{"id":88992,"date":"2020-07-17T07:42:02","date_gmt":"2020-07-17T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami"},"modified":"2020-07-17T07:42:02","modified_gmt":"2020-07-17T05:42:02","slug":"wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","title":{"rendered":"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/c52b58a326ba424d73a93614818c82f5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nA m\u00faltban <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/news\/t\/507776\/\">a Spotify d\u00f6nt\u00e9shozatali m\u00f3dszertan\u00e1r\u00f3l. Egyre t\u00f6bb felhaszn\u00e1l\u00f3 prefer\u00e1lja a zenehallgat\u00e1st mobilon a streaming szolg\u00e1ltat\u00e1sban, de a c\u00e9gn\u00e9l t\u00falnyom\u00f3r\u00e9szt webprogramoz\u00f3k dolgoznak. A Spotify elemezte ezt a helyzetet, \u00e9s \u00fagy d\u00f6nt\u00f6tt, hogy t\u00f6bb mobilfejleszt\u0151t vesz fel, valamint \u00e1tnevezi a webes szakembereket \u00faj ir\u00e1nyba:<\/a><\/noindex> besz\u00e9lt\u00fcnk a <strong>Nemesida WAF Free<\/strong> \u2014 ingyenes eszk\u00f6z a weboldalak \u00e9s API-k v\u00e9delm\u00e9re a hekkert\u00e1mad\u00e1sok ellen, \u00e9s ebben a cikkben a n\u00e9pszer\u0171 sebezhet\u0151s\u00e9gi szkenner \u00e1ttekint\u00e9s\u00e9t szerett\u00fck volna bemutatni <noindex><a rel=\"nofollow\" href=\"https:\/\/wapiti.sourceforge.io\/\">Wapiti<\/a><\/noindex>.<\/p>\n<p><\/p>\n<p>A weboldal sebezhet\u0151s\u00e9g\u00e9nek vizsg\u00e1lata sz\u00fcks\u00e9ges l\u00e9p\u00e9s, amely, a forr\u00e1sk\u00f3d elemz\u00e9s\u00e9vel egy\u00fctt, lehet\u0151v\u00e9 teszi annak v\u00e9delmi szintj\u00e9nek \u00e9rt\u00e9kel\u00e9s\u00e9t a kompromitt\u00e1l\u00f3d\u00e1s ellen. A webes er\u0151forr\u00e1sok szkennel\u00e9s\u00e9t szakspecifikus eszk\u00f6zk\u00e9szlettel v\u00e9gezhetj\u00fck.<\/p>\n<p><\/p>\n<p>A Nikto, W3af (Python 2.7-ben \u00edr\u00f3dott, amelynek t\u00e1mogat\u00e1sa megsz\u0171nt) vagy az Arachni (febru\u00e1rt\u00f3l m\u00e1r nem t\u00e1mogatott) \u2014 a legn\u00e9pszer\u0171bb megold\u00e1sok, amelyek a szabad szegmensben el\u00e9rhet\u0151k. Term\u00e9szetesen vannak m\u00e1sok is, p\u00e9ld\u00e1ul a Wapiti, amellyel mi foglalkozunk.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3 id=\"wapiti-rabotaet-so-sleduyuschimi-tipami-uyazvimostey\">A Wapiti a k\u00f6vetkez\u0151 sebezhet\u0151s\u00e9gi t\u00edpusokkal dolgozik:<\/h3>\n<p><\/p>\n<ul>\n<li>f\u00e1jlok nyilv\u00e1noss\u00e1gra hozatala (helyi \u00e9s t\u00e1voli, fopen, readfile);<\/li>\n<li>befecskendez\u00e9sek (PHP \/ JSP \/ ASP \/ SQL-injekci\u00f3k \u00e9s XPath-befecskendez\u00e9sek);<\/li>\n<li>XSS (cross-site scripting) (visszaver\u0151d\u0151 \u00e9s tart\u00f3s);<\/li>\n<li>parancsok felfedez\u00e9se \u00e9s v\u00e9grehajt\u00e1s (eval (), system (), passtru ());<\/li>\n<li>CRLF-befecskendez\u00e9sek (HTTP v\u00e1laszok elv\u00e1laszt\u00e1sa, munkamenet r\u00f6gz\u00edt\u00e9se);<\/li>\n<li>XXE (XML k\u00fcls\u0151 entit\u00e1s) behatol\u00e1s;<\/li>\n<li>SSRF (szerveroldali k\u00e9r\u00e9s