Skip to content

Commit a04d2cc

Browse files
kingthorinkingthorin
authored
Merge pull request #1919 from zapbot/update-site-content
Update site content
2 parents f89b51e + beac5bb commit a04d2cc

File tree

2 files changed

+86
-1
lines changed

2 files changed

+86
-1
lines changed

‎docs/testapps/altoroj/index.html‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,91 @@ <h3 id="results">Results <a class="header-link" href="#results"><svg class="fill
346346
</tr>
347347
</tbody>
348348
</table>
349+
350+
<h3 id="api-scanning">API Scanning <a class="header-link" href="#api-scanning"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h3>
351+
<p>Authentication is a bit different for the API.</p>
352+
<p>You need to make a <code>POST</code> request to the <code>/api/login</code> with the credentials in JSON format: <code>{&quot;username&quot;:&quot;jsmith&quot;,&quot;password&quot;:&quot;demo1234&quot;}</code>. Which responds with a an Authorization token which then needs to be sent via the <code>Authorization</code> header on requests to other parts of the API. Session/token validity can be verified by making a <code>GET</code> request to <code>/api/login</code> then checking the response code (200 OK vs 401 Unauthorized).</p>
353+
354+
<h4 id="recommended-environment-1">Recommended Environment <a class="header-link" href="#recommended-environment-1"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h4>
355+
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span><span style="color:#f92672">env</span>:
356+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">contexts</span>:
357+
</span></span><span style="display:flex;"><span> - <span style="color:#f92672">name</span>: <span style="color:#ae81ff">testfire_api</span>
358+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">urls</span>:
359+
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">https://demo.testfire.net</span>
360+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">includePaths</span>:
361+
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">https://demo.testfire.net.*</span>
362+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">excludePaths</span>:
363+
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">https://demo.testfire.net/api/logout</span>
364+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">authentication</span>:
365+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">method</span>: <span style="color:#ae81ff">json</span>
366+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">parameters</span>:
367+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">loginRequestBody</span>: <span style="color:#e6db74">&#34;{\&#34;username\&#34;:\&#34;{%username%}\&#34;,\&#34;password\&#34;:\&#34;{%password%}\&#34;\
368+
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> }&#34;</span>
369+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">loginPageUrl</span>: <span style="color:#e6db74">&#34;&#34;</span>
370+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">loginRequestUrl</span>: <span style="color:#ae81ff">https://demo.testfire.net/api/login</span>
371+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">verification</span>:
372+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">method</span>: <span style="color:#ae81ff">poll</span>
373+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">loggedInRegex</span>: <span style="color:#ae81ff">200</span> <span style="color:#ae81ff">OK</span>
374+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">loggedOutRegex</span>: <span style="color:#ae81ff">401</span> <span style="color:#ae81ff">Unauthorized</span>
375+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">pollFrequency</span>: <span style="color:#ae81ff">60</span>
376+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">pollUnits</span>: <span style="color:#ae81ff">seconds</span>
377+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">pollUrl</span>: <span style="color:#ae81ff">https://demo.testfire.net/api/login</span>
378+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">pollPostData</span>: <span style="color:#e6db74">&#34;&#34;</span>
379+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">sessionManagement</span>:
380+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">method</span>: <span style="color:#ae81ff">headers</span>
381+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">parameters</span>:
382+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">Authorization</span>: <span style="color:#e6db74">&#34;{%json:Authorization%}&#34;</span>
383+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">technology</span>: {}
384+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">structure</span>: {}
385+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">users</span>:
386+
</span></span><span style="display:flex;"><span> - <span style="color:#f92672">name</span>: <span style="color:#ae81ff">jsmith</span>
387+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">credentials</span>:
388+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">password</span>: <span style="color:#ae81ff">demo1234</span>
389+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">username</span>: <span style="color:#ae81ff">jsmith</span>
390+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">parameters</span>: {}
391+
</span></span></code></pre></div>
392+
<h4 id="openapi-import">OpenAPI Import <a class="header-link" href="#openapi-import"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h4>
393+
<p>You can then use an OpenAPI Import job to explore the API prior to active scanning.</p>
394+
395+
396+
397+
<blockquote class="alert alert-note">
398+
<p class="alert-heading">
399+
📝
400+
401+
Note
402+
403+
</p>
404+
405+
<div class="alert-content">
406+
<p>The traffic will be passively scanned during import.</p>
407+
</div>
408+
</blockquote>
409+
410+
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span>- <span style="color:#f92672">type</span>: <span style="color:#ae81ff">openapi</span>
411+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">parameters</span>:
412+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">apiUrl</span>: <span style="color:#ae81ff">https://demo.testfire.net/swagger/properties.json</span>
413+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">context</span>: <span style="color:#ae81ff">testfire_api</span>
414+
</span></span><span style="display:flex;"><span> <span style="color:#f92672">user</span>: <span style="color:#ae81ff">jsmith</span>
415+
</span></span></code></pre></div>
416+
<h4 id="scanning-1">Scanning <a class="header-link" href="#scanning-1"><svg class="fill-current o-60 hover-accent-color-light" height="22px" viewBox="0 0 24 24" width="22px" xmlns="http://www.w3.org/2000/svg"><path d="M0 0h24v24H0z" fill="none"/><path d="M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z" fill="currentColor"/></svg></a></h4>
417+
<p>You can then active scan as you see fit.</p>
418+
419+
420+
421+
<blockquote class="alert alert-note">
422+
<p class="alert-heading">
423+
📝
424+
425+
Note
426+
427+
</p>
428+
429+
<div class="alert-content">
430+
<p>If you have the <a href="/docs/desktop/addons/scan-policies/">Scan Policies add-on</a> installed, this is a good opportunity to leverage the <a href="/docs/desktop/addons/scan-policies/policy-api/">API Policy</a>.</p>
431+
</div>
432+
</blockquote>
433+
349434
</main>
350435
</article>
351436
</section>

