile id="77">
|
|
993
|
+
<Name>pmwiki_2_1_19</Name>
|
|
994
|
+
<URL>/wvstests/pmwiki_2_1_19/</URL>
|
|
995
|
+
<FullURL>http://testphp.vulnweb.com/wvstests/pmwiki_2_1_19/</FullURL>
|
|
996
|
+
<Inputs>
|
|
997
|
+
</Inputs>
|
|
998
|
+
<Variations>
|
|
999
|
+
</Variations>
|
|
1000
|
+
</SiteFile>
|
|
1001
|
+
<SiteFile id="78">
|
|
1002
|
+
<Name>scripts</Name>
|
|
1003
|
+
<URL>/wvstests/pmwiki_2_1_19/scripts/</URL>
|
|
1004
|
+
<FullURL>http://testphp.vulnweb.com/wvstests/pmwiki_2_1_19/scripts/</FullURL>
|
|
1005
|
+
<Inputs>
|
|
1006
|
+
</Inputs>
|
|
1007
|
+
<Variations>
|
|
1008
|
+
</Variations>
|
|
1009
|
+
</SiteFile>
|
|
1010
|
+
<SiteFile id="79">
|
|
1011
|
+
<Name>version.php</Name>
|
|
1012
|
+
<URL>/wvstests/pmwiki_2_1_19/scripts/version.php</URL>
|
|
1013
|
+
<FullURL>http://testphp.vulnweb.com/wvstests/pmwiki_2_1_19/scripts/version.php</FullURL>
|
|
1014
|
+
<Inputs>
|
|
1015
|
+
</Inputs>
|
|
1016
|
+
<Variations>
|
|
1017
|
+
</Variations>
|
|
1018
|
+
</SiteFile>
|
|
1019
|
+
<SiteFile id="80">
|
|
1020
|
+
<Name>pictures</Name>
|
|
1021
|
+
<URL>/pictures/</URL>
|
|
1022
|
+
<FullURL>http://testphp.vulnweb.com/pictures/</FullURL>
|
|
1023
|
+
<Inputs>
|
|
1024
|
+
</Inputs>
|
|
1025
|
+
<Variations>
|
|
1026
|
+
</Variations>
|
|
1027
|
+
</SiteFile>
|
|
1028
|
+
<SiteFile id="81">
|
|
1029
|
+
<Name>6.jpg.tn</Name>
|
|
1030
|
+
<URL>/pictures/6.jpg.tn</URL>
|
|
1031
|
+
<FullURL>http://testphp.vulnweb.com/pictures/6.jpg.tn</FullURL>
|
|
1032
|
+
<Inputs>
|
|
1033
|
+
</Inputs>
|
|
1034
|
+
<Variations>
|
|
1035
|
+
</Variations>
|
|
1036
|
+
</SiteFile>
|
|
1037
|
+
<SiteFile id="82">
|
|
1038
|
+
<Name>3.jpg.tn</Name>
|
|
1039
|
+
<URL>/pictures/3.jpg.tn</URL>
|
|
1040
|
+
<FullURL>http://testphp.vulnweb.com/pictures/3.jpg.tn</FullURL>
|
|
1041
|
+
<Inputs>
|
|
1042
|
+
</Inputs>
|
|
1043
|
+
<Variations>
|
|
1044
|
+
</Variations>
|
|
1045
|
+
</SiteFile>
|
|
1046
|
+
<SiteFile id="83">
|
|
1047
|
+
<Name>WS_FTP.LOG</Name>
|
|
1048
|
+
<URL>/pictures/WS_FTP.LOG</URL>
|
|
1049
|
+
<FullURL>http://testphp.vulnweb.com/pictures/WS_FTP.LOG</FullURL>
|
|
1050
|
+
<Inputs>
|
|
1051
|
+
</Inputs>
|
|
1052
|
+
<Variations>
|
|
1053
|
+
</Variations>
|
|
1054
|
+
</SiteFile>
|
|
1055
|
+
<SiteFile id="84">
|
|
1056
|
+
<Name>wp-config.bak</Name>
|
|
1057
|
+
<URL>/pictures/wp-config.bak</URL>
|
|
1058
|
+
<FullURL>http://testphp.vulnweb.com/pictures/wp-config.bak</FullURL>
|
|
1059
|
+
<Inputs>
|
|
1060
|
+
</Inputs>
|
|
1061
|
+
<Variations>
|
|
1062
|
+
</Variations>
|
|
1063
|
+
</SiteFile>
|
|
1064
|
+
<SiteFile id="85">
|
|
1065
|
+
<Name>ipaddresses.txt</Name>
|
|
1066
|
+
<URL>/pictures/ipaddresses.txt</URL>
|
|
1067
|
+
<FullURL>http://testphp.vulnweb.com/pictures/ipaddresses.txt</FullURL>
|
|
1068
|
+
<Inputs>
|
|
1069
|
+
</Inputs>
|
|
1070
|
+
<Variations>
|
|
1071
|
+
</Variations>
|
|
1072
|
+
</SiteFile>
|
|
1073
|
+
<SiteFile id="86">
|
|
1074
|
+
<Name>path-disclosure-win.html</Name>
|
|
1075
|
+
<URL>/pictures/path-disclosure-win.html</URL>
|
|
1076
|
+
<FullURL>http://testphp.vulnweb.com/pictures/path-disclosure-win.html</FullURL>
|
|
1077
|
+
<Inputs>
|
|
1078
|
+
</Inputs>
|
|
1079
|
+
<Variations>
|
|
1080
|
+
</Variations>
|
|
1081
|
+
</SiteFile>
|
|
1082
|
+
<SiteFile id="87">
|
|
1083
|
+
<Name>2.jpg.tn</Name>
|
|
1084
|
+
<URL>/pictures/2.jpg.tn</URL>
|
|
1085
|
+
<FullURL>http://testphp.vulnweb.com/pictures/2.jpg.tn</FullURL>
|
|
1086
|
+
<Inputs>
|
|
1087
|
+
</Inputs>
|
|
1088
|
+
<Variations>
|
|
1089
|
+
</Variations>
|
|
1090
|
+
</SiteFile>
|
|
1091
|
+
<SiteFile id="88">
|
|
1092
|
+
<Name>5.jpg.tn</Name>
|
|
1093
|
+
<URL>/pictures/5.jpg.tn</URL>
|
|
1094
|
+
<FullURL>http://testphp.vulnweb.com/pictures/5.jpg.tn</FullURL>
|
|
1095
|
+
<Inputs>
|
|
1096
|
+
</Inputs>
|
|
1097
|
+
<Variations>
|
|
1098
|
+
</Variations>
|
|
1099
|
+
</SiteFile>
|
|
1100
|
+
<SiteFile id="89">
|
|
1101
|
+
<Name>credentials.txt</Name>
|
|
1102
|
+
<URL>/pictures/credentials.txt</URL>
|
|
1103
|
+
<FullURL>http://testphp.vulnweb.com/pictures/credentials.txt</FullURL>
|
|
1104
|
+
<Inputs>
|
|
1105
|
+
</Inputs>
|
|
1106
|
+
<Variations>
|
|
1107
|
+
</Variations>
|
|
1108
|
+
</SiteFile>
|
|
1109
|
+
<SiteFile id="90">
|
|
1110
|
+
<Name>4.jpg.tn</Name>
|
|
1111
|
+
<URL>/pictures/4.jpg.tn</URL>
|
|
1112
|
+
<FullURL>http://testphp.vulnweb.com/pictures/4.jpg.tn</FullURL>