hamis\u00edt\u00e1sa);<\/li>\n<li>ismertek potenci\u00e1lisan vesz\u00e9lyes f\u00e1jlok haszn\u00e1lata (Nikto adatb\u00e1zis \u00e1ltal);<\/li>\n<li>gyenge .htaccess konfigur\u00e1ci\u00f3k, amelyeket meg lehet ker\u00fclni;<\/li>\n<li>bizalmas inform\u00e1ci\u00f3k nyilv\u00e1noss\u00e1gra hozatala (forr\u00e1sk\u00f3d felfed\u00e9se) biztons\u00e1gi ment\u00e9si f\u00e1jlok jelenl\u00e9te;<\/li>\n<li>Shellshock;<\/li>\n<li>nyitott \u00e1tir\u00e1ny\u00edt\u00e1sok;<\/li>\n<li>nem szabv\u00e1nyos HTTP m\u00f3dszerek, amelyeket enged\u00e9lyezhetnek (PUT).<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"vozmozhnosti\">Lehet\u0151s\u00e9gek:<\/h4>\n<p><\/p>\n<ul>\n<li>HTTP, HTTPS \u00e9s SOCKS5 proxy t\u00e1mogat\u00e1s;<\/li>\n<li>t\u00f6bb m\u00f3dszerrel val\u00f3 hiteles\u00edt\u00e9s: Basic, Digest, Kerberos vagy NTLM;<\/li>\n<li>lehet\u0151s\u00e9g a szkennel\u00e9si ter\u00fclet korl\u00e1toz\u00e1s\u00e1ra (domain, mappa, oldal, URL);<\/li>\n<li>egyetlen param\u00e9ter automatikus elt\u00e1vol\u00edt\u00e1sa az URL-b\u0151l;<\/li>\n<li>t\u00f6bb \u00f3vint\u00e9zked\u00e9s a v\u00e9gtelen szkennel\u00e9si ciklusok ellen (p\u00e9lda: ifor, \u00e9rt\u00e9kek korl\u00e1toz\u00e1sa a param\u00e9terre);<\/li>\n<li>lehet\u0151s\u00e9g az URL-c\u00edmek kutat\u00e1s\u00e1nak priorit\u00e1s\u00e1nak be\u00e1ll\u00edt\u00e1s\u00e1ra (m\u00e9g ha nem is a szkennel\u00e9si ter\u00fcleten tal\u00e1lhat\u00f3k);<\/li>\n<li>lehet\u0151s\u00e9g bizonyos URL-c\u00edmek kiz\u00e1r\u00e1s\u00e1ra a szkennel\u00e9sb\u0151l \u00e9s t\u00e1mad\u00e1sokb\u00f3l (p\u00e9ld\u00e1ul: logout URL);<\/li>\n<li>cookie f\u00e1jlok import\u00e1l\u00e1sa (megszerz\u00e9s\u00fck a wapiti-getcookie eszk\u00f6zzel);<\/li>\n<li>SSL tan\u00fas\u00edtv\u00e1nyok ellen\u0151rz\u00e9s\u00e9nek aktiv\u00e1l\u00e1s\u00e1nak\/deaktiv\u00e1l\u00e1s\u00e1nak lehet\u0151s\u00e9ge;<\/li>\n<li>lehet\u0151s\u00e9g URL-ek kinyer\u00e9s\u00e9re JavaScript-b\u0151l (nagyon egyszer\u0171 JS \u00e9rtelmez\u0151);<\/li>\n<li>HTML5-tel val\u00f3 interakci\u00f3;<\/li>\n<li>t\u00f6bb lehet\u0151s\u00e9g a crawler viselked\u00e9s\u00e9nek \u00e9s korl\u00e1toz\u00e1sainak kezel\u00e9s\u00e9re;<\/li>\n<li>a beolvas\u00e1si folyamat maxim\u00e1lis idej\u00e9nek be\u00e1ll\u00edt\u00e1sa;<\/li>\n<li>bizonyos testreszabhat\u00f3 HTTP-fejl\u00e9cek hozz\u00e1ad\u00e1sa vagy egyedi User-Agent be\u00e1ll\u00edt\u00e1sa.<\/li>\n<\/ul>\n<p><\/p>\n<h4 id=\"dopolnitelnye-vozmozhnosti\">Tov\u00e1bbi lehet\u0151s\u00e9gek:<\/h4>\n<p><\/p>\n<ul>\n<li>biztons\u00e1gi jelent\u00e9sek l\u00e9trehoz\u00e1sa k\u00fcl\u00f6nb\u00f6z\u0151 form\u00e1tumokban (HTML, XML, JSON, TXT);<\/li>\n<li>a beolvas\u00e1s vagy t\u00e1mad\u00e1s felf\u00fcggeszt\u00e9se \u00e9s folytat\u00e1sa (sesszi\u00f3kezel\u00e9s SQLite3 adatb\u00e1zis haszn\u00e1lat\u00e1val);<\/li>\n<li>termin\u00e1lbeli kiemel\u00e9s a sebezhet\u0151s\u00e9g kiemel\u00e9s\u00e9re;<\/li>\n<li>k\u00fcl\u00f6nb\u00f6z\u0151 napl\u00f3z\u00e1si szintek;<\/li>\n<li>gyors \u00e9s egyszer\u0171 m\u00f3dja a t\u00e1mad\u00f3 modulok aktiv\u00e1l\u00e1s\u00e1nak \/ deaktiv\u00e1l\u00e1s\u00e1nak.