diff --git a/docs/content/en/integrations/parsers/file/invicti.md b/docs/content/en/integrations/parsers/file/invicti.md new file mode 100644 index 0000000000..c0ffda1a48 --- /dev/null +++ b/docs/content/en/integrations/parsers/file/invicti.md @@ -0,0 +1,9 @@ +--- +title: "Invicti" +toc_hide: true +--- +Vulnerabilities List - JSON report + +### Sample Scan Data + +Sample Invicti scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/invicti). diff --git a/docs/content/en/integrations/parsers/file/netsparker.md b/docs/content/en/integrations/parsers/file/netsparker.md index 7e46af07b1..0be436e185 100644 --- a/docs/content/en/integrations/parsers/file/netsparker.md +++ b/docs/content/en/integrations/parsers/file/netsparker.md @@ -4,5 +4,8 @@ toc_hide: true --- Vulnerabilities List - JSON report +[Netsparker has now become Invicti](https://www.invicti.com/blog/news/netsparker-is-now-invicti-signaling-a-new-era-for-modern-appsec/). Please plan to migrate automation scripts to use the [Invicti Scan](../invicti.md) + ### Sample Scan Data + Sample Netsparker scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/netsparker). \ No newline at end of file diff --git a/dojo/settings/.settings.dist.py.sha256sum b/dojo/settings/.settings.dist.py.sha256sum index 878a104af5..b6e48ee437 100644 --- a/dojo/settings/.settings.dist.py.sha256sum +++ b/dojo/settings/.settings.dist.py.sha256sum @@ -1 +1 @@ -5adedc433a342d675492b86dc18786f72e167115f9718a397dc9b91c5fdc9c94 +1a74292fc58b2bd05c763c8c126b0b35888e2a6f8ef9ab2588bb6c8589987c9c diff --git a/dojo/settings/settings.dist.py b/dojo/settings/settings.dist.py index ebf0283dd6..41f0631fa4 100644 --- a/dojo/settings/settings.dist.py +++ b/dojo/settings/settings.dist.py @@ -1279,6 +1279,7 @@ def saml2_attrib_map_format(dict): "AppCheck Web Application Scanner": ["title", "severity"], "Legitify Scan": ["title", "endpoints", "severity"], "ThreatComposer Scan": ["title", "description"], + "Invicti Scan": ["title", "description", "severity"], } # Override the hardcoded settings here via the env var @@ -1503,6 +1504,7 @@ def saml2_attrib_map_format(dict): "AppCheck Web Application Scanner": DEDUPE_ALGO_HASH_CODE, "Legitify Scan": DEDUPE_ALGO_HASH_CODE, "ThreatComposer Scan": DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE, + "Invicti Scan": DEDUPE_ALGO_HASH_CODE, } # Override the hardcoded settings here via the env var diff --git a/dojo/tools/invicti/__init__.py b/dojo/tools/invicti/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/dojo/tools/invicti/parser.py b/dojo/tools/invicti/parser.py new file mode 100644 index 0000000000..93854d9a2d --- /dev/null +++ b/dojo/tools/invicti/parser.py @@ -0,0 +1,20 @@ +from dojo.tools.netsparker.parser import NetsparkerParser + + +class InvictiParser(NetsparkerParser): + def get_scan_types(self): + return ["Invicti Scan"] + + def get_label_for_scan_types(self, scan_type): + return "Invicti Scan" + + def get_description_for_scan_types(self, scan_type): + return "Invicti JSON format." + + def get_findings(self, filename, test): + """Extended the NetSparker Parser since the Invicti is the a renamed version of Netsparker. + + If there are deviations from the two report formats in the future, then this + function can be implemented then. + """ + return super().get_findings(filename, test) diff --git a/unittests/scans/invicti/invicti_many_findings.json b/unittests/scans/invicti/invicti_many_findings.json new file mode 100644 index 0000000000..c1a1bef778 --- /dev/null +++ b/unittests/scans/invicti/invicti_many_findings.json @@ -0,0 +1,4681 @@ +{ + "Generated": "25/06/2021 10:00 AM", + "Target": { + "Duration": "00:12:24.8161163", + "Initiated": "25/06/2021 01:46 AM", + "ScanId": "ee9136920f6243486d12ad5104e2f745", + "Url": "http://php.testsparker.com/" + }, + "Vulnerabilities": [ + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "107", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "5.7" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "5.5" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "5.5" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "16", + "Hipaa": "", + "Owasp": "A5", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "15" + }, + "Confirmed": true, + "Description": "
Netsparker Enterprise identified a cookie not marked as HTTPOnly.
\nHTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.
", + "ExploitationSkills": "", + "ExternalReferences": "", + "ExtraInformation": [ + { + "Name": "Identified Cookie(s)", + "Value": "PHPSESSID" + }, + { + "Name": "Cookie Source", + "Value": "HTTP Header" + }, + { + "Name": "Page Type", + "Value": "Login" + } + ], + "FirstSeenDate": "16/06/2021 12:30 PM", + "HttpRequest": { + "Content": "GET /auth/login.php HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nReferer: http://php.testsparker.com/auth/\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d; path=/\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nContent-Length: 3061\r\nX-Powered-By: PHP/5.2.6\r\nPragma: no-cache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nKeep-Alive: timeout=5, max=150\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:36 GMT\r\nCache-Control: no-store, must-revalidate, no-cache, post-check=0, pre-check=0\r\n\r\n\n\n\n\n\n\n\n\n Enter your credentials (admin / admin123456)\n
\n
Netsparker Enterprise identified a Boolean-Based SQL Injection, which occurs when data input by a user is interpreted as a SQL command rather than as normal data by the backend database.
\nThis is an extremely common vulnerability and its successful exploitation can have critical implications.
\nNetsparker Enterprise confirmed the vulnerability by executing a test SQL query on the backend database. In these tests, SQL injection was not obvious, but the different responses from the page based on the injection test allowed Netsparker Enterprise to identify and confirm the SQL injection.
sqlibench
root@localhost
5.0.51b-community-nt-log
\n \n
ID | Name | SURNAME | CREATION DATE | |
---|---|---|---|---|
2 | \nNICK | \nWAHLBERG | \n2006-02-15 04:34:33 | \n\n |
3 | \nED | \nCHASE | \n2006-02-15 04:34:33 | \n\n |
4 | \nJENNIFER | \nDAVIS | \n2006-02-15 04:34:33 | \n\n |
5 | \nJOHNNY | \nLOLLOBRIGIDA | \n2006-02-15 04:34:33 | \n\n |
6 | \nBETTE | \nNICHOLSON | \n2006-02-15 04:34:33 | \n\n |
7 | \nGRACE | \nMOSTEL | \n2006-02-15 04:34:33 | \n\n |
8 | \nMATTHEW | \nJOHANSSON | \n2006-02-15 04:34:33 | \n\n |
9 | \nJOE | \nSWANK | \n2006-02-15 04:34:33 | \n\n |
10 | \nCHRISTIAN | \nGABLE | \n2006-02-15 04:34:33 | \n\n |
11 | \nZERO | \nCAGE | \n2006-02-15 04:34:33 | \n\n |
12 | \nKARL | \nBERRY | \n2006-02-15 04:34:33 | \n\n |
13 | \nUMA | \nWOOD | \n2006-02-15 04:34:33 | \n\n |
14 | \nVIVIEN | \nBERGEN | \n2006-02-15 04:34:33 | \n\n |
15 | \nCUBA | \nOLIVIER | \n2006-02-15 04:34:33 | \n\n |
16 | \nFRED | \nCOSTNER | \n2012-03-13 12:14:54 | \n22 | \n
17 | \nHELEN | \nVOIGHT | \n2012-03-13 12:14:54 | \n22 | \n
18 | \nDAN | \nTORN | \n2012-03-13 12:14:54 | \n22 | \n
19 | \nBOB | \nFAWCETT | \n2012-03-13 12:14:54 | \n22 | \n