|
|
1113
|
+
<Inputs>
|
|
1114
|
+
</Inputs>
|
|
1115
|
+
<Variations>
|
|
1116
|
+
</Variations>
|
|
1117
|
+
</SiteFile>
|
|
1118
|
+
<SiteFile id="91">
|
|
1119
|
+
<Name>7.jpg.tn</Name>
|
|
1120
|
+
<URL>/pictures/7.jpg.tn</URL>
|
|
1121
|
+
<FullURL>http://testphp.vulnweb.com/pictures/7.jpg.tn</FullURL>
|
|
1122
|
+
<Inputs>
|
|
1123
|
+
</Inputs>
|
|
1124
|
+
<Variations>
|
|
1125
|
+
</Variations>
|
|
1126
|
+
</SiteFile>
|
|
1127
|
+
<SiteFile id="92">
|
|
1128
|
+
<Name>path-disclosure-unix.html</Name>
|
|
1129
|
+
<URL>/pictures/path-disclosure-unix.html</URL>
|
|
1130
|
+
<FullURL>http://testphp.vulnweb.com/pictures/path-disclosure-unix.html</FullURL>
|
|
1131
|
+
<Inputs>
|
|
1132
|
+
</Inputs>
|
|
1133
|
+
<Variations>
|
|
1134
|
+
</Variations>
|
|
1135
|
+
</SiteFile>
|
|
1136
|
+
<SiteFile id="93">
|
|
1137
|
+
<Name>1.jpg.tn</Name>
|
|
1138
|
+
<URL>/pictures/1.jpg.tn</URL>
|
|
1139
|
+
<FullURL>http://testphp.vulnweb.com/pictures/1.jpg.tn</FullURL>
|
|
1140
|
+
<Inputs>
|
|
1141
|
+
</Inputs>
|
|
1142
|
+
<Variations>
|
|
1143
|
+
</Variations>
|
|
1144
|
+
</SiteFile>
|
|
1145
|
+
<SiteFile id="94">
|
|
1146
|
+
<Name>8.jpg.tn</Name>
|
|
1147
|
+
<URL>/pictures/8.jpg.tn</URL>
|
|
1148
|
+
<FullURL>http://testphp.vulnweb.com/pictures/8.jpg.tn</FullURL>
|
|
1149
|
+
<Inputs>
|
|
1150
|
+
</Inputs>
|
|
1151
|
+
<Variations>
|
|
1152
|
+
</Variations>
|
|
1153
|
+
</SiteFile>
|
|
1154
|
+
<SiteFile id="95">
|
|
1155
|
+
<Name>logout.php</Name>
|
|
1156
|
+
<URL>/logout.php</URL>
|
|
1157
|
+
<FullURL>http://testphp.vulnweb.com/logout.php</FullURL>
|
|
1158
|
+
<Inputs>
|
|
1159
|
+
</Inputs>
|
|
1160
|
+
<Variations>
|
|
1161
|
+
</Variations>
|
|
1162
|
+
</SiteFile>
|
|
1163
|
+
<SiteFile id="96">
|
|
1164
|
+
<Name>adm1nPan3l</Name>
|
|
1165
|
+
<URL>/adm1nPan3l/</URL>
|
|
1166
|
+
<FullURL>http://testphp.vulnweb.com/adm1nPan3l/</FullURL>
|
|
1167
|
+
<Inputs>
|
|
1168
|
+
</Inputs>
|
|
1169
|
+
<Variations>
|
|
1170
|
+
</Variations>
|
|
1171
|
+
</SiteFile>
|
|
1172
|
+
<SiteFile id="97">
|
|
1173
|
+
<Name>index.php</Name>
|
|
1174
|
+
<URL>/adm1nPan3l/index.php</URL>
|
|
1175
|
+
<FullURL>http://testphp.vulnweb.com/adm1nPan3l/index.php</FullURL>
|
|
1176
|
+
<Inputs>
|
|
1177
|
+
</Inputs>
|
|
1178
|
+
<Variations>
|
|
1179
|
+
</Variations>
|
|
1180
|
+
</SiteFile>
|
|
1181
|
+
<SiteFile id="98">
|
|
1182
|
+
<Name>admin</Name>
|
|
1183
|
+
<URL>/admin/</URL>
|
|
1184
|
+
<FullURL>http://testphp.vulnweb.com/admin/</FullURL>
|
|
1185
|
+
<Inputs>
|
|
1186
|
+
</Inputs>
|
|
1187
|
+
<Variations>
|
|
1188
|
+
</Variations>
|
|
1189
|
+
</SiteFile>
|
|
1190
|
+
<SiteFile id="99">
|
|
1191
|
+
<Name>create.sql</Name>
|
|
1192
|
+
<URL>/admin/create.sql</URL>
|
|
1193
|
+
<FullURL>http://testphp.vulnweb.com/admin/create.sql</FullURL>
|
|
1194
|
+
<Inputs>
|
|
1195
|
+
</Inputs>
|
|
1196
|
+
<Variations>
|
|
1197
|
+
</Variations>
|
|
1198
|
+
</SiteFile>
|
|
1199
|
+
<SiteFile id="100">
|
|
1200
|
+
<Name>404.php</Name>
|
|
1201
|
+
<URL>/404.php</URL>
|
|
1202
|
+
<FullURL>http://testphp.vulnweb.com/404.php</FullURL>
|
|
1203
|
+
<Inputs>
|
|
1204
|
+
</Inputs>
|
|
1205
|
+
<Variations>
|
|
1206
|
+
</Variations>
|
|
1207
|
+
</SiteFile>
|
|
1208
|
+
<SiteFile id="101">
|
|
1209
|
+
<Name>Templates</Name>
|
|
1210
|
+
<URL>/Templates/</URL>
|
|
1211
|
+
<FullURL>http://testphp.vulnweb.com/Templates/</FullURL>
|
|
1212
|
+
<Inputs>
|
|
1213
|
+
</Inputs>
|
|
1214
|
+
<Variations>
|
|
1215
|
+
</Variations>
|
|
1216
|
+
</SiteFile>
|
|
1217
|
+
<SiteFile id="102">
|
|
1218
|
+
<Name>main_dynamic_template.dwt.php</Name>
|
|
1219
|
+
<URL>/Templates/main_dynamic_template.dwt.php</URL>
|
|
1220
|
+
<FullURL>http://testphp.vulnweb.com/Templates/main_dynamic_template.dwt.php</FullURL>
|
|
1221
|
+
<Inputs>
|
|
1222
|
+
</Inputs>
|
|
1223
|
+
<Variations>
|
|
1224
|
+
</Variations>
|
|
1225
|
+
</SiteFile>
|
|
1226
|
+
<SiteFile id="103">
|
|
1227
|
+
<Name>index.bak</Name>
|
|
1228
|
+
<URL>/index.bak</URL>
|
|
1229
|
+
<FullURL>http://testphp.vulnweb.com/index.bak</FullURL>
|
|
1230
|
+
<Inputs>
|
|
1231
|
+
</Inputs>
|
|
1232
|
+
<Variations>
|
|
1233
|
+
</Variations>
|
|
1234
|
+
</SiteFile>
|
|
1235
|
+
<SiteFile id="104">
|
|
1236
|
+
<Name>product.php</Name>
|
|
1237
|
+
<URL>/product.php</URL>
|
|
1238
|
+
<FullURL>http://testphp.vulnweb.com/product.php</FullURL>
|
|
1239
|
+