<\/li>\n<\/ul>\n<p><\/p>\n<h3 id=\"ustanovka\">Telep\u00edt\u00e9s<\/h3>\n<p><\/p>\n<p>A Wapiti aktu\u00e1lis verzi\u00f3j\u00e1t 2 m\u00f3dszerrel lehet telep\u00edteni:<\/p>\n<p><\/p>\n<ul>\n<li>let\u00f6lteni a forr\u00e1st a hivatalos oldalr\u00f3l <noindex><a rel=\"nofollow\" href=\"https:\/\/wapiti.sourceforge.io\/\">weboldalr\u00f3l<\/a><\/noindex> \u00e9s futtatni a telep\u00edt\u0151 scriptet a Python3 el\u0151zetes telep\u00edt\u00e9se ut\u00e1n;<\/li>\n<li>a pip3 install wapiti3 paranccsal.<\/li>\n<\/ul>\n<p><\/p>\n<p>Ezt k\u00f6vet\u0151en a Wapiti k\u00e9szen \u00e1ll a haszn\u00e1latra.<\/p>\n<p><\/p>\n<h3 id=\"rabota-s-instrumentom\">Munka az eszk\u00f6zzel<\/h3>\n<p><\/p>\n<p>A Wapiti m\u0171k\u00f6d\u00e9s\u00e9nek bemutat\u00e1s\u00e1hoz egy k\u00fcl\u00f6n k\u00e9sz\u00edtett \u00e1llv\u00e1nyt haszn\u00e1lunk, sites.vulns.pentestit.ru (bels\u0151 forr\u00e1s), amely k\u00fcl\u00f6nb\u00f6z\u0151 sebezhet\u0151s\u00e9geket (Injection, XSS, LFI\/RFI) \u00e9s m\u00e1s webalkalmaz\u00e1sok hi\u00e1nyoss\u00e1gait tartalmazza. <\/p>\n<p><\/p>\n<p><strong>Az inform\u00e1ci\u00f3 kiz\u00e1r\u00f3lag t\u00e1j\u00e9koztat\u00e1si c\u00e9lokat szolg\u00e1l. Ne s\u00e9rtsd meg a t\u00f6rv\u00e9nyeket!<\/strong><\/p>\n<p><\/p>\n<p>Az alapvet\u0151 parancs a szkenner ind\u00edt\u00e1s\u00e1hoz:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti -u &lt;target&gt; &lt;options&gt;<\/code><\/pre>\n<p><\/p>\n<p>A szkennernek sz\u00e1mos r\u00e9szletes dokument\u00e1ci\u00f3ja van, rengeteg ind\u00edt\u00e1si opci\u00f3val, p\u00e9ld\u00e1ul:<\/p>\n<p><\/p>\n<p><strong>\u2014terjedelem<\/strong> \u2014 a terjedelem meghat\u00e1roz\u00e1sa<br \/>\nHa a beolvasand\u00f3 URL mellett a scope param\u00e9tert is megadjuk, szab\u00e1lyozhatjuk a weboldal beolvas\u00e1si terjedelm\u00e9t, megadva egyes oldalakat vagy azokat az \u00f6sszes oldalt, amelyet a weboldalon tal\u00e1lni lehet.<\/p>\n<p><\/p>\n<p><strong>-s<\/strong> \u00e9s <strong>-x<\/strong> \u2014 param\u00e9terek egyes URL-c\u00edmek hozz\u00e1ad\u00e1s\u00e1ra vagy elt\u00e1vol\u00edt\u00e1s\u00e1ra. Ezek a param\u00e9terek hasznosak, amikor egy adott URL-c\u00edmet kell hozz\u00e1adni vagy elt\u00e1vol\u00edtani a beolvas\u00e1si folyamatb\u00f3l.<\/p>\n<p><\/p>\n<p><strong>\u2014ugr\u00e1s<\/strong> \u2014 a megadott param\u00e9ter e kulccsal be lesz olvasva, de nem lesz megt\u00e1madva. Hasznos, ha vannak olyan vesz\u00e9lyes param\u00e9terek, amelyeket \u00e9rdemes kiz\u00e1rni a beolvas\u00e1s sor\u00e1n.<\/p>\n<p><\/p>\n<p><strong>\u2014ssl-ellen\u0151rz\u00e9s<\/strong> \u2014 a tan\u00fas\u00edtv\u00e1ny ellen\u0151rz\u00e9s\u00e9nek enged\u00e9lyez\u00e9se vagy letilt\u00e1sa.