{
    "vulnerabilities": {
        "Command execution": [
            {
                "method": "GET",
                "path": "/argument_inject.php/",
                "info": "Command execution via injection in the parameter args",
                "parameter": "args",
                "module": "exec",
                "http_request": "GET /argument_inject.php/?args=%3Benv%3B HTTP/1.1\nhost: exec\nconnection: keep-alive\nuser-agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0\naccept-language: en-US\naccept-encoding: gzip, deflate, br\naccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
                "wstg": [
                    "WSTG-INPV-12"
                ]
            },
            {
                "method": "GET",
                "path": "/direct_exec.php/",
                "info": "Command execution via injection in the parameter cmd",
                "parameter": "cmd",
                "module": "exec",
                "http_request": "GET /direct_exec.php/?cmd=id HTTP/1.1\nhost: exec\nconnection: keep-alive\nuser-agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0\naccept-language: en-US\naccept-encoding: gzip, deflate, br\naccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
                "wstg": [
                    "WSTG-INPV-12"
                ]
            },
            {
                "method": "GET",
                "path": "/last_payload.php/",
                "info": "Command execution via injection in the parameter abc",
                "parameter": "abc",
                "module": "exec",
                "http_request": "GET /last_payload.php/?abc=%26set%26 HTTP/1.1\nhost: exec\nconnection: keep-alive\nuser-agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0\naccept-language: en-US\naccept-encoding: gzip, deflate, br\naccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
                "wstg": [
                    "WSTG-INPV-12"
                ]
            }
        ]
    },
    "infos": {
        "target": "http://exec/",
        "crawled_pages": [
            {
                "request": {
                    "url": "http://exec/",
                    "method": "GET",
                    "headers": [
                        [
                            "accept",
                            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
                        ],
                        [
                            "accept-encoding",
                            "gzip, deflate, br"
                        ],
                        [
                            "accept-language",
                            "en-US"
                        ],
                        [
                            "connection",
                            "keep-alive"
                        ],
                        [
                            "host",
                            "exec"
                        ],
                        [
                            "user-agent",
                            "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0"
                        ]
                    ]
                },
                "response": {
                    "status_code": 200,
                    "body": "<!DOCTYPE html>\n<html>\n    <head>\n        <meta charset=\"UTF-8\"/>\n        <title>CMD Injections</title>\n    </head>\n\n    <body>\n        <p>Here you can use the cmd attribute to inject commands</p>\n        <ul>\n            <li>inject commands directly <a href=\"./direct_exec.php/?cmd=echo\">on this page</a></li>\n            <li>inject commands as curl parameters <a href=\"./argument_inject.php/?args=/var/log\">on this page</a></li>\n            <li>inject commands with some string processing <a href=\"./last_payload.php/?abc=blabla\">on this page</a></li>\n        </ul>\n    </body>\n</html>\n",
                    "headers": [
                        [
                            "connection",
                            "Keep-Alive"
                        ],
                        [
                            "content-encoding",
                            "gzip"
                        ],
                        [
                            "content-length",
                            "298"
                        ],
                        [
                            "content-type",
                            "text/html; charset=UTF-8"
                        ],
                        [
                            "server",
                            "Apache/2.4.56 (Debian)"
                        ],
                        [
                            "vary",
                            "Accept-Encoding"
                        ],
                        [
                            "x-powered-by",
                            "PHP/8.1.18"
                        ]
                    ]
                }
            },
            {
                "request": {
                    "url": "http://exec/argument_inject.php/",
                    "method": "GET",
                    "headers": [
                        [
                            "accept",
                            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
                        ],
                        [
                            "accept-encoding",
                            "gzip, deflate, br"
                        ],
                        [
                            "accept-language",
                            "en-US"
                        ],
                        [
                            "connection",
                            "keep-alive"
                        ],
                        [
                            "host",
                            "exec"
                        ],
                        [
                            "user-agent",
                            "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0"
                        ]
                    ]
                },
                "response": {
                    "status_code": 200,
                    "body": "<!DOCTYPE html>\n<html>\n    <head>\n        <meta charset=\"UTF-8\"/>\n        <title>CMD Injections</title>\n    </head>\n\n    <body>\n        <p>Here you can use the args attribute to inject commands</p>\n</body>\n</html>\n",
                    "headers": [
                        [
                            "connection",
                            "Keep-Alive"
                        ],
                        [
                            "content-encoding",
                            "gzip"
                        ],
                        [
                            "content-length",
                            "164"
                        ],
                        [
                            "content-type",
                            "text/html; charset=UTF-8"
                        ],
                        [
                            "server",
                            "Apache/2.4.56 (Debian)"
                        ],
                        [
                            "vary",
                            "Accept-Encoding"
                        ],
                        [
                            "x-powered-by",
                            "PHP/8.1.18"
                        ]
                    ]
                }
            },
            {
                "request": {
                    "url": "http://exec/argument_inject.php/",
                    "method": "GET",
                    "headers": [
                        [
                            "accept",
                            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
                        ],
                        [
                            "accept-encoding",
                            "gzip, deflate, br"
                        ],
                        [
                            "accept-language",
                            "en-US"
                        ],
                        [
                            "connection",
                            "keep-alive"
                        ],
                        [
                            "host",
                            "exec"
                        ],
                        [
                            "user-agent",
                            "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0"
                        ]
                    ]
                },
                "response": {
                    "status_code": 200,