20 | \nLUCILLE | \nTRACY | \n2012-03-13 12:14:54 | \n22 | \n
21 | \nKIRSTEN | \nPALTROW | \n2012-03-13 12:14:54 | \n22 | \n
22 | \nELVIS | \nMARX | \n2012-03-13 12:14:54 | \n22 | \n
23 | \nSANDRA | \nKILMER | \n2012-03-13 12:14:54 | \n22 | \n
24 | \nCAMERON | \nSTREEP | \n2012-03-13 12:14:54 | \n22 | \n
25 | \nKEVIN | \nBLOOM | \n2012-03-13 12:14:54 | \n22 | \n
26 | \nRIP | \nCRAWFORD | \n2012-03-13 12:14:54 | \n22 | \n
27 | \nJULIA | \nMCQUEEN | \n2012-03-13 12:14:54 | \n22 | \n
28 | \nWOODY | \nHOFFMAN | \n2012-03-13 12:14:54 | \n22 | \n
29 | \nALEC | \nWAYNE | \n2012-03-13 12:14:54 | \n22 | \n
30 | \nSANDRA | \nPECK | \n2012-03-13 12:14:54 | \n22 | \n
31 | \nSISSY | \nSOBIESKI | \n2012-03-13 12:14:54 | \n22 | \n
32 | \nTIM | \nHACKMAN | \n2012-03-13 12:14:54 | \n22 | \n
33 | \nMILLA | \nPECK | \n2012-03-13 12:14:54 | \n22 | \n
34 | \nAUDREY | \nOLIVIER | \n2012-03-13 12:14:54 | \n22 | \n
35 | \nJUDY | \nDEAN | \n2012-03-13 12:14:54 | \n22 | \n
36 | \nBURT | \nDUKAKIS | \n2012-03-13 12:14:54 | \n22 | \n
37 | \nVAL | \nBOLGER | \n2012-03-13 12:14:54 | \n22 | \n
38 | \nTOM | \nMCKELLEN | \n2012-03-13 12:14:54 | \n22 | \n
39 | \nGOLDIE | \nBRODY | \n2012-03-13 12:14:54 | \n22 | \n
40 | \nJOHNNY | \nCAGE | \n2012-03-13 12:14:54 | \n22 | \n
41 | \nJODIE | \nDEGENERES | \n2012-03-13 12:14:54 | \n22 | \n
42 | \nTOM | \nMIRANDA | \n2012-03-13 12:14:54 | \n22 | \n
43 | \nKIRK | \nJOVOVICH | \n2012-03-13 12:14:54 | \n22 | \n
44 | \nNICK | \nSTALLONE | \n2012-03-13 12:14:54 | \n22 | \n
45 | \nREESE | \nKILMER | \n2012-03-13 12:14:54 | \n22 | \n
46 | \nPARKER | \nGOLDBERG | \n2012-03-13 12:14:54 | \n22 | \n
47 | \nJULIA | \nBARRYMORE | \n2012-03-13 12:14:54 | \n22 | \n
48 | \nFRANCES | \nDAY-LEWIS | \n2012-03-13 12:14:54 | \n22 | \n
49 | \nANNE | \nCRONYN | \n2012-03-13 12:14:54 | \n22 | \n
50 | \nNATALIE | \nHOPKINS | \n2012-03-13 12:14:54 | \n22 | \n
51 | \nGARY | \nPHOENIX | \n2012-03-13 12:14:54 | \n22 | \n
52 | \nCARMEN | \nHUNT | \n2012-03-13 12:14:54 | \n22 | \n
53 | \nMENA | \nTEMPLE | \n2012-03-13 12:14:54 | \n22 | \n
54 | \nPENELOPE | \nPINKETT | \n2012-03-13 12:14:54 | \n22 | \n
55 | \nFAY | \nKILMER | \n2012-03-13 12:14:54 | \n22 | \n
56 | \nDAN | \nHARRIS | \n2012-03-13 12:14:54 | \n22 | \n
57 | \nJUDE | \nCRUISE | \n2012-03-13 12:14:54 | \n22 | \n
58 | \nCHRISTIAN | \nAKROYD | \n2012-03-13 12:14:54 | \n22 | \n
59 | \nDUSTIN | \nTAUTOU | \n2012-03-13 12:14:54 | \n22 | \n
60 | \nHENRY | \nBERRY | \n2012-03-13 12:14:54 | \n22 | \n
61 | \nCHRISTIAN | \nNEESON | \n2012-03-13 12:14:54 | \n22 | \n
62 | \nJAYNE | \nNEESON | \n2012-03-13 12:14:54 | \n22 | \n
63 | \nCAMERON | \nWRAY | \n2012-03-13 12:14:54 | \n22 | \n
64 | \nRAY | \nJOHANSSON | \n2012-03-13 12:14:54 | \n22 | \n