<br \/>\nA Wapiti szkenner modul\u00e1ris. Azonban egyes modulok ind\u00edt\u00e1s\u00e1hoz, amelyek automatikusan csatlakoznak a szkenner fut\u00e1sa sor\u00e1n, haszn\u00e1lni kell a -m kapcsol\u00f3t \u00e9s felsorolni a sz\u00fcks\u00e9ges modulokat vessz\u0151vel elv\u00e1lasztva. Ha nem haszn\u00e1ljuk a kapcsol\u00f3t, akkor alap\u00e9rtelmez\u00e9s szerint minden modul m\u0171k\u00f6dni fog. A legegyszer\u0171bb form\u00e1ja \u00edgy n\u00e9z ki:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti -u http:\/\/sites.vulns.pentestit.ru\/ -m sql,xss,xxe<\/code><\/pre>\n<p><\/p>\n<p>Ez a haszn\u00e1lati p\u00e9lda azt jelenti, hogy csak az SQL, XSS \u00e9s XXE modulokat fogjuk haszn\u00e1lni a c\u00e9l szkennel\u00e9sekor. Ezen k\u00edv\u00fcl a modulok m\u0171k\u00f6d\u00e9s\u00e9t is sz\u0171rhetj\u00fck a k\u00edv\u00e1nt m\u00f3dszer szerint. P\u00e9ld\u00e1ul <strong>-m \u201cxss: get, blindsql: post, xxe: post\u201d<\/strong>. Ilyen esetben az <strong>xss<\/strong> modul az GET m\u00f3dszerrel tov\u00e1bb\u00edtott lek\u00e9rdez\u00e9sekhez lesz alkalmazva, m\u00edg a <strong>blibdsql<\/strong> modul a POST lek\u00e9rdez\u00e9sekhez stb. Egy\u00e9bk\u00e9nt, ha egy modul, amely szerepel a list\u00e1n, nem volt sz\u00fcks\u00e9ges a szkennel\u00e9s sor\u00e1n, vagy nagyon sok\u00e1ig tart, akkor a Ctrl+C kombin\u00e1ci\u00f3 megnyom\u00e1s\u00e1val \u00e1tugorhatjuk a jelenlegi modul haszn\u00e1lat\u00e1t, kiv\u00e1lasztva a megfelel\u0151 opci\u00f3t az interakt\u00edv men\u00fcben.<\/p>\n<p><\/p>\n<p>A Wapiti t\u00e1mogatja a lek\u00e9rdez\u00e9sek proxy szerveren kereszt\u00fcli tov\u00e1bb\u00edt\u00e1s\u00e1t a <strong>parancsban<\/strong> kulccsal, \u00e9s a c\u00e9l weboldalon val\u00f3 hiteles\u00edt\u00e9st az <strong>-a<\/strong>param\u00e9ter seg\u00edts\u00e9g\u00e9vel. Az autentik\u00e1ci\u00f3 t\u00edpus\u00e1t is megadhatjuk: <strong>Basi\u0441<\/strong>, <strong>Digest<\/strong>, <strong>Kerberos<\/strong> \u00e9s <strong>NTLM<\/strong>. Az utols\u00f3 kett\u0151h\u00f6z tov\u00e1bbi modulok telep\u00edt\u00e9se sz\u00fcks\u00e9ges lehet. Ezenk\u00edv\u00fcl b\u00e1rmilyen fejl\u00e9cet (t\u00f6bbek k\u00f6z\u00f6tt tetsz\u0151leges <strong>User-Agent<\/strong>) is be lehet illeszteni a lek\u00e9rdez\u00e9sekbe, \u00e9s m\u00e9g sok m\u00e1s.<\/p>\n<p><\/p>\n<p>A hiteles\u00edt\u00e9s haszn\u00e1lat\u00e1hoz haszn\u00e1lhatjuk az <strong>wapiti-getcookie<\/strong>eszk\u00f6zt. Ennek seg\u00edts\u00e9g\u00e9vel gener\u00e1ljuk a <strong>cookie<\/strong>, amelyet a Wapiti a szkennel\u00e9s sor\u00e1n haszn\u00e1lni fog. A <strong>cookie<\/strong> gener\u00e1l\u00e1sa a k\u00f6vetkez\u0151 paranccsal t\u00f6rt\u00e9nik:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti-getcookie -u http:\/\/sites.vulns.pentestit.ru\/login.php -c cookie.json<\/code><\/pre>\n<p><\/p>\n<p>Az interakt\u00edv m\u00f3dban a k\u00e9rd\u00e9sekre v\u00e1laszolva megadjuk a sz\u00fcks\u00e9ges inform\u00e1ci\u00f3kat, p\u00e9ld\u00e1ul: felhaszn\u00e1l\u00f3n\u00e9v, jelsz\u00f3 \u00e9s egyebek:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/1f858db74cd11b0837d0aeca890af816.