<Inputs>
|
|
1240
|
+
<Variable Name="pic" Type="URL encoded GET">
|
|
1241
|
+
</Variable>
|
|
1242
|
+
</Inputs>
|
|
1243
|
+
<Variations>
|
|
1244
|
+
<Variation>
|
|
1245
|
+
<URL>http://testphp.vulnweb.com/product.php?pic=2</URL>
|
|
1246
|
+
<PostData><![CDATA[]]></PostData>
|
|
1247
|
+
</Variation>
|
|
1248
|
+
<Variation>
|
|
1249
|
+
<URL>http://testphp.vulnweb.com/product.php?pic=3</URL>
|
|
1250
|
+
<PostData><![CDATA[]]></PostData>
|
|
1251
|
+
</Variation>
|
|
1252
|
+
<Variation>
|
|
1253
|
+
<URL>http://testphp.vulnweb.com/product.php?pic=4</URL>
|
|
1254
|
+
<PostData><![CDATA[]]></PostData>
|
|
1255
|
+
</Variation>
|
|
1256
|
+
</Variations>
|
|
1257
|
+
</SiteFile>
|
|
1258
|
+
<SiteFile id="105">
|
|
1259
|
+
<Name>listproducts.php</Name>
|
|
1260
|
+
<URL>/listproducts.php</URL>
|
|
1261
|
+
<FullURL>http://testphp.vulnweb.com/listproducts.php</FullURL>
|
|
1262
|
+
<Inputs>
|
|
1263
|
+
<Variable Name="cat" Type="URL encoded GET">
|
|
1264
|
+
</Variable>
|
|
1265
|
+
<Variable Name="artist" Type="URL encoded GET">
|
|
1266
|
+
</Variable>
|
|
1267
|
+
<Variable Name="artist" Type="URL encoded GET">
|
|
1268
|
+
</Variable>
|
|
1269
|
+
<Variable Name="artist" Type="URL encoded GET">
|
|
1270
|
+
</Variable>
|
|
1271
|
+
</Inputs>
|
|
1272
|
+
<Variations>
|
|
1273
|
+
<Variation>
|
|
1274
|
+
<URL>http://testphp.vulnweb.com/listproducts.php?cat=1</URL>
|
|
1275
|
+
<PostData><![CDATA[]]></PostData>
|
|
1276
|
+
</Variation>
|
|
1277
|
+
<Variation>
|
|
1278
|
+
<URL>http://testphp.vulnweb.com/listproducts.php?cat=2</URL>
|
|
1279
|
+
<PostData><![CDATA[]]></PostData>
|
|
1280
|
+
</Variation>
|
|
1281
|
+
<Variation>
|
|
1282
|
+
<URL>http://testphp.vulnweb.com/listproducts.php?cat=4</URL>
|
|
1283
|
+
<PostData><![CDATA[]]></PostData>
|
|
1284
|
+
</Variation>
|
|
1285
|
+
<Variation>
|
|
1286
|
+
<URL>http://testphp.vulnweb.com/listproducts.php?artist=2</URL>
|
|
1287
|
+
<PostData><![CDATA[]]></PostData>
|
|
1288
|
+
</Variation>
|
|
1289
|
+
<Variation>
|
|
1290
|
+
<URL>http://testphp.vulnweb.com/listproducts.php?artist=1</URL>
|
|
1291
|
+
<PostData><![CDATA[]]></PostData>
|
|
1292
|
+
</Variation>
|
|
1293
|
+
<Variation>
|
|
1294
|
+
<URL>http://testphp.vulnweb.com/listproducts.php?artist=3</URL>
|
|
1295
|
+
<PostData><![CDATA[]]></PostData>
|
|
1296
|
+
</Variation>
|
|
1297
|
+
</Variations>
|
|
1298
|
+
</SiteFile>
|
|
1299
|
+
<SiteFile id="106">
|
|
1300
|
+
<Name>clientaccesspolicy.xml</Name>
|
|
1301
|
+
<URL>/clientaccesspolicy.xml</URL>
|
|
1302
|
+
<FullURL>http://testphp.vulnweb.com/clientaccesspolicy.xml</FullURL>
|
|
1303
|
+
<Inputs>
|
|
1304
|
+
</Inputs>
|
|
1305
|
+
<Variations>
|
|
1306
|
+
</Variations>
|
|
1307
|
+
</SiteFile>
|
|
1308
|
+
<SiteFile id="107">
|
|
1309
|
+
<Name>showimage.php</Name>
|
|
1310
|
+
<URL>/showimage.php</URL>
|
|
1311
|
+
<FullURL>http://testphp.vulnweb.com/showimage.php</FullURL>
|
|
1312
|
+
<Inputs>
|
|
1313
|
+
<Variable Name="file" Type="URL encoded GET">
|
|
1314
|
+
</Variable>
|
|
1315
|
+
<Variable Name="file" Type="URL encoded GET">
|
|
1316
|
+
</Variable>
|
|
1317
|
+
<Variable Name="file" Type="URL encoded GET">
|
|
1318
|
+
</Variable>
|
|
1319
|
+
</Inputs>
|
|
1320
|
+
<Variations>
|
|
1321
|
+
<Variation>
|
|
1322
|
+
<URL>http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg&size=160</URL>
|
|
1323
|
+
<PostData><![CDATA[]]></PostData>
|
|
1324
|
+
</Variation>
|
|
1325
|
+
<Variation>
|
|
1326
|
+
<URL>http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg&size=160</URL>
|
|
1327
|
+
<PostData><![CDATA[]]></PostData>
|
|
1328
|
+
</Variation>
|
|
1329
|
+
<Variation>
|
|
1330
|
+
<URL>http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg&size=160</URL>
|
|
1331
|
+
<PostData><![CDATA[]]></PostData>
|
|
1332
|
+
</Variation>
|
|
1333
|
+
<Variation>
|
|
1334
|
+
<URL>http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg&size=160</URL>
|
|
1335
|
+
<PostData><![CDATA[]]></PostData>
|
|
1336
|
+
</Variation>
|
|
1337
|
+
<Variation>
|
|
1338
|
+
<URL>http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg&size=160</URL>
|
|
1339
|
+
<PostData><![CDATA[]]></PostData>
|
|
1340
|
+
</Variation>
|
|
1341
|
+
<Variation>
|
|
1342
|
+
<URL>http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg&size=160</URL>
|
|
1343
|
+
<PostData><![CDATA[]]></PostData>
|
|
1344
|
+
</Variation>
|
|
1345
