2

I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea how to check to see if it's a false positive. What should I look at for a timeout attack from ZAP? Are there any HTML tags or DOM things I should check?

Request:

POST https://www.example./ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0;)
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 195
Referer: https://www.example.com/run timeout /T 5
X-ZAP-Scan-ID: 90020
Host: www.example.com

username=foo-bar%40example.com&password=ZAP&screenSize=desktop&interface=ajax&hasPushState=0&sessionKey=33dd6c741affafeef106ede200e510a7c0ba8e00a630398d3271649db0878cdcf1e7cc7fbd77c30d&remember=1

Response:

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 26 Jan 2016 06:02:06 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 34075
Connection: close
X-Request-Id: web3-3017604-1453788125-73
Set-Cookie: s_=1%3Bnyi%3Bnyi%3B4897e65805da04c0f9c6208c1ef21967%3B1453788126%3B89609bbbece2c72f5cc2e6a4acea1c2944c3deb6; path=/; domain=www.example.com; secure; HttpOnly
X-Backend: web3
X-Frame-Options: SAMEORIGIN
X-Frontend: frontend2
X-UA-Compatible: IE=edge,chrome=1
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://api.pin.net.au https://api.stripe.com https://tag.perfectaudience.com; frame-src *; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src data: https://fonts.gstatic.com; img-src * data: blob:; media-src 'none'; object-src 'none'
1
  • 1
    A time based attack affects the time the page takes to load. What happens if you change the 5 for a different value to the time the page takes to load? If it changes significantly, it's probably vulnerable.
    – Matthew
    Jan 26, 2016 at 16:20

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.