Category
False Positive | False Negative
Describe the bug
The requests library which this project uses has some strange behaviours, which leads to the POST attack (-a 4) not working correctly.
The issue:
When you use a data dictionary for the POST request, requests percent-encodes the POST data. This leads that more complex evasion payloads fail, even if they should work. Also, the output of the scanner will be wrong. Let's say the server is vulnerable to ..%252f. Then, when Vailyn scans for ..%2f, it is detected as vulnerable, since requests transforms it into %252f. However, ..%2f will be shown as successful, while the real %252f test won't be.
There have been several ways to fix that in the past - none of them worked in this case.
The first way I have tried to fix it is using prepared requests, and manually setting the body afterwards. The second way was that I used a string for the data argument, instead of a dict. However, both tries resulted in the scanner finding nothing at all, despite a vulnerability being present.
If anyone reading this knows a fix: I'd really appreciate your help!
To Reproduce
Steps to reproduce the behaviour:
- Set up a server with a path traversal vulnerability coming from a POST parameter.
- Run Vailyn against this server.
Expected behaviour
Vailyn should output the vulnerability, and the correct payload.
Desktop (please complete the following information):
- OS: [e.g. Windows, Linux] probably all
- Program Version [e.g. 1.0] <= latest
- Python Version [e.g. 3.7] 3.8
- Requests Version: 2.24.0