I'm using Jmeter to test my Jira instance. I recorded a login and a Scrumboard action.
When I want to replicate this using 2000 users I am getting an error.
I know this is because of the Token in needs.
How can I create a regex for finding the token?
I am doing a request to the server that looks like this
GET httb://SOMESERVERON.intranet:8080/secure/Dashboard.jspa
Cookie Data:
JSESSIONID=#IDNUMBER; atlassian.xsrf.token=#TOKENNUMBER
Request Headers: Connection: keep-alive Referer:
httb://SOMESERVERON.intranet:8080/plugins/servlet/gadgets/ifr?container=atlassian&mid=0&country=UK&lang=en&view=default&view-params=%7B%22writable%22%3A%22false%22%7D&st=atlassian%3AWYF9KCckTIxHKei%2BvMoCPKoa3LOkMGPilSEdaSqyqEFKIPnF0I3YcZDdKdElV0s%2B9%2FqBhMWhS2Qyvo7m0F2f3uTB3JBeKZF8Ou3EimeszE1Ms1IPMqDoYcVgPdF1CaQnnrANHwH1KhR1UxUlHed7VOyRPmfI26rO2FU65FQbvNuIZADHLRt1v8lF52vBeCqi6aSfyrfGau2lv3JDL4HVQv3dDmt%2FudFaX3a05CS94ncoGr0s&up_isPublicMode=false&up_isElevatedSecurityCheckShown=false&up_loginFailedByPermissions=false&up_externalUserManagement=false&up_loginSucceeded=false&up_allowCookies=true&up_externalPasswordManagement=&up_captchaFailure=false&up_isAdminFormOn=false&url=http%3A%2F%2Flrv142c3.europe.intranet%3A8080%2Frest%2Fgadgets%2F1.0%2Fg%2Fcom.atlassian.jira.gadgets%2Fgadgets%2Flogin.xml&libs=auth-refresh
Accept-Language: nl,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip,
deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0)
Gecko/20100101 Firefox/34.0 Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host:
http://SOMESERVERON.intranet:8080
So I know to look for this part
name="atlassian-token" content="TOKENKEY"
But what is the RegEx that I need to find the token and put it in a parameter that I can re use.
Regular Expression: name="atlassian-token" content="(.+?)"
Hope this will help.
For handling both JSESSIONID and atlassian-token cookies just add a HTTP Cookie Manager, JMeter is smart enough to deal with them automatically.
Related
While a third party company executing a security assessment on our SharePoint 2013 project. The Security Assessment was comprised of a Vulnerability Assessment. The Cycura determined that the "Search Box Web Part" functionality is vulnerable to XSS attacks.
The Proof of Concept came up like below:
Vulnerable parameter: "k":"String"
Payload: "test"><a onmouseover="alert('xss')">xxx
GET /Pages/SearchResults.aspx?k=test"><a onmouseover="alert('xss')">xxx HTTP/1.1 Host: wwwqa.xyz.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cookie: _ga=GA1.3.911615250.1492781812; dtLatC=31; dtPC=256094571_636h3; WSS_FullScreenMode=false; SearchSession=4d21f382%2D23e3%2D4f86%2D91ad%2Dc6c712e70704;
_gat_UA-82498113-1=1; dtCookie=911302E10B144FAA0C644F92C2950F93|UUErZUN1c3RvbWVyfDE
Connection: close
Upgrade-Insecure-Requests:
1enter image description here
The recommendations was to perform sanitization and input validation on user supplied data. the steps of validation, sanitization and escaping should happen both in client and server side. Whenever possible.
Did anyone had the same security assessment issue and if anyone managed to resolve or get an idea how to manage that since this is using SP OOTB search box web parts.
Much appreciate your help and contributions.
XSS can be prevented by defining white-list of acceptable charaters in user input. The key to prevent this attack is never trust user data. Always sanitize the user input. Always perform data validation i.e whether it has some blacklist characters[character which should not be allowed to user input] on input output both. https://www.owasp.org/index.php/Data_Validation.
This link will help you to understand data sanitazation,validation.
https://www.troyhunt.com/understanding-xss-input-sanitisation/
Here is the prevention cheat sheet for XSS. https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet.
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
I have been wrestling with this issue for several hours:
I have a Single-Page Application written in Angular which communicates with a DjangoREST backend. I am trying to implement an auth fonction with session Cookies. The way I see it is:
1/ Show any unlogged visitor a login page
2/ Make a POST to url/login with the credentials
3/ Obtain a "sessionid" cookie and writing in a service that the user is logged
4/ Redirect vistor towards reserved content and used get & post to access contents with the cookie
The login endpoint is already set and works. When I make a post, I receive a HTTP 200 response with user info and a Set-Cookie, but subsequent calls do not contain the Cookie:
Request URL: ...