65 | \nANGELA | \nHUDSON | \n2012-03-13 12:14:54 | \n22 | \n
66 | \nMARY | \nTANDY | \n2012-03-13 12:14:54 | \n22 | \n
67 | \nJESSICA | \nBAILEY | \n2012-03-13 12:14:54 | \n22 | \n
68 | \nRIP | \nWINSLET | \n2012-03-13 12:14:54 | \n22 | \n
69 | \nKENNETH | \nPALTROW | \n2012-03-13 12:14:54 | \n22 | \n
70 | \nMICHELLE | \nMCCONAUGHEY | \n2012-03-13 12:14:54 | \n22 | \n
71 | \nADAM | \nGRANT | \n2012-03-13 12:14:54 | \n22 | \n
72 | \nSEAN | \nWILLIAMS | \n2012-03-13 12:14:54 | \n22 | \n
73 | \nGARY | \nPENN | \n2012-03-13 12:14:54 | \n22 | \n
74 | \nMILLA | \nKEITEL | \n2012-03-13 12:14:54 | \n22 | \n
75 | \nBURT | \nPOSEY | \n2012-03-13 12:14:54 | \n22 | \n
76 | \nANGELINA | \nASTAIRE | \n2012-03-13 12:14:54 | \n22 | \n
77 | \nCARY | \nMCCONAUGHEY | \n2012-03-13 12:14:54 | \n22 | \n
78 | \nGROUCHO | \nSINATRA | \n2012-03-13 12:14:54 | \n22 | \n
79 | \nMAE | \nHOFFMAN | \n2012-03-13 12:14:54 | \n22 | \n
80 | \nRALPH | \nCRUZ | \n2012-03-13 12:14:54 | \n22 | \n
81 | \nSCARLETT | \nDAMON | \n2012-03-13 12:14:54 | \n22 | \n
82 | \nWOODY | \nJOLIE | \n2012-03-13 12:14:54 | \n22 | \n
83 | \nBEN | \nWILLIS | \n2012-03-13 12:14:54 | \n22 | \n
84 | \nJAMES | \nPITT | \n2012-03-13 12:14:54 | \n22 | \n
85 | \nMINNIE | \nZELLWEGER | \n2012-03-13 12:14:54 | \n22 | \n
86 | \nGREG | \nCHAPLIN | \n2012-03-13 12:14:54 | \n22 | \n
87 | \nSPENCER | \nPECK | \n2012-03-13 12:14:54 | \n22 | \n
88 | \nKENNETH | \nPESCI | \n2012-03-13 12:14:54 | \n22 | \n
89 | \nCHARLIZE | \nDENCH | \n2012-03-13 12:14:54 | \n22 | \n
90 | \nSEAN | \nGUINESS | \n2012-03-13 12:14:54 | \n22 | \n
91 | \nCHRISTOPHER | \nBERRY | \n2012-03-13 12:14:54 | \n22 | \n
92 | \nKIRSTEN | \nAKROYD | \n2012-03-13 12:14:54 | \n22 | \n
93 | \nELLEN | \nPRESLEY | \n2012-03-13 12:14:54 | \n22 | \n
94 | \nKENNETH | \nTORN | \n2012-03-13 12:14:54 | \n22 | \n
95 | \nDARYL | \nWAHLBERG | \n2012-03-13 12:14:54 | \n22 | \n
96 | \nGENE | \nWILLIS | \n2012-03-13 12:14:54 | \n22 | \n
97 | \nMEG | \nHAWKE | \n2012-03-13 12:14:54 | \n22 | \n
98 | \nCHRIS | \nBRIDGES | \n2012-03-13 12:14:54 | \n22 | \n
99 | \nJIM | \nMOSTEL | \n2012-03-13 12:14:54 | \n22 | \n
100 | \nSPENCER | \nDEPP | \n2012-03-13 12:14:54 | \n22 | \n
101 | \nSUSAN | \nDAVIS | \n2012-03-13 12:14:54 | \n22 | \n
102 | \nWALTER | \nTORN | \n2012-03-13 12:14:54 | \n22 | \n
103 | \nMATTHEW | \nLEIGH | \n2012-03-13 12:14:54 | \n22 | \n
104 | \nPENELOPE | \nCRONYN | \n2012-03-13 12:14:54 | \n22 | \n
105 | \nSIDNEY | \nCROWE | \n2012-03-13 12:14:54 | \n22 | \n
106 | \nGROUCHO | \nDUNST | \n2012-03-13 12:14:54 | \n22 | \n
107 | \nGINA | \nDEGENERES | \n2012-03-13 12:14:54 | \n22 | \n
108 | \nWARREN | \nNOLTE | \n2012-03-13 12:14:54 | \n22 | \n
109 | \nSYLVESTER | \nDERN | \n2012-03-13 12:14:54 | \n22 | \n