‎search/index.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4997,7 +4997,7 @@
49974997
"keywords": ["","/","altoroj","testfire.net"],
49984998
"tags": null,
49994999
"summary": "\u003ch3 id=\"overview\"\u003eOverview \u003ca class=\"header-link\" href=\"#overview\"\u003e\u003csvg class=\"fill-current o-60 hover-accent-color-light\" height=\"22px\" viewBox=\"0 0 24 24\" width=\"22px\" xmlns=\"http://www.w3.org/2000/svg\"\u003e\u003cpath d=\"M0 0h24v24H0z\" fill=\"none\"/\u003e\u003cpath d=\"M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1zM8 13h8v-2H8v2zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5z\" fill=\"currentColor\"/\u003e\u003c/svg\u003e\u003c/a\u003e\u003c/h3\u003e\n\u003cp\u003eAltoroJ, also known as Altoro Mutual and Testfire, is an open source sample banking J2EE web application\nmaintained by \u003ca href=\"https://www.hcl-software.com/\"\u003eHCL Software\u003c/a\u003e.\u003c/p\u003e",
5000-
"content": "overview altoroj also known altoro mutual testfire open source sample banking j2ee web application maintained by hcl software traditional app created 2008 not updated very often online: https:demotestfirenet repo: https:githubcomhcltechsoftwarealtoroj quick start new zap just want quickly run against these commands: download recommended plan using curl use any other suitable tool https:rawgithubusercontentcomzaproxycommunityscriptsrefsheadsmainotherafplansfullscantestfireauthyaml stable docker image mapping cwd that can access file system export report pwd:zapwrk:rw zaproxyzapstable zapsh cmd autorun wrkfullscantestfireauthyaml command windows see relevant documentation you will need have installed do then course install locally create html your containing full details all issues found further resultsresults below potential pitfalls online which may unavailable broken point running local version give more consistent results authentication users username password: admin jsmith demo1234 browser based successfully authenticate identify session handling verification client script zest available here: testfirezst environment env: contexts: name: urls: http:demotestfirenet includepaths: authentication: method: parameters: loginpageurl: https:demotestfirenetloginjsp loginpagewait: browserid: firefox verification: poll loggedinregex: 200 oke loggedoutregex: 302 founde pollfrequency: 60 pollunits: seconds pollurl: https:demotestfirenetbankmainjsp pollpostdata: 3434 sessionmanagement: headers users: credentials: username: note there exclude paths added definition logout avoidance used spider job example dologin left included impacted sqli vulnerability crawling spiders crawl we recommend following configuration: type: context: user: url: logoutavoidance: true ajax link: spiderajax firefoxheadless excludedelements: description: element: text: sign off scanning believe definitive list vulnerabilities altoroj: https:helphclsoftwarecomappscanasocjapdfsampledastreportpdf too surprisingly configure activescan probably generate vuln disposition cross site scripting reflected http:testfirenetbankcustomizejsp positive http:testfirenetbankqueryxpathjsp http:testfirenetsearchjsp http:testfirenetsendfeedback sql injection http:testfirenetbankccapply https:testfirenetdologin https:demotestfirenetbankshowtransactions false negative external redirect pii disclosure https:testfirenetbankmainjsp content security policy csp header set absence anticsrf tokens missing anticlickjacking relative path confusion secure pages include mixed including scripts sub resource integrity attribute insecure http method code "