|
+
<Variation>
|
|
1346
|
+
<URL>http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160</URL>
|
|
1347
|
+
<PostData><![CDATA[]]></PostData>
|
|
1348
|
+
</Variation>
|
|
1349
|
+
</Variations>
|
|
1350
|
+
</SiteFile>
|
|
1351
|
+
<SiteFile id="108">
|
|
1352
|
+
<Name>signup.php</Name>
|
|
1353
|
+
<URL>/signup.php</URL>
|
|
1354
|
+
<FullURL>http://testphp.vulnweb.com/signup.php</FullURL>
|
|
1355
|
+
<Inputs>
|
|
1356
|
+
</Inputs>
|
|
1357
|
+
<Variations>
|
|
1358
|
+
</Variations>
|
|
1359
|
+
</SiteFile>
|
|
1360
|
+
<SiteFile id="109">
|
|
1361
|
+
<Name>clearguestbook.php</Name>
|
|
1362
|
+
<URL>/clearguestbook.php</URL>
|
|
1363
|
+
<FullURL>http://testphp.vulnweb.com/clearguestbook.php</FullURL>
|
|
1364
|
+
<Inputs>
|
|
1365
|
+
</Inputs>
|
|
1366
|
+
<Variations>
|
|
1367
|
+
</Variations>
|
|
1368
|
+
</SiteFile>
|
|
1369
|
+
<SiteFile id="110">
|
|
1370
|
+
<Name>bxss</Name>
|
|
1371
|
+
<URL>/bxss/</URL>
|
|
1372
|
+
<FullURL>http://testphp.vulnweb.com/bxss/</FullURL>
|
|
1373
|
+
<Inputs>
|
|
1374
|
+
</Inputs>
|
|
1375
|
+
<Variations>
|
|
1376
|
+
</Variations>
|
|
1377
|
+
</SiteFile>
|
|
1378
|
+
<SiteFile id="111">
|
|
1379
|
+
<Name>cleanDatabase.php</Name>
|
|
1380
|
+
<URL>/bxss/cleanDatabase.php</URL>
|
|
1381
|
+
<FullURL>http://testphp.vulnweb.com/bxss/cleanDatabase.php</FullURL>
|
|
1382
|
+
<Inputs>
|
|
1383
|
+
</Inputs>
|
|
1384
|
+
<Variations>
|
|
1385
|
+
</Variations>
|
|
1386
|
+
</SiteFile>
|
|
1387
|
+
<SiteFile id="112">
|
|
1388
|
+
<Name>index.php</Name>
|
|
1389
|
+
<URL>/bxss/index.php</URL>
|
|
1390
|
+
<FullURL>http://testphp.vulnweb.com/bxss/index.php</FullURL>
|
|
1391
|
+
<Inputs>
|
|
1392
|
+
</Inputs>
|
|
1393
|
+
<Variations>
|
|
1394
|
+
</Variations>
|
|
1395
|
+
</SiteFile>
|
|
1396
|
+
<SiteFile id="113">
|
|
1397
|
+
<Name>test.js</Name>
|
|
1398
|
+
<URL>/bxss/test.js</URL>
|
|
1399
|
+
<FullURL>http://testphp.vulnweb.com/bxss/test.js</FullURL>
|
|
1400
|
+
<Inputs>
|
|
1401
|
+
</Inputs>
|
|
1402
|
+
<Variations>
|
|
1403
|
+
</Variations>
|
|
1404
|
+
</SiteFile>
|
|
1405
|
+
<SiteFile id="114">
|
|
1406
|
+
<Name>adminPan3l</Name>
|
|
1407
|
+
<URL>/bxss/adminPan3l/</URL>
|
|
1408
|
+
<FullURL>http://testphp.vulnweb.com/bxss/adminPan3l/</FullURL>
|
|
1409
|
+
<Inputs>
|
|
1410
|
+
</Inputs>
|
|
1411
|
+
<Variations>
|
|
1412
|
+
</Variations>
|
|
1413
|
+
</SiteFile>
|
|
1414
|
+
<SiteFile id="115">
|
|
1415
|
+
<Name>index.php</Name>
|
|
1416
|
+
<URL>/bxss/adminPan3l/index.php</URL>
|
|
1417
|
+
<FullURL>http://testphp.vulnweb.com/bxss/adminPan3l/index.php</FullURL>
|
|
1418
|
+
<Inputs>
|
|
1419
|
+
</Inputs>
|
|
1420
|
+
<Variations>
|
|
1421
|
+
</Variations>
|
|
1422
|
+
</SiteFile>
|
|
1423
|
+
<SiteFile id="116">
|
|
1424
|
+
<Name>style.css</Name>
|
|
1425
|
+
<URL>/bxss/adminPan3l/style.css</URL>
|
|
1426
|
+
<FullURL>http://testphp.vulnweb.com/bxss/adminPan3l/style.css</FullURL>
|
|
1427
|
+
<Inputs>
|
|
1428
|
+
</Inputs>
|
|
1429
|
+
<Variations>
|
|
1430
|
+
</Variations>
|
|
1431
|
+
</SiteFile>
|
|
1432
|
+
<SiteFile id="117">
|
|
1433
|
+
<Name>vuln.php</Name>
|
|
1434
|
+
<URL>/bxss/vuln.php</URL>
|
|
1435
|
+
<FullURL>http://testphp.vulnweb.com/bxss/vuln.php</FullURL>
|
|
1436
|
+
<Inputs>
|
|
1437
|
+
<Variable Name="id" Type="URL encoded GET">
|
|
1438
|
+
</Variable>
|
|
1439
|
+
</Inputs>
|
|
1440
|
+
<Variations>
|
|
1441
|
+
<Variation>
|
|
1442
|
+
<URL>http://testphp.vulnweb.com/bxss/vuln.php?id=1</URL>
|
|
1443
|
+
<PostData><![CDATA[]]></PostData>
|
|
1444
|
+
</Variation>
|
|
1445
|
+
</Variations>
|
|
1446
|
+
</SiteFile>
|
|
1447
|
+
<SiteFile id="118">
|
|
1448
|
+
<Name>database_connect.php</Name>
|
|
1449
|
+
<URL>/bxss/database_connect.php</URL>
|
|
1450
|
+
<FullURL>http://testphp.vulnweb.com/bxss/database_connect.php</FullURL>
|
|
1451
|
+
<Inputs>
|
|
1452
|
+
</Inputs>
|
|
1453
|
+
<Variations>
|
|
1454
|
+
</Variations>
|
|
1455
|
+
</SiteFile>
|
|
1456
|
+
<SiteFile id="119">
|
|
1457
|
+
<Name>crossdomain.xml</Name>
|
|
1458
|
+
<URL>/crossdomain.xml</URL>
|
|
1459
|
+
<FullURL>http://testphp.vulnweb.com/crossdomain.xml</FullURL>
|
|
1460
|
+
<Inputs>
|
|
1461
|
+
</Inputs>
|
|
1462
|
+
<Variations>
|
|
1463
|
+
</Variations>
|
|
1464
|
+
</SiteFile>
|
|
1465
|
+
<SiteFile id="120">
|
|
1466
|
+
<Name>Connections</Name>
|
|
1467
|
+
<URL>/Connections/</URL>
|
|
1468
|
+