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A kimenet egy JSON form\u00e1tum\u00fa f\u00e1jl lesz. Egy m\u00e1sik lehet\u0151s\u00e9g \u2013 az \u00f6sszes sz\u00fcks\u00e9ges inform\u00e1ci\u00f3t a <strong>-d<\/strong>:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti-getcookie - http:\/\/sites.vulns.pentestit.ru\/login.php -c cookie.json -d &quot;username=admin&amp;password=admin&amp;enter=submit&quot;<\/code><\/pre>\n<p><\/p>\n<p>param\u00e9teren kereszt\u00fcl hozz\u00e1adni.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/87e0923c3027bdda5f1ccf0d4e08a10f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Az eredm\u00e9ny hasonl\u00f3 lesz:<\/p>\n<p><\/p>\n<pre><code class=\"bash\"># wapiti --level 1 -u http:\/\/sites.vulns.pentestit.ru\/ -f html -o \/tmp\/vulns.html -m all --color -\u0441 cookie.json --scope folder --flush-session -A 'Pentestit Scans' -p http:\/\/proxy.office.pentestit.ru:3128<\/code><\/pre>\n<p><\/p>\n<p>A szkenner alapfunkcionalit\u00e1s\u00e1nak vizsg\u00e1latakor a webalkalmaz\u00e1s tesztel\u00e9s\u00e9re ir\u00e1nyul\u00f3 v\u00e9gs\u0151 k\u00e9r\u00e9s a k\u00f6vetkez\u0151 lett:<\/p>\n<p><\/p>\n<p><strong>-f<\/strong> \u00e9s <strong>-o<\/strong> ahol a t\u00f6bbi param\u00e9ter mellett:<\/p>\n<p><\/p>\n<p><strong>-m<\/strong> \u2014 a jelent\u00e9s ment\u00e9s\u00e9nek form\u00e1tuma \u00e9s helye;<\/p>\n<p><\/p>\n<p><strong>\u2014sz\u00edn<\/strong> \u2014color<\/p>\n<p><\/p>\n<p><strong>-c<\/strong> \u2014 megjel\u00f6li a tal\u00e1lt sebezhet\u0151s\u00e9geket azok s\u00falyoss\u00e1ga alapj\u00e1n a Wapiti verzi\u00f3ja szerint; <strong>cookie<\/strong>\u2014 a <strong>wapiti-getcookie<\/strong>; <\/p>\n<p><\/p>\n<p><strong>\u2014terjedelem<\/strong> f\u00e1jl haszn\u00e1lata, amelyet a <strong>folder<\/strong> c\u00e9l kiv\u00e1laszt\u00e1sa az attack\u00e1l\u00e1shoz. Ha a<\/p>\n<p><\/p>\n<p><strong>\u2014szesszi\u00f3-t\u00f6rl\u00e9s<\/strong> \u2014flush-session<\/p>\n<p><\/p>\n<p><strong>-A<\/strong> \u2014 lehet\u0151v\u00e9 teszi az \u00fajraszkennel\u00e9st, amely figyelmen k\u00edv\u00fcl hagyja az el\u0151z\u0151 eredm\u00e9nyeket; <strong>User-Agent<\/strong>;<\/p>\n<p><\/p>\n<p><strong>parancsban<\/strong> \u2014 a proxy server address, if needed.<\/p>\n<p><\/p>\n<h3 id=\"nemnogo-ob-otchete\">A bit about the report<\/h3>\n<p><\/p>\n<p>The scan result is presented in a detailed report format on all identified vulnerabilities in an HTML page, in a clear and understandable manner. The report will specify the categories and number of vulnerabilities found, their description, queries, commands for <strong>curl<\/strong> and advice on how to fix them. For easier navigation, a link will be added in the category titles that will allow you to jump to it:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/39d35304b6f2ea20fd9096e167daabd5.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A significant downside of the report is the absence of a map of the web application, without which it will not be clear whether all addresses and parameters have been analyzed. There is also a likelihood of false positives. In our case, the report features 'backup files' and 'potentially dangerous files'. Their count does not reflect reality, as there were no such files on the server:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/09c6f8945e6fb6dc6de1388f71fc96bb.