110 | \nSUSAN | \nDAVIS | \n2012-03-13 12:14:54 | \n22 | \n
111 | \nCAMERON | \nZELLWEGER | \n2012-03-13 12:14:54 | \n22 | \n
112 | \nRUSSELL | \nBACALL | \n2012-03-13 12:14:54 | \n22 | \n
113 | \nMORGAN | \nHOPKINS | \n2012-03-13 12:14:54 | \n22 | \n
114 | \nMORGAN | \nMCDORMAND | \n2012-03-13 12:14:54 | \n22 | \n
115 | \nHARRISON | \nBALE | \n2012-03-13 12:14:54 | \n22 | \n
116 | \nDAN | \nSTREEP | \n2012-03-13 12:14:54 | \n22 | \n
117 | \nRENEE | \nTRACY | \n2012-03-13 12:14:54 | \n22 | \n
118 | \nCUBA | \nALLEN | \n2012-03-13 12:14:54 | \n22 | \n
119 | \nWARREN | \nJACKMAN | \n2012-03-13 12:14:54 | \n22 | \n
120 | \nPENELOPE | \nMONROE | \n2012-03-13 12:14:54 | \n22 | \n
121 | \nLIZA | \nBERGMAN | \n2012-03-13 12:14:54 | \n22 | \n
122 | \nSALMA | \nNOLTE | \n2012-03-13 12:14:54 | \n22 | \n
123 | \nJULIANNE | \nDENCH | \n2012-03-13 12:14:54 | \n22 | \n
124 | \nSCARLETT | \nBENING | \n2012-03-13 12:14:54 | \n22 | \n
125 | \nALBERT | \nNOLTE | \n2012-03-13 12:14:54 | \n22 | \n
126 | \nFRANCES | \nTOMEI | \n2012-03-13 12:14:54 | \n22 | \n
127 | \nKEVIN | \nGARLAND | \n2012-03-13 12:14:54 | \n22 | \n
128 | \nCATE | \nMCQUEEN | \n2012-03-13 12:14:54 | \n22 | \n
129 | \nDARYL | \nCRAWFORD | \n2012-03-13 12:14:54 | \n22 | \n
130 | \nGRETA | \nKEITEL | \n2012-03-13 12:14:54 | \n22 | \n
131 | \nJANE | \nJACKMAN | \n2012-03-13 12:14:54 | \n22 | \n
132 | \nADAM | \nHOPPER | \n2012-03-13 12:14:54 | \n22 | \n
133 | \nRICHARD | \nPENN | \n2012-03-13 12:14:54 | \n22 | \n
134 | \nGENE | \nHOPKINS | \n2012-03-13 12:14:54 | \n22 | \n
135 | \nRITA | \nREYNOLDS | \n2012-03-13 12:14:54 | \n22 | \n
136 | \nED | \nMANSFIELD | \n2012-03-13 12:14:54 | \n22 | \n
137 | \nMORGAN | \nWILLIAMS | \n2012-03-13 12:14:54 | \n22 | \n
138 | \nLUCILLE | \nDEE | \n2012-03-13 12:14:54 | \n22 | \n
139 | \nEWAN | \nGOODING | \n2012-03-13 12:14:54 | \n22 | \n
140 | \nWHOOPI | \nHURT | \n2012-03-13 12:14:54 | \n22 | \n
141 | \nCATE | \nHARRIS | \n2012-03-13 12:14:54 | \n22 | \n
142 | \nJADA | \nRYDER | \n2012-03-13 12:14:54 | \n22 | \n
143 | \nRIVER | \nDEAN | \n2012-03-13 12:14:54 | \n22 | \n
144 | \nANGELA | \nWITHERSPOON | \n2012-03-13 12:14:54 | \n22 | \n
145 | \nKIM | \nALLEN | \n2012-03-13 12:14:54 | \n22 | \n
146 | \nALBERT | \nJOHANSSON | \n2012-03-13 12:14:54 | \n22 | \n
147 | \nFAY | \nWINSLET | \n2012-03-13 12:14:54 | \n22 | \n
148 | \nEMILY | \nDEE | \n2012-03-13 12:14:54 | \n22 | \n
149 | \nRUSSELL | \nTEMPLE | \n2012-03-13 12:14:54 | \n22 | \n
150 | \nJAYNE | \nNOLTE | \n2012-03-13 12:14:54 | \n22 | \n
151 | \nGEOFFREY | \nHESTON | \n2012-03-13 12:14:54 | \n22 | \n
152 | \nBEN | \nHARRIS | \n2012-03-13 12:14:54 | \n22 | \n
153 | \nMINNIE | \nKILMER | \n2012-03-13 12:14:54 | \n22 | \n