<FullURL>http://testphp.vulnweb.com/Connections/</FullURL>
|
|
1469
|
+
<Inputs>
|
|
1470
|
+
</Inputs>
|
|
1471
|
+
<Variations>
|
|
1472
|
+
</Variations>
|
|
1473
|
+
</SiteFile>
|
|
1474
|
+
<SiteFile id="121">
|
|
1475
|
+
<Name>DB_Connection.php</Name>
|
|
1476
|
+
<URL>/Connections/DB_Connection.php</URL>
|
|
1477
|
+
<FullURL>http://testphp.vulnweb.com/Connections/DB_Connection.php</FullURL>
|
|
1478
|
+
<Inputs>
|
|
1479
|
+
</Inputs>
|
|
1480
|
+
<Variations>
|
|
1481
|
+
</Variations>
|
|
1482
|
+
</SiteFile>
|
|
1483
|
+
<SiteFile id="122">
|
|
1484
|
+
<Name>database_connect.php</Name>
|
|
1485
|
+
<URL>/database_connect.php</URL>
|
|
1486
|
+
<FullURL>http://testphp.vulnweb.com/database_connect.php</FullURL>
|
|
1487
|
+
<Inputs>
|
|
1488
|
+
</Inputs>
|
|
1489
|
+
<Variations>
|
|
1490
|
+
</Variations>
|
|
1491
|
+
</SiteFile>
|
|
1492
|
+
<SiteFile id="123">
|
|
1493
|
+
<Name>medias</Name>
|
|
1494
|
+
<URL>/medias</URL>
|
|
1495
|
+
<FullURL>http://testphp.vulnweb.com/medias</FullURL>
|
|
1496
|
+
<Inputs>
|
|
1497
|
+
</Inputs>
|
|
1498
|
+
<Variations>
|
|
1499
|
+
</Variations>
|
|
1500
|
+
</SiteFile>
|
|
1501
|
+
<SiteFile id="124">
|
|
1502
|
+
<Name>img</Name>
|
|
1503
|
+
<URL>/medias/img</URL>
|
|
1504
|
+
<FullURL>http://testphp.vulnweb.com/medias/img</FullURL>
|
|
1505
|
+
<Inputs>
|
|
1506
|
+
</Inputs>
|
|
1507
|
+
<Variations>
|
|
1508
|
+
</Variations>
|
|
1509
|
+
</SiteFile>
|
|
1510
|
+
<SiteFile id="125">
|
|
1511
|
+
<Name>css</Name>
|
|
1512
|
+
<URL>/medias/css</URL>
|
|
1513
|
+
<FullURL>http://testphp.vulnweb.com/medias/css</FullURL>
|
|
1514
|
+
<Inputs>
|
|
1515
|
+
</Inputs>
|
|
1516
|
+
<Variations>
|
|
1517
|
+
</Variations>
|
|
1518
|
+
</SiteFile>
|
|
1519
|
+
<SiteFile id="126">
|
|
1520
|
+
<Name>main.css</Name>
|
|
1521
|
+
<URL>/medias/css/main.css</URL>
|
|
1522
|
+
<FullURL>http://testphp.vulnweb.com/medias/css/main.css</FullURL>
|
|
1523
|
+
<Inputs>
|
|
1524
|
+
</Inputs>
|
|
1525
|
+
<Variations>
|
|
1526
|
+
</Variations>
|
|
1527
|
+
</SiteFile>
|
|
1528
|
+
<SiteFile id="127">
|
|
1529
|
+
<Name>js</Name>
|
|
1530
|
+
<URL>/medias/js</URL>
|
|
1531
|
+
<FullURL>http://testphp.vulnweb.com/medias/js</FullURL>
|
|
1532
|
+
<Inputs>
|
|
1533
|
+
</Inputs>
|
|
1534
|
+
<Variations>
|
|
1535
|
+
</Variations>
|
|
1536
|
+
</SiteFile>
|
|
1537
|
+
<SiteFile id="128">
|
|
1538
|
+
<Name>common_functions.js</Name>
|
|
1539
|
+
<URL>/medias/js/common_functions.js</URL>
|
|
1540
|
+
<FullURL>http://testphp.vulnweb.com/medias/js/common_functions.js</FullURL>
|
|
1541
|
+
<Inputs>
|
|
1542
|
+
</Inputs>
|
|
1543
|
+
<Variations>
|
|
1544
|
+
</Variations>
|
|
1545
|
+
</SiteFile>
|
|
1546
|
+
</SiteFiles>
|
|
1547
|
+
</Crawler>
|
|
1548
|
+
<ReportItems>
|
|
1549
|
+
<ReportItem id="0" color="red">
|
|
1550
|
+
<Name><![CDATA[SQL injection (verified)]]></Name>
|
|
1551
|
+
<ModuleName><![CDATA[Scripting (Sql_Injection.script)]]></ModuleName>
|
|
1552
|
+
<Details><![CDATA[URL encoded POST input <b><font color="dark">uuname</font></b> was set to <b><font color="dark">1ACUSTART'"VfFd7ACUEND</font></b>]]></Details>
|
|
1553
|
+
<Affects><![CDATA[/secured/newuser.php]]></Affects>
|
|
1554
|
+
<Parameter><![CDATA[uuname]]></Parameter>
|
|
1555
|
+
<AOP_SourceFile><![CDATA[/hj/var/www//secured/newuser.php]]></AOP_SourceFile>
|
|
1556
|
+
<AOP_SourceLine>16</AOP_SourceLine>
|
|
1557
|
+
<AOP_Additional><![CDATA[SQL query: SELECT * FROM users WHERE uname='1ACUSTART'"VfFd7ACUEND'
|
|
1558
|
+
"mysql_query" was called.]]></AOP_Additional>
|
|
1559
|
+
<IsFalsePositive><![CDATA[False]]></IsFalsePositive>
|
|
1560
|
+
<Severity><![CDATA[high]]></Severity>
|
|
1561
|
+
<Type><![CDATA[Validation]]></Type>
|
|
1562
|
+
<Impact><![CDATA[An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of your database and/or expose sensitive information. <br/><br/>Depending on the back-end database in use, SQL injection vulnerabilities lead to varying levels of data/system access for the attacker. It may be possible to not only manipulate existing queries, but to UNION in arbitrary data, use sub selects, or append additional queries. In some cases, it may be possible to read in or write out to files, or to execute shell commands on the underlying operating system.<br/><br/>Certain SQL Servers such as Microsoft SQL Server contain stored and extended procedures (database server functions). If an attacker can obtain access to these procedures it may be possible to compromise the entire machine.]]></Impact>
