openRasp block requeste after that not able to do further any action

45 views
Skip to first unread message

venkateswararao yeluru

unread,
Jun 14, 2019, 3:28:52 AM6/14/19
to OpenRASP
Hi Team,

i'm using openaRasp 1.0 i try to test one application called easytravel.

first time i will registrator, after that when gave login id as : <script>alert("Hello")</script> ..it's blocking.
but after that i'm not able to do any further action with login.

general info : 
  1. Request URL:
  2. Request Method:
    OPTIONS
  3. Status Code:
    404
  4. Remote Address:
    <IP:PORT>
  5. Referrer Policy:
    no-referrer-when-downgrade
    1. Access-Control-Request-Headers:
      faces-request
    2. Access-Control-Request-Method:
      GET
    3. Origin:
      <IP>
    4. Referer:
      http://<IP>/privacy-orange.jsf
    5. User-Agent:
      Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36

c0debreak

unread,
Jun 14, 2019, 5:02:44 AM6/14/19
to OpenRASP
Please upload alarm.log. 
It can be usually found at $APP_HOME/rasp/logs/alarm/alarm.log.

venkateswararao yeluru

unread,
Jun 14, 2019, 6:05:35 AM6/14/19
to c0debreak, OpenRASP
please find the alaram.log file.

--
You received this message because you are subscribed to the Google Groups "OpenRASP" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openrasp+u...@googlegroups.com.
To post to this group, send email to open...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/openrasp/a5add0bf-b943-48a9-82f8-8740df7395f1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
alarm.log

c0debreak

unread,
Jun 14, 2019, 7:48:59 AM6/14/19
to OpenRASP
This message is unexpected:
PM22__Reflected XSS attack detected: more than 0 html tags detected in userinput

Did you modify our source code?
To unsubscribe from this group and stop receiving emails from it, send an email to openrasp+unsubscribe@googlegroups.com.

venkateswararao yeluru

unread,
Jun 14, 2019, 12:54:00 PM6/14/19
to c0debreak, OpenRASP
Yes..I have modified for my requirement.

To unsubscribe from this group and stop receiving emails from it, send an email to openrasp+u...@googlegroups.com.

To post to this group, send email to open...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/openrasp/a5add0bf-b943-48a9-82f8-8740df7395f1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "OpenRASP" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openrasp+u...@googlegroups.com.

To post to this group, send email to open...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/openrasp/d07e3fca-8a2e-4267-8215-6b8b7ef00e42%40googlegroups.com.

OpenRASP

unread,
Jun 14, 2019, 7:57:00 PM6/14/19
to OpenRASP
This algorithm creates an alarm if more than 10 parameters contains HTML tags. It is not very effective against XSS, and we've seen a few false positives in product environment, so we have removed this algorithm in the 1.1.1 branch. 
To unsubscribe from this group and stop receiving emails from it, send an email to openrasp+unsubscribe@googlegroups.com.

To post to this group, send email to open...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/openrasp/a5add0bf-b943-48a9-82f8-8740df7395f1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "OpenRASP" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openrasp+unsubscribe@googlegroups.com.
Reply all
Reply to author
Forward
0 new messages