report.html

def test_for_anomalies():
pattern_observed = {"status_code": [], "resp_size": [], "request":[], "fuzz_type": "vulns"}
for resp in responses_recieved:
pattern_observed["status_code"].append(resp.status_code)
pattern_observed["resp_size"].append(len(resp.content))
#pattern_observed["request"].append(_create_curl_request(resp.request.url,resp.request.method,resp.request.headers,resp.request.body))
pattern_observed["request"].append(curlify.to_curl(resp.request))
> assertions.assert_for_anomalies(pattern_observed)

tests/test_app_demo_api_v1_transfers_for_vulns_fuzzing.py:575:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

pattern_observed = {'fuzz_type': 'vulns', 'request': ['curl -X POST -H \'Accept: application/vnd.demoapp.com; version=1\' -H \'Accept-Enc.../v1/transfers', ...], 'resp_size': [52, 57, 491, 496, 49, 49, ...], 'status_code': [404, 404, 201, 201, 404, 404, ...]}

def assert_for_anomalies(pattern_observed):
status_codes = list(set(pattern_observed["status_code"]))
print(status_codes)
print(pattern_observed["status_code"])
if len(status_codes) == 1:
print("No anomalies observed in status codes")
assert 1
else:
counter = 0
num = status_codes[0]

for i in status_codes:
curr_frequency = status_codes.count(i)
if curr_frequency > counter:
counter = curr_frequency
num = i

indexes = [i for i, x in enumerate(pattern_observed["status_code"]) if x == num]
for _ in indexes:
print("\n ------------ To regenerate the request for "+str(pattern_observed["fuzz_type"])+":\n\n"+
str(pattern_observed["request"][_]))
print("--------" * 20)
print("anomalies observed in status codes")
> assert 0
E AssertionError

tests/assertions.py:58: AssertionError
------------------------------Captured stdout call------------------------------
[201, 404] [404, 404, 201, 201, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404, 404] ------------ To regenerate the request for vulns: curl -X POST -H 'Accept: application/vnd.demoapp.com; version=1' -H 'Accept-Encoding: gzip, deflate' -H 'Accept-Language: en-US,en;q=0.9' -H 'Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD' -H 'Access-Control-Allow-Origin: *' -H 'Access-Control-Expose-Headers: ' -H 'Access-Control-Max-Age: 1728000' -H 'Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJkZW1vYXBwLWFwaSIsImlhdCI6MTU5MjM1MzYzMiwidGkiOiI5MmM5ZWJlMi0xYjBkLTRjOTUtYjNjYi1kNDg3NmJhODM2NTAiLCJ1c2VyIjp7ImlkIjozLCJlbWFpbCI6ImpvaG5AZGVtb2FwcC5jb20ifX0.C8BZ3vZW3heVdMPXnynYBHD-NPw3o5M36TIgdkaXXxuoScZhLGnBhMzpH5iPSP-v10M3-4INuJB8iqNzzumhyQ' -H 'Cache-Control: max-age=0, private, must-revalidate' -H 'Connection: keep-alive' -H 'Content-Length: 119' -H 'Content-Type: application/json; charset=utf-8' -H 'Date: Wed, 17 Jun 2020 00:27:12 GMT' -H 'Etag: W/"f21d0acb657593909d7dc1dad0f31408"' -H 'Origin: http://34.238.148.157:31380' -H 'Referer: http://34.238.148.157:31380/profile' -H 'Referrer-Policy: strict-origin-when-cross-origin' -H 'Server: nginx/1.17.10' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36' -H 'Vary: Origin' -H 'X-Content-Type-Options: nosniff' -H 'X-Download-Options: noopen' -H 'X-Frame-Options: SAMEORIGIN' -H 'X-Permitted-Cross-Domain-Policies: none' -H 'X-Request-Id: 5cb20a88-dbbf-46c5-8a9f-87e0538f5895' -H 'X-Runtime: 0.188602' -H 'X-Xss-Protection: 1; mode=block' -H 'cv-fuzzed-event: 1' -d '{"user_id1": "1,,,00", "beneficiary_id": "1,,,00", "description": "1,,,00", "amount": "1,,,00", "account_id": "1,,,00"}' http://54.236.47.36:31236/app-demo/api/v1/transfers ---------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------ To regenerate the request for vulns: curl -X POST -H 'Accept: application/vnd.demoapp.com; version=1' -H 'Accept-Encoding: gzip, deflate' -H 'Accept-Language: en-US,en;q=0.9' -H 'Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD' -H 'Access-Control-Allow-Origin: *' -H 'Access-Control-Expose-Headers: ' -H 'Access-Control-Max-Age: 1728000' -H 'Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJkZW1vYXBwLWFwaSIsImlhdCI6MTU5MjM1MzYzMiwidGkiOiI5MmM5ZWJlMi0xYjBkLTRjOTUtYjNjYi1kNDg3NmJhODM2NTAiLCJ1c2VyIjp7ImlkIjozLCJlbWFpbCI6ImpvaG5AZGVtb2FwcC5jb20ifX0.C8BZ3vZW3heVdMPXnynYBHD-NPw3o5M36TIgdkaXXxuoScZhLGnBhMzpH5iPSP-v10M3-4INuJB8iqNzzumhyQ' -H 'Cache-Control: max-age=0, private, must-revalidate' -H 'Connection: keep-alive' -H 'Content-Length: 144' -H 'Content-Type: application/json; charset=utf-8' -H 'Date: Wed, 17 Jun 2020 00:27:12 GMT' -H 'Etag: W/"f21d0acb657593909d7dc1dad0f31408"' -H 'Origin: http://34.238.148.157:31380' -H 'Referer: http://34.238.148.157:31380/profile' -H 'Referrer-Policy: strict-origin-when-cross-origin' -H 'Server: nginx/1.17.10' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36' -H 'Vary: Origin' -H 'X-Content-Type-Options: nosniff' -H 'X-Download-Options: noopen' -H 'X-Frame-Options: SAMEORIGIN' -H 'X-Permitted-Cross-Domain-Policies: none' -H 'X-Request-Id: 5cb20a88-dbbf-46c5-8a9f-87e0538f5895' -H 'X-Runtime: 0.188602' -H 'X-Xss-Protection: 1; mode=block' -H 'cv-fuzzed-event: 1' -d '{"user_id1": "1,,,00.html", "beneficiary_id": "1,,,00.html", "description": "1,,,00.html", "amount": "1,,,00.html", "account_id": "1,,,00.html"}' http://54.236.47.36:31236/app-demo/api/v1/transfers ---------------------------------------------------------------------------------------------------------------------------------------------------------------- anomalies observed in status codes