Request Method:POST
Status Code:200 OK
Request Headersview source
Accept:application/json, text/plain, */*
Accept-Encoding:gzip,deflate,sdch
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Connection:keep-alive
Content-Length:38
Content-Type:application/x-www-form-urlencoded; charset=UTF-8
Host:devinify1.herokuapp..
Origin:http://mobilevinify.herokuapp...
Referer:http://mobilevinify.herokuapp...
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Form Dataview sourceview URL encoded
username:felix#vinify.co
password:test
Response Headersview source
Access-Control-Allow-Origin:*
Connection:keep-alive
Content-Length:189
Content-Type:application/json
Date:Sat, 14 Dec 2013 20:45:14 GMT
Server:gunicorn/18.0
Set-Cookie:sessionid=ijz27zy655qn0cwmlnvr66609hsyvdub; expires=Sat, 28-Dec-2013 20:45:14 GMT; Max-Age=1209600; Path=/
Vary:Cookie
My code is a very simple adaptation of the angular-app example:
https://github.com/FelixLC/MobileWebApp/blob/master/app/scripts/security/security.js
I have tried this on localhost et on heroku. The server and the client are on different domains, CORS are allowed.
When I try to make calls, I receive an error from Django
TypeError at /vinibarwines/
int() argument must be a string or a number, not 'AnonymousUser'
Should I try to get this cookie and put it in the headers with angularJS?
You can try to login at http://mobilevinify.herokuapp.com/#/login with felix#vinify.co & test. Then Click on Vinibar, there is a 500 internal error on the GET request
Any help much appreciated
Felix
Here is the full layout of how I actually do my authentication. Django/Angular Authentication. It's a pretty extensive response, I'm more than happy to answer further questions you might have.
Good morning all,
I have a web app using Classic ASP, hosted on IIS 7.5. I need to create a word document and stream back to the client for display, however when the document is streamed into the response something (an IIS setting?) is causing a 401 error - and i cannot track it down.
A colleague very kindly furnished me with some C++ code which deals with the document building & streaming and an ASP page which builds the COM objects and makes the calls etc.
The document starts life as a template in an IIS virtual directory outside my ASP application. We make a copy, do some find and replace actions and then stream it into the response with the correct MIME type for the browser to handle it however it sees fit.
It seems as soon as the streaming takes place (via a call to ASPTypeLibrary::IResponsePtr piResponse->BinaryWrite()) the 401 response is sent back, until that moment the response looks fine.
The site uses Forms authentication, and i have by this point signed in, the request i see in fiddler definitely has valid session data and the rest of the site is happy with my authentication.
Any ideas? (he asks with a note of desperation)
p.s. I realise i haven't listed all the code, i can if it helps though...
The plot thickens...
I have had success using the ASP page to stream the file into the output using and ADODB.Stream object.
When this is successful Fiddler picks up two HTTP request/responses; the first request gets a 401 back, then the browser sends another request with different cookie data which returns a successful result.
When my COM object is used two requests occur, but the second request also receives a 401...
Points to some security setting to do with COM object? Something i am not adding to the response with the COM object?
As per my response to Eric, my colleague worked a bit of magic and got the thing working, i am still a little confused about why it was caused though...
The line which Magic Al changed was this one:
piResponse->AddHeader( _T("Content-Length"), (LPCTSTR)Length );
Which is called while the response is being built up and what he did was comment it out.
Apparently he noticed that the length written by the BinaryWrite was coming out 13 bytes larger than the length of the file. He tells me that this may be because it is writing out the reserved WORD blocks from the Variant it is given.
So the response header is a bit mangled and the result is an HTTP violation error in fiddler which i had overlooked and somewhere in between client and COM object the mangled 200 response is replaced with a 401.
I guess the moral of this story is that you should always pay attention to fiddler errors and to ensure your Content-Length is correct.
My new question is why 401? why not a 500? And what is likely to be throwing this out? is it coming from IIS?