154 | \nMERYL | \nGIBSON | \n2012-03-13 12:14:54 | \n22 | \n
155 | \nIAN | \nTANDY | \n2012-03-13 12:14:54 | \n22 | \n
156 | \nFAY | \nWOOD | \n2012-03-13 12:14:54 | \n22 | \n
157 | \nGRETA | \nMALDEN | \n2012-03-13 12:14:54 | \n22 | \n
158 | \nVIVIEN | \nBASINGER | \n2012-03-13 12:14:54 | \n22 | \n
159 | \nLAURA | \nBRODY | \n2012-03-13 12:14:54 | \n22 | \n
160 | \nCHRIS | \nDEPP | \n2012-03-13 12:14:54 | \n22 | \n
161 | \nHARVEY | \nHOPE | \n2012-03-13 12:14:54 | \n22 | \n
162 | \nOPRAH | \nKILMER | \n2012-03-13 12:14:54 | \n22 | \n
163 | \nCHRISTOPHER | \nWEST | \n2012-03-13 12:14:54 | \n22 | \n
164 | \nHUMPHREY | \nWILLIS | \n2012-03-13 12:14:54 | \n22 | \n
165 | \nAL | \nGARLAND | \n2012-03-13 12:14:54 | \n22 | \n
166 | \nNICK | \nDEGENERES | \n2012-03-13 12:14:54 | \n22 | \n
167 | \nLAURENCE | \nBULLOCK | \n2012-03-13 12:14:54 | \n22 | \n
168 | \nWILL | \nWILSON | \n2012-03-13 12:14:54 | \n22 | \n
169 | \nKENNETH | \nHOFFMAN | \n2012-03-13 12:14:54 | \n22 | \n
170 | \nMENA | \nHOPPER | \n2012-03-13 12:14:54 | \n22 | \n
171 | \nOLYMPIA | \nPFEIFFER | \n2012-03-13 12:14:54 | \n22 | \n
172 | \nGROUCHO | \nWILLIAMS | \n2012-03-13 12:14:54 | \n22 | \n
173 | \nALAN | \nDREYFUSS | \n2012-03-13 12:14:54 | \n22 | \n
174 | \nMICHAEL | \nBENING | \n2012-03-13 12:14:54 | \n22 | \n
175 | \nWILLIAM | \nHACKMAN | \n2012-03-13 12:14:54 | \n22 | \n
176 | \nJON | \nCHASE | \n2012-03-13 12:14:54 | \n22 | \n
177 | \nGENE | \nMCKELLEN | \n2012-03-13 12:14:54 | \n22 | \n
178 | \nLISA | \nMONROE | \n2012-03-13 12:14:54 | \n22 | \n
179 | \nED | \nGUINESS | \n2012-03-13 12:14:54 | \n22 | \n
180 | \nJEFF | \nSILVERSTONE | \n2012-03-13 12:14:54 | \n22 | \n
181 | \nMATTHEW | \nCARREY | \n2012-03-13 12:14:54 | \n22 | \n
182 | \nDEBBIE | \nAKROYD | \n2012-03-13 12:14:54 | \n22 | \n
183 | \nRUSSELL | \nCLOSE | \n2012-03-13 12:14:54 | \n22 | \n
184 | \nHUMPHREY | \nGARLAND | \n2012-03-13 12:14:54 | \n22 | \n
185 | \nMICHAEL | \nBOLGER | \n2012-03-13 12:14:54 | \n22 | \n
186 | \nJULIA | \nZELLWEGER | \n2012-03-13 12:14:54 | \n22 | \n
187 | \nRENEE | \nBALL | \n2012-03-13 12:14:54 | \n22 | \n
188 | \nROCK | \nDUKAKIS | \n2012-03-13 12:14:54 | \n22 | \n
189 | \nCUBA | \nBIRCH | \n2012-03-13 12:14:54 | \n22 | \n
190 | \nAUDREY | \nBAILEY | \n2012-03-13 12:14:54 | \n22 | \n
191 | \nGREGORY | \nGOODING | \n2012-03-13 12:14:54 | \n22 | \n
192 | \nJOHN | \nSUVARI | \n2012-03-13 12:14:54 | \n22 | \n
193 | \nBURT | \nTEMPLE | \n2012-03-13 12:14:54 | \n22 | \n
194 | \nMERYL | \nALLEN | \n2012-03-13 12:14:54 | \n22 | \n
195 | \nJAYNE | \nSILVERSTONE | \n2012-03-13 12:14:54 | \n22 | \n
196 | \nBELA | \nWALKEN | \n2012-03-13 12:14:54 | \n22 | \n
197 | \nREESE | \nWEST | \n2012-03-13 12:14:54 | \n22 | \n