|
|
1563
|
+
<Description><![CDATA[This script is possibly vulnerable to SQL Injection attacks.<br/><br/>
|
|
1564
|
+
SQL injection is a vulnerability that allows an attacker to alter back-end SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters. <br/> <br/> This is one of the most common application layer attacks currently being used on the Internet. Despite the fact that it is relatively easy to protect against, there is a large number of web applications vulnerable.]]></Description>
|
|
1565
|
+
<DetailedInformation><![CDATA[<i>Quote from SQL Injection Attacks by Example - http://www.unixwiz.net/techtips/sql-injection.html</i>
|
|
1566
|
+
<h2>SQL injection mitigations</h2>
|
|
1567
|
+
|
|
1568
|
+
<p>We believe that web application developers often simply do not think about "surprise inputs", but security people do (including the bad guys), so there are three broad approaches that can be applied here.</p>
|
|
1569
|
+
|
|
1570
|
+
<h2>Sanitize the input</h2>
|
|
1571
|
+
<p>It's absolutely vital to sanitize user inputs to insure that they do not contain dangerous codes, whether to the SQL server or to HTML itself. One's first idea is to strip out "bad stuff", such as quotes or semicolons or escapes, but this is a misguided attempt. Though it's easy to point out some dangerous characters, it's harder to point to all of them.</p>
|
|
1572
|
+
<p>The language of the web is full of special characters and strange markup (including alternate ways of representing the same characters), and efforts to authoritatively identify all "bad stuff" are unlikely to be successful.</p>
|
|
1573
|
+
<p>Instead, rather than "remove known bad data", it's better to "remove everything but known good data": this distinction is crucial. Since - in our example - an email address can contain only these characters: </p>
|
|
1574
|
+
<code><pre wrap="virtual">
|
|
1575
|
+
abcdefghijklmnopqrstuvwxyz
|
|
1576
|
+
ABCDEFGHIJKLMNOPQRSTUVWXYZ
|
|
1577
|
+
0123456789
|
|
1578
|
+
@.-_+
|
|
1579
|
+
</pre></code>
|
|
1580
|
+
|
|
1581
|
+
<p>There is really no benefit in allowing characters that could not be valid, and rejecting them early - presumably with an error message - not only helps forestall SQL Injection, but also catches mere typos early rather than stores them into the database. </p>
|
|
1582
|
+
|
|
1583
|
+
<p>Be aware that "sanitizing the input" doesn't mean merely "remove the quotes", because even "regular" characters can be troublesome. In an example where an integer ID value is being compared against the user input (say, a numeric PIN): </p>
|
|
1584
|
+
<code><pre wrap="virtual">
|
|
1585
|
+
SELECT fieldlist
|
|
1586
|
+
FROM table
|
|
1587
|
+
WHERE id = 23 OR 1=1; -- Boom! Always matches!
|
|
1588
|
+
</pre></code>
|
|
1589
|
+
<p>In practice, however, this approach is highly limited because there are so few fields for which it's possible to outright exclude many of the dangerous characters. For "dates" or "email addresses" or "integers" it may have merit, but for any kind of real application, one simply cannot avoid the other mitigations. </p>
|
|
1590
|
+
|
|
1591
|
+
<h2>Escape/Quotesafe the input</h2>
|
|
1592
|
+
<p>Even if one might be able to sanitize a phone number or email address, one cannot take this approach with a "name" field lest one wishes to exclude the likes of Bill O'Reilly from one's application: a quote is simply a valid character for this field.</p>
|
|
1593
|
+
<p>One includes an actual single quote in an SQL string by putting two of them together, so this suggests the obvious - but wrong! - technique of preprocessing every string to replicate the single quotes:</p>
|
|
1594
|
+
<code><pre wrap="virtual">
|
|
1595
|
+
SELECT fieldlist
|
|
1596
|
+
FROM customers
|
|
1597
|
+
WHERE name = 'Bill O''Reilly'; -- works OK
|
|
1598
|
+
</pre></code>
|
|
1599
|
+
<p>However, this naive approach can be beaten because most databases support other string escape mechanisms. MySQL, for instance, also permits \' to escape a quote, so after input of \'; DROP TABLE users; -- is "protected" by doubling the quotes, we get: </p>
|
|
1600
|
+
<code><pre wrap="virtual">
|
|
1601
|
+
SELECT fieldlist
|
|
1602
|
+
FROM customers
|
|
1603
|
+
WHERE name = '\''; DROP TABLE users; --'; -- Boom!