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Potentially, malfunctioning modules may be corrected over time. Another drawback of the report is the lack of color coding for the identified vulnerabilities (depending on their criticality), or at least their classification into categories. The only way we can indirectly understand the criticality of the identified vulnerability is to use the parameter <strong>\u2014sz\u00edn<\/strong> during the scan, and then the identified vulnerabilities will be color-coded in various colors:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/46f4c34f9215117eeddd96db633e9e3e.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>But in the report itself, such color coding is not provided.<\/p>\n<p><\/p>\n<h3 id=\"uyazvimosti\">Vulnerabilities<\/h3>\n<p><\/p>\n<h4 id=\"sqli\">SQLi<\/h4>\n<p><\/p>\n<p>The scanner partially succeeded in finding SQLi. When searching for SQL vulnerabilities on pages where authentication is not required, there are no issues:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/f9ffef805a115c1a7d47c068a38794bf.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>It was not possible to find vulnerabilities on pages accessible only after authentication, even using valid <strong>cookie<\/strong>, mivel val\u00f3sz\u00edn\u0171, hogy a sikeres hiteles\u00edt\u00e9s ut\u00e1n \"ki fognak l\u00e9pni a szesszi\u00f3b\u00f3l\" \u00e9s <strong>cookie<\/strong> will become invalid. If the deauthorization function were implemented as a separate script responsible for handling this procedure, it could be completely excluded via the -x parameter, thereby preventing its execution. Otherwise, it will not be possible to exclude its processing. This is not a problem of a specific module, but of the tool as a whole, but due to this nuance, multiple injections in the private area of the resource could not be detected.<\/p>\n<p><\/p>\n<h4 id=\"xss\">XSS<\/h4>\n<p><\/p>\n<p>A megadott feladattal a szkenner remek\u00fcl megbirk\u00f3zott, \u00e9s megtal\u00e1lta az \u00f6sszes el\u0151k\u00e9sz\u00edtett sebezhet\u0151s\u00e9get:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/ae43bf1f7d78224a5df5f2ef733f8203.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h4 id=\"lfirfi\">LFI\/RFI<\/h4>\n<p><\/p>\n<p>A szkenner megtal\u00e1lta az \u00f6sszes rejtett sebezhet\u0151s\u00e9get:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Wapiti \u2014 biztons\u00e1gi ellen\u0151rz\u00e9s saj\u00e1t hat\u00e1sk\u00f6rben\" src=\"\/wp-content\/uploads\/2020\/07\/9056c7911237b607a6b12cc2e5a488d3.