5000+
"content": "overview altoroj also known altoro mutual testfire open source sample banking j2ee web application maintained by hcl software traditional app created 2008 not updated very often online: https:demotestfirenet repo: https:githubcomhcltechsoftwarealtoroj quick start new zap just want quickly run against these commands: download recommended plan using curl use any other suitable tool https:rawgithubusercontentcomzaproxycommunityscriptsrefsheadsmainotherafplansfullscantestfireauthyaml stable docker image mapping cwd that can access file system export report pwd:zapwrk:rw zaproxyzapstable zapsh cmd autorun wrkfullscantestfireauthyaml command windows see relevant documentation you will need have installed do then course install locally create html your containing full details all issues found further resultsresults below potential pitfalls online which may unavailable broken point running local version give more consistent results authentication users username password: admin jsmith demo1234 browser based successfully authenticate identify session handling verification client script zest available here: testfirezst environment env: contexts: name: urls: http:demotestfirenet includepaths: authentication: method: parameters: loginpageurl: https:demotestfirenetloginjsp loginpagewait: browserid: firefox verification: poll loggedinregex: 200 oke loggedoutregex: 302 founde pollfrequency: 60 pollunits: seconds pollurl: https:demotestfirenetbankmainjsp pollpostdata: 3434 sessionmanagement: headers users: credentials: username: note there exclude paths added definition logout avoidance used spider job example dologin left included impacted sqli vulnerability crawling spiders crawl we recommend following configuration: type: context: user: url: logoutavoidance: true ajax link: spiderajax firefoxheadless excludedelements: description: element: text: sign off scanning believe definitive list vulnerabilities altoroj: https:helphclsoftwarecomappscanasocjapdfsampledastreportpdf too surprisingly configure activescan probably generate vuln disposition cross site scripting reflected http:testfirenetbankcustomizejsp positive http:testfirenetbankqueryxpathjsp http:testfirenetsearchjsp http:testfirenetsendfeedback sql injection http:testfirenetbankccapply https:testfirenetdologin https:demotestfirenetbankshowtransactions false negative external redirect pii disclosure https:testfirenetbankmainjsp content security policy csp header set absence anticsrf tokens missing anticlickjacking relative path confusion secure pages include mixed including scripts sub resource integrity attribute insecure http method code api bit different make post request apilogin credentials json format: username:jsmithpassword:demo1234 responds authorization token needs sent via requests parts sessiontoken validity verified making get checking response ok vs 401 unauthorized testfireapi excludepaths: https:demotestfirenetapilogout loginrequestbody: 3434username34:34username3434password34:34password34 34 loginrequesturl: https:demotestfirenetapilogin authorization: 34json:authorization34 technology: structure: openapi import explore prior active traffic passively scanned during apiurl: https:demotestfirenetswaggerpropertiesjson scan fit policies addon good opportunity leverage "
50015001
},
50025002
{
50035003
"url": "/docs/alerts/10020/",

0 commit comments

Comments
 (0)