|
|
1604
|
+
</pre></code>
|
|
1605
|
+
<p>The expression '\'' is a complete string (containing just one single quote), and the usual SQL shenanigans follow. It doesn't stop with backslashes either: there is Unicode, other encodings, and parsing oddities all hiding in the weeds to trip up the application designer.</p>
|
|
1606
|
+
<p>Getting quotes right is notoriously difficult, which is why many database interface languages provide a function that does it for you. When the same internal code is used for "string quoting" and "string parsing", it's much more likely that the process will be done properly and safely.</p>
|
|
1607
|
+
<p>Some examples are the MySQL function <b>mysql_real_escape_string()</b> and perl DBD method <b>$dbh->quote($value)</b>. These methods must be used. </p>
|
|
1608
|
+
|
|
1609
|
+
<h2>Use bound parameters (the PREPARE statement)</h2>
|
|
1610
|
+
<p>Though quotesafing is a good mechanism, we're still in the area of "considering user input as SQL", and a much better approach exists: bound parameters, which are supported by essentially all database programming interfaces. In this technique, an SQL statement string is created with placeholders - a question mark for each parameter - and it's compiled ("prepared", in SQL parlance) into an internal form. Later, this prepared query is "executed" with a list of parameters: </p>
|
|
1611
|
+
|
|
1612
|
+
<b>Example in perl</b>
|
|
1613
|
+
<code><pre wrap="virtual"> $sth = $dbh->prepare("SELECT email, userid FROM members WHERE email = ?;");
|
|
1614
|
+
$sth->execute($email);
|
|
1615
|
+
</pre></code>
|
|
1616
|
+
<p>Thanks to Stefan Wagner, this demonstrates bound parameters in Java: </p>
|
|
1617
|
+
|
|
1618
|
+
<b>Insecure version</b>
|
|
1619
|
+
<code><pre wrap="virtual"> Statement s = connection.createStatement();
|
|
1620
|
+
ResultSet rs = s.executeQuery("SELECT email FROM member WHERE name = "
|
|
1621
|
+
+ formField); // *boom*
|
|
1622
|
+
</pre></code>
|
|
1623
|
+
|
|
1624
|
+
<p><b>Secure version</b></p>
|
|
1625
|
+
<code><pre wrap="virtual"> PreparedStatement ps = connection.prepareStatement(
|
|
1626
|
+
"SELECT email FROM member WHERE name = ?");
|
|
1627
|
+
ps.setString(1, formField);
|
|
1628
|
+
ResultSet rs = ps.executeQuery();
|
|
1629
|
+
</pre></code>
|
|
1630
|
+
|
|
1631
|
+
<p>Here, $email is the data obtained from the user's form, and it is passed as positional parameter #1 (the first question mark), and at no point do the contents of this variable have anything to do with SQL statement parsing. Quotes, semicolons, backslashes, SQL comment notation - none of this has any impact, because it's "just data". There simply is nothing to subvert, so the application is be largely immune to SQL injection attacks.</p>
|
|
1632
|
+
|
|
1633
|
+
<p>There also may be some performance benefits if this prepared query is reused multiple times (it only has to be parsed once), but this is minor compared to the enormous security benefits. This is probably the single most important step one can take to secure a web application. </p>
|
|
1634
|
+
|
|
1635
|
+
<h2>Limit database permissions and segregate users</h2>
|
|
1636
|
+
<p>In the case at hand, we observed just two interactions that are made not in the context of a logged-in user: "log in" and "send me password". The web application ought to use a database connection with the most limited rights possible: query-only access to the members table, and no access to any other table.</p>
|
|
1637
|
+
<p>The effect here is that even a "successful" SQL injection attack is going to have much more limited success. Here, we'd not have been able to do the UPDATE request that ultimately granted us access, so we'd have had to resort to other avenues.</p>
|
|
1638
|
+
<p>Once the web application determined that a set of valid credentials had been passed via the login form, it would then switch that session to a database connection with more rights.</p>
|
|
1639
|
+
<p>It should go almost without saying that sa rights should never be used for any web-based application.</p>
|
|
1640
|
+
|
|
1641
|
+
<h2>Use stored procedures for database access</h2>
|
|
1642
|
+
<p>When the database server supports them, use stored procedures for performing access on the application's behalf, which can eliminate SQL entirely (assuming the stored procedures themselves are written properly). </p>
|
|
1643
|
+
<p>By encapsulating the rules for a certain action - query, update, delete, etc. - into a single procedure, it can be tested and documented on a standalone basis and business rules enforced (for instance, the "add new order" procedure might reject that order if the customer were over his credit limit). </p>
|
|
1644
|
+
<p>For simple queries this might be only a minor benefit, but as the operations become more complicated (or are used in more than one place), having a single definition for the operation means it's going to be more robust and easier to maintain. </p>
|
|
1645
|
+
<p><i>Note: </i>it's always possible to write a stored procedure that itself constructs a query dynamically: this provides no protection against SQL Injection - it's only proper binding with prepare/execute or direct SQL statements with bound variables that provide this protection. </p>
|
|
1646
|
+
|
|
1647
|
+
<h2>Isolate the webserver</h2>
|
|
1648
|
+