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>\u00d6sszess\u00e9g\u00e9ben, a hamis riaszt\u00e1sok \u00e9s a sebezhet\u0151s\u00e9gek kihagy\u00e1sa ellen\u00e9re a Wapiti, mint ingyenes eszk\u00f6z, meglehet\u0151sen j\u00f3 teljes\u00edtm\u00e9nyt mutat. Mindenesetre el kell ismerni, hogy a szkenner meglehet\u0151sen er\u0151s, rugalmas \u00e9s multifunkcion\u00e1lis, ami a legfontosabb \u2014 ingyenes, ez\u00e9rt jogosan haszn\u00e1lhat\u00f3, seg\u00edtve az adminisztr\u00e1torokat \u00e9s fejleszt\u0151ket az alapvet\u0151 inform\u00e1ci\u00f3k megszerz\u00e9s\u00e9ben a webalkalmaz\u00e1s biztons\u00e1gi \u00e1llapot\u00e1r\u00f3l.<\/p>\n<p><\/p>\n<p>Maradjanak eg\u00e9szs\u00e9gesek \u00e9s v\u00e9dettek!<\/p>\n<p>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/510998\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e Nemesida WAF Free \u2014 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 API \u043e\u0442 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0445 \u0430\u0442\u0430\u043a, \u0430 \u0432 \u044d\u0442\u043e\u0439 \u0440\u0435\u0448\u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u0431\u0437\u043e\u0440 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Wapiti. \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0430\u044f \u043c\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u043a\u0443\u043f\u0435 \u0441 \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0435\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u0443\u0433\u0440\u043e\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438. \u0412\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0435\u0431-\u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u043c\u043e\u0436\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":88993,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-88992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wapiti \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-17T05:42:02+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-17T05:42:02+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wapiti \u2014 webhely sebezhet\u0151s\u00e9g\u00e9nek ellen\u0151rz\u00e9se saj\u00e1t kez\u0171leg | ProHoster","description":"A m\u00faltban","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wapiti \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u0430\u0439\u0442\u0430 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/wapiti-proverka-sajta-na-uyazvimosti-svoimi-silami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-17T05:42:02+00:00","article:modified_time":"2020-07-17T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"88992","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:45:41","updated":"2022-09-28 15:58:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/88992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=88992"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/88992\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/88993"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=88992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=88992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=88992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}