How to analyze the result of vulnerability scanner

Question

I need to do penetration testing, I'm scanning the vulnerability of My Web Application using VEGA tool. I did this using proxy mode set the manual proxy and recorded the actions after login in the site, also navigated some form submission. After these few actions I'm seeing the complete summary of my scan. Some priorities are showing high.

When Expand the url where it is, It shows some information.

Things are not much clear How the given URL is vulnerable ?. How do I reproduce the same to break the system ? and what should be done to avoid the problem ?

Answer 1

Essentially what Gewure said. The vulnerability you posted an image of is for what is called "command injection". The resulting HTML was because the scanner was able to craft a GET that then returns that data, un-sanitized, back into the page your service creates when sent that GET request. It's likely not the request that is problematic, it is what happens with what is passed in via that request on the back end that is problematic.

This means that a malicious actor could then start placing other values within those GET parameters which would act on the hosting system and potentially cause an confidentiality exposure at the least.

For instance, if this is passed to a local process which then checks against the system or a DB, then returns data, things like placing "cat%20%2Fetc%2Fpasswd%3Bcat%2Fetc%2Fshadow" as a parameter, which would dump users and their password hashes to the resulting HTML page (as a very simple example).

And yes, sanitize your inputs.

https://xkcd.com/327/

Answer 2

According to the picture you supplied here, one can see that your application might be vulnerble to user-manipulated GET-requests, as stated in the report your assessment-tool supplied.

E.g. one could change EventId to something like ../../ which could be a LFI (Local File Inclusion) vulnerability.

Same is true for FirstName, LastName, EmailID, ZipCode, PhoneNumber.. Make sure those user-supplied values are sanitized correctly to avoid any attacking-vectors.

Especially if your backend is PHP, which mostly lacks typesafety, XSS (Cross-site scripting) is easily possible if you don't sanitize (-> checking if the user-supplied values are allowed values, e.g. "LastName" should only consist of characters...) your userinput correclty.