<p>Even having taken all these mitigation steps, it's nevertheless still possible to miss something and leave the server open to compromise. One ought to design the network infrastructure to assume that the bad guy will have full administrator access to the machine, and then attempt to limit how that can be leveraged to compromise other things. </p>
|
|
1649
|
+
<p>For instance, putting the machine in a DMZ with extremely limited pinholes "inside" the network means that even getting complete control of the webserver doesn't automatically grant full access to everything else. This won't stop everything, of course, but it makes it a lot harder. </p>
|
|
1650
|
+
|
|
1651
|
+
<h2>Configure error reporting</h2>
|
|
1652
|
+
<p>The default error reporting for some frameworks includes developer debugging information, and this cannot be shown to outside users. Imagine how much easier a time it makes for an attacker if the full query is shown, pointing to the syntax error involved. </p>
|
|
1653
|
+
<p>This information is useful to developers, but it should be restricted - if possible - to just internal users. </p>]]></DetailedInformation>
|
|
1654
|
+
<Recommendation><![CDATA[Your script should filter metacharacters from user input. <br/>Check detailed information for more information about fixing this vulnerability.]]></Recommendation>
|
|
1655
|
+
<TechnicalDetails>
|
|
1656
|
+
<Request><![CDATA[POST /secured/newuser.php HTTP/1.1
|
|
1657
|
+
Acunetix-Aspect-Password: 082119f75623eb7abd7bf357698ff66c
|
|
1658
|
+
Acunetix-Aspect: enabled
|
|
1659
|
+
Content-Length: 207
|
|
1660
|
+
Content-Type: application/x-www-form-urlencoded
|
|
1661
|
+
Referer: http://testphp.vulnweb.com:80/
|
|
1662
|
+
Host: testphp.vulnweb.com
|
|
1663
|
+
Connection: Keep-alive
|
|
1664
|
+
Accept-Encoding: gzip,deflate
|
|
1665
|
+
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
|
|
1666
|
+
Accept: */*
|
|
1667
|
+
|
|
1668
|
+
signup=signup&uaddress=3137%20Laguna%20Street&ucc=4111111111111111&uemail=sample%40email.tst&upass=g00dPa%24%24w0rD&upass2=g00dPa%24%24w0rD&uphone=555-666-0606&urname=inrbcvxp&uuname=1ACUSTART'%22VfFd7ACUEND]]></Request>
|
|
1669
|
+
<Response><![CDATA[HTTP/1.1 200 OK
|
|
1670
|
+
Server: nginx/1.4.1
|
|
1671
|
+
Date: Tue, 07 Oct 2014 17:30:56 GMT
|
|
1672
|
+
Content-Type: text/html
|
|
1673
|
+
Connection: keep-alive
|
|
1674
|
+
X-Powered-By: PHP/5.3.10-1~lucid+2uwsgi2
|
|
1675
|
+
Original-Content-Encoding: gzip
|
|
1676
|
+
Content-Length: 421
|
|
1677
|
+
]]></Response>
|
|
1678
|
+
</TechnicalDetails>
|
|
1679
|
+
<CWE id="89"><![CDATA[CWE-89]]></CWE>
|
|
1680
|
+
<CVEList/>
|
|
1681
|
+
<CVSS>
|
|
1682
|
+
<Descriptor><![CDATA[AV:N/AC:M/Au:N/C:P/I:P/A:P]]></Descriptor>
|
|
1683
|
+
<Score><![CDATA[6.8]]></Score>
|
|
1684
|
+
<AV><![CDATA[Network]]></AV>
|
|
1685
|
+
<AVdesc><![CDATA[A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access.]]></AVdesc>
|
|
1686
|
+
<AC><![CDATA[Medium]]></AC>
|
|
1687
|
+
<ACdesc><![CDATA[The access conditions are somewhat specialized.]]></ACdesc>
|
|
1688
|
+
<Au><![CDATA[None]]></Au>
|
|
1689
|
+
<Audesc><![CDATA[Authentication is not required to exploit the vulnerability.]]></Audesc>
|
|
1690
|
+
<C><![CDATA[Partial]]></C>
|
|
1691
|
+
<Cdesc><![CDATA[There is considerable informational disclosure. Access to some system files is possible, but the attacker does not have control over what is obtained, or the scope of the loss is constrained.]]></Cdesc>
|
|
1692
|
+
<I><![CDATA[Partial]]></I>
|
|
1693
|
+
<Idesc><![CDATA[Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.]]></Idesc>
|
|
1694
|
+
<A><![CDATA[Partial]]></A>
|
|
1695
|
+
<Adesc><![CDATA[There is reduced performance or interruptions in resource availability.]]></Adesc>
|
|
1696
|
+
<E><![CDATA[]]></E>
|
|
1697
|
+
<Edesc><![CDATA[]]></Edesc>
|
|
1698
|
+
<RL><![CDATA[]]></RL>
|
|
1699
|
+
<RLdesc><![CDATA[]]></RLdesc>
|
|
1700
|
+
<RC><![CDATA[]]></RC>
|
|
1701
|
+
<RCdesc><![CDATA[]]></RCdesc>
|
|
1702
|
+
</CVSS>
|
|
1703
|
+
<References>
|
|
1704
|
+
<Reference>
|
|
1705
|
+
<Database><![CDATA[Acunetix SQL Injection Attack]]></Database>
|
|
1706
|
+
<URL><![CDATA[http://www.acunetix.com/websitesecurity/sql-injection.htm]]></URL>
|
|
1707
|
+
</Reference>
|
|
1708
|
+
<Reference>
|
|
1709
|
+
<Database><![CDATA[VIDEO: SQL Injection tutorial]]></Database>
|
|
1710
|
+
<URL><![CDATA[http://www.acunetix.com/blog/web-security-zone/video-sql-injection-tutorial/]]></URL>
|
|
1711
|
+
</Reference>
|
|
1712
|
+
<Reference>
|
|
1713
|
+
<Database><![CDATA[OWASP Injection Flaws]]></Database>
|
|
1714
|
+
<URL><![CDATA[http://www.owasp.org/index.php/Injection_Flaws]]></URL>
|
|
1715
|
+
</Reference>
|
|
1716
|
+
<Reference>
|
|
1717
|
+
<Database><![CDATA[How to check for SQL injection vulnerabilities]]></Database>
|
|
1718
|
+
<URL><![CDATA[http://www.acunetix.com/websitesecurity/sql-injection2/]]></URL>
|
|
1719
|
+
</Reference>
|
|
1720
|
+
<Reference>
|
|
1721
|
+
<Database><![CDATA[SQL Injection Walkthrough]]></Database>
|
|
1722
|
+
<URL><![CDATA[http://www.securiteam.com/securityreviews/5DP0N1P76E.html]]></URL>
|
|
1723
|
+
</Reference>
|
|
1724
|
+
<Reference>
|
|
1725
|
+
<Database><![CDATA[OWASP PHP Top 5]]></Database>
|
|
1726
|
+
<URL><![CDATA[http://www.owasp.org/index.php/PHP_Top_5]]></URL>
|
|
1727
|
+
</Reference>
|
|
1728
|
+
</References>
|
|
1729
|
+
</ReportItem>
|
|
1730
|
+
</ReportItems>
|
|
1731
|
+
</Scan>
|
|
1732
|
+
</ScanGroup>
|