198 | \nMARY | \nKEITEL | \n2012-03-13 12:14:54 | \n22 | \n
199 | \nJULIA | \nFAWCETT | \n2012-03-13 12:14:54 | \n22 | \n
200 | \nTHORA | \nTEMPLE | \n2012-03-13 12:14:54 | \n22 | \n
412 | \n-1 OR 1=1 | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
413 | \n-1 OR 1=1 | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
414 | \nNS1NO | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
415 | \n1 AND 'NS='ss | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
416 | \n' OR 'ns'='ns | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
417 | \n-1 OR 17-7=10 | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
418 | \n1 OR X='ss | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
419 | \n' OR '1'='1 | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
420 | \n' OR '1'='1 | \ntest | \n2012-03-13 12:14:54 | \n22 | \n
Netsparker Enterprise identified a version disclosure (Apache) in the target web server's HTTP response.
\nThis information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.
", + "ExploitationSkills": "", + "ExternalReferences": "", + "ExtraInformation": [ + { + "Name": "Page Type", + "Value": "Other" + }, + { + "Name": "Extracted Version", + "Value": "2.2.8" + } + ], + "FirstSeenDate": "15/06/2021 01:44 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "fbb65b68-873e-4fff-871d-ad48024dd60f", + "Impact": "SERVER
header of its HTTP response.Netsparker Enterprise identified a version disclosure (PHP) in target web server's HTTP response.
\nThis information can help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.
", + "ExploitationSkills": "", + "ExternalReferences": "", + "ExtraInformation": [ + { + "Name": "Page Type", + "Value": "Other" + }, + { + "Name": "Extracted Version", + "Value": "5.2.6" + } + ], + "FirstSeenDate": "15/06/2021 01:44 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "d765b64b-8f6a-4343-872d-ad48024dd723", + "Impact": "SERVER
header of its HTTP response.Netsparker Enterprise detected backup source code on your web server.
<?php\nrequire("auth.php");\nini_set("display_errors","0");\n\n//global configuration area\n$globals["title"] = "Netsparker Test Web Site - PHP";\nfunction EndsWith($FullStr, $EndStr)\n{\n // Get the length of the end string\n $StrLen = strlen($EndStr);\n // Look at the end of FullStr for the substring the size of EndStr\n $FullStrEnd = substr($FullStr, strlen($FullStr) - $StrLen);\n // If it matches, it does end with EndStr\n return $FullStrEnd == $EndStr;\n}\n?>\n…\n<?php include "Internals/header.php"?>\n…\n<?php include "Internals/upmenu.php"?>\n…\n<?php\n $file = $_REQUEST["file"];\n if(EndsWith($file,".nsp"))\n include $_REQUEST["file"];\n ?>\n…\n<?php include "Internals/footer.php"?>", + "ExploitationSkills": "