This is the HTTP text fiddler registers for the exchange:
GET GET [The page address - its on localhost and is an ASP page] HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-GB
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: localhost
Cookie: SessionUID={E41F5378-FBE2-475E-8F9A-6416AFE2BAA0}; DisplayMethod=0; ShowDataTips=1; LOGONUSER={UserName Info}ASPSESSIONIDQARAQRBD={Session ID} Authorization: Negotiate YH8GBisGAQUFAqB1MHOgMDAuBgorBgEEAYI3AgIKBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHqI/BD1OVExNU1NQAAEAAACXsgjiCwALADIAAAAKAAoAKAAAAAYBsR0AAAAPRE9DREVWLUpDV0RFVkVMT1BNRU5U
HTTP/1.1 401 Unauthorized
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
WWW-Authenticate: Negotiate oYIBYTCCAV2gAwoBAaEMBgorBgEEAYI3AgIKooIBRgSCAUJOVExNU1NQAAIAAAAWABYAOAAAABXCieJQEtMwe36vajD3zwEAAAAA9AD0AE4AAAAGAbEdAAAAD0QARQBWAEUATABPAFAATQBFAE4AVAACABYARABFAFYARQBMAE8AUABNAEUATgBUAAEAFABEAE8AQwBEAEUAVgAtAEoAQwBXAAQAOABEAGUAdgBlAGwAbwBwAG0AZQBuAHQALgBEAG8AYwB1AG0AYQB0AGkAbwBuAC4AYwBvAC4AdQBrAAMATgBEAE8AQwBEAEUAVgAtAEoAQwBXAC4ARABlAHYAZQBsAG8AcABtAGUAbgB0AC4ARABvAGMAdQBtAGEAdABpAG8AbgAuAGMAbwAuAHUAawAFACAARABvAGMAdQBtAGEAdABpAG8AbgAuAGMAbwAuAHUAawAHAAgAKRk7jhfZzQEAAAAA
Date: Thu, 13 Dec 2012 09:52:25 GMT
Content-Length: 341
Proxy-Support: Session-Based-Authentication
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Not Authorized</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Not Authorized</h2>
<hr><p>HTTP Error 401. The requested resource requires user authentication.</p>
</BODY></HTML>
------------------------------------------------------------------
GET [The page address - its on localhost and is an ASP page] HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-GB
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Cookie: SessionUID={E41F5378-FBE2-475E-8F9A-6416AFE2BAA0}; DisplayMethod=0; ShowDataTips=1; LOGONUSER={UserName Info}ASPSESSIONIDQARAQRBD={Session ID}
Authorization: Negotiate oXcwdaADCgEBoloEWE5UTE1TU1AAAwAAAAAAAABYAAAAAAAAAFgAAAAAAAAAWAAAAAAAAABYAAAAAAAAAFgAAAAAAAAAWAAAABXCiOIGAbEdAAAAD4GPyFfTAkcs1KpJqG4eT0ujEgQQAQAAAPUXp1AtIpqEAAAAAA==
Host: localhost
HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Thu, 13 Dec 2012 09:52:27 GMT
Content-Length: 6630
Proxy-Support: Session-Based-Authentication
<HTML Page telling you about the error which gets displayed when you cancel the authentication dialog.>
I've never visited one website before, for the first time I visit this website and try to login, I use fiddler to monitor the post data,
in the http post header, there's already cookie in there. how would that happen?
How can I generate a cookie to auto login the website?
The following is the raw header.
POST https://us.battle.net/login/en/?ref=&app= HTTP/1.1
Host: us.battle.net
Connection: keep-alive
Content-Length: 64
Cache-Control: max-age=0
Origin: https://us.battle.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.77 Safari/537.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: https://us.battle.net/login/en/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,en-GB;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: perm=1; __utma=134253166.2032096419.1344959743.1344959743.1344959743.1; __utmb=134253166.2.10.1344959743; __utmc=134253166; __utmz=134253166.1344959743.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)
accountName=aaaa%40me.com&password=password&persistLogin=on
The cookie could have been generated on the GET request when you visited the login page.
Alternatively, although you haven't directly visited a website, it may have been integrated into another website you have visited, for example in an iframe. This is common with ad networks for example.
how can i create a batch that can send HTTPS requests ?
byfar i used Fiddler Request Builder so i can send requests like:
GET https://website.com/index.aspx?typeoflink=**[HERE-VARIABLE-FROM-FILE]**&min=1 HTTP/1.1
Accept: */*
Referer: https://website.com/index.aspx?chknumbertypeoflink&min=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: website.com
Connection: Keep-Alive
Cookie: cookieverrylongstringD%FG^&N*MJ( CVV%^B&N*&*(NHN*B*&BH*&H
But i have to mannualy change the variable NOT GOOD...
So the script would send many Requests and just changing the [HERE-VARIABLE-FROM-FILE] variable
The variables are textnames in a file (one variable per line)
if this could be done in a batch file or vbs or jscript or anything!
Thanks in advance!
adam
One way would be to download a version of curl for Windows, and then write a batch file that invokes curl.
set TYPEOFLINK=foo
curl https://website.com/index.aspx?typeoflink=%TYPEOFLINK%&min=1 > savedfile
I'm going to assume Windows because you mention Fiddler.
You can use curl which runs under cygwin.
curl is a command line tool which will allows you to initiates GET requests.