1

I tried scanning my web application built with AngularJS front-end and PHP backend. But scanning with scanners like Nessus and Websecurify fails due to '#' in URL. My URL has format

http://domain.com/webapp/index.php/base#controller/function

When I checked apache access log, I found that scanners discard URL portion after '#'. So it always scans for http://domain.com/webapp/index.php/base.

How can I solve this issue?

Improve this question
3
  • have you tried looking for a vulnerability scanner that supports # in the URL. so far, it seems like a limitation with the scanners used( or maybe there is an option in the Scanner to ignore the # symbol).
    – JOW
    Dec 23, 2015 at 7:13
  • 1
    Yes. But I haven't found any scanners support '#' or single window web apps like AngularJS. Also I don't want to discard the '#'. It will show page not found error if I do that.
    – Harikrishnan
    Dec 23, 2015 at 7:21
  • This is one of those occasions where resorting to a human to do security testing is the easy solution! Nessus isn't really a web application scanner primarily - it is a general purpose scanner, which really excels at network and server level issues, and is a bit hit and miss with web application specific ones.
    – Matthew
    Dec 23, 2015 at 8:53

1 Answer 1

Reset to default
1

Browsers don't submit anything after the hash character to the server. Anything after that character can only be access on the client side with JavaScript. Some vulnerability scanners (like burp suite) perform a static code analysis to see if the application is vulnerable to DOM-based cross-site scripting, for example. They generally don't execute JavaScript, so the typical scanning methods don't apply here.

Also see: https://en.wikipedia.org/wiki/Fragment_identifier

The fragment identifier functions differently than the rest of the URI: namely, its processing is exclusively client-side with no participation from the web server — of course the server typically helps to determine the MIME type, and the MIME type determines the processing of fragments. When an agent (such as a Web browser) requests a web resource from a Web server, the agent sends the URI to the server, but does not send the fragment. Instead, the agent waits for the server to send the resource, and then the agent processes the resource according to the document type and fragment value.[2]

So your options are to manually fuzz the parameters after the hash character in the browser or read the JavaScript source code.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.