                    "body": "alternatives.log\napache2\napt\nbtmp\ndpkg.log\nfaillog\nlastlog\nwtmp\nwtmp<!DOCTYPE html>\n<html>\n    <head>\n        <meta charset=\"UTF-8\"/>\n        <title>CMD Injections</title>\n    </head>\n\n    <body>\n        <p>Here you can use the args attribute to inject commands</p>\n</body>\n</html>\n",
                    "headers": [
                        [
                            "connection",
                            "Keep-Alive"
                        ],
                        [
                            "content-encoding",
                            "gzip"
                        ],
                        [
                            "content-type",
                            "text/html; charset=UTF-8"
                        ],
                        [
                            "server",
                            "Apache/2.4.56 (Debian)"
                        ],
                        [
                            "transfer-encoding",
                            "chunked"
                        ],
                        [
                            "vary",
                            "Accept-Encoding"
                        ],
                        [
                            "x-powered-by",
                            "PHP/8.1.18"
                        ]
                    ]
                }
            },
            {
                "request": {
                    "url": "http://exec/direct_exec.php/",
                    "method": "GET",
                    "headers": [
                        [
                            "accept",
                            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
                        ],
                        [
                            "accept-encoding",
                            "gzip, deflate, br"
                        ],
                        [
                            "accept-language",
                            "en-US"
                        ],
                        [
                            "connection",
                            "keep-alive"
                        ],
                        [
                            "host",
                            "exec"
                        ],
                        [
                            "user-agent",
                            "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0"
                        ]
                    ]
                },
                "response": {
                    "status_code": 200,
                    "body": "<!DOCTYPE html>\n<html>\n    <head>\n        <meta charset=\"UTF-8\"/>\n        <title>CMD Injections</title>\n    </head>\n\n    <body>\n        <p>Here you can use the cmd attribute to inject commands</p>\n</body>\n</html>\n",
                    "headers": [
                        [
                            "connection",
                            "Keep-Alive"
                        ],
                        [
                            "content-encoding",
                            "gzip"
                        ],
                        [
                            "content-length",
                            "163"
                        ],
                        [
                            "content-type",
                            "text/html; charset=UTF-8"
                        ],
                        [
                            "server",
                            "Apache/2.4.56 (Debian)"
                        ],
                        [
                            "vary",
                            "Accept-Encoding"
                        ],
                        [
                            "x-powered-by",
                            "PHP/8.1.18"
                        ]
                    ]
                }
            },
            {
                "request": {
                    "url": "http://exec/direct_exec.php/",
                    "method": "GET",
                    "headers": [
                        [
                            "accept",
                            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
                        ],
                        [
                            "accept-encoding",
                            "gzip, deflate, br"
                        ],
                        [
                            "accept-language",
                            "en-US"
                        ],
                        [
                            "connection",
                            "keep-alive"
                        ],
                        [
                            "host",
                            "exec"
                        ],
                        [
                            "user-agent",
                            "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0"
                        ]
                    ]
                },
                "response": {
                    "status_code": 200,
                    "body": "\n<!DOCTYPE html>\n<html>\n    <head>\n        <meta charset=\"UTF-8\"/>\n        <title>CMD Injections</title>\n    </head>\n\n    <body>\n        <p>Here you can use the cmd attribute to inject commands</p>\n</body>\n</html>\n",
                    "headers": [
                        [
                            "connection",
                            "Keep-Alive"
                        ],
                        [
                            "content-encoding",
                            "gzip"
                        ],
                        [
                            "content-type",
                            "text/html; charset=UTF-8"
                        ],
                        [
                            "server",
                            "Apache/2.4.56 (Debian)"
                        ],
                        [
                            "transfer-encoding",
                            "chunked"
                        ],
                        [
                            "vary",
                            "Accept-Encoding"
                        ],
                        [
                            "x-powered-by",
                            "PHP/8.1.18"
                        ]
                    ]
                }
            },
            {
                "request": {
                    "url": "http://exec/last_payload.php/",
                    "method": "GET",
                    "headers": [
                        [
                            "accept",
                            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
                        ],
                        [
                            "accept-encoding",
                            "gzip, deflate, br"
                        ],
                        [
                            "accept-language",
                            "en-US"
                        ],
                        [
                            "connection",
                            "keep-alive"
                        ],
                        [
                            "host",
                            "exec"
                        ],
                        [
                            "user-agent",
                            "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0"
                        ]
                    ]
                },
                "response": {
                    "status_code": 200,
                    "body": "<!DOCTYPE html>\n<html>\n    <head>\n        <meta charset=\"UTF-8\"/>\n        <title>CMD Injections</title>\n    </head>\n\n    <body>\n        <p>Here you can use the abc attribute to inject commands</p>\n</body>\n</html>\n",
                    "headers": [
                        [
                            "connection",
                            "Keep-Alive"
                        ],
                        [
                            "content-encoding",
                            "gzip"
                        ],
                        [
                            "content-length",
                            "163"
                        ],
                        [
                            "content-type",
                            "text/html; charset=UTF-8"
                        ],
                        [
                            "server",
                            "Apache/2.4.56 (Debian)"
                        ],
                        [
                            "vary",
                            "Accept-Encoding"
                        ],
                        [
                            "x-powered-by",
                            "PHP/8.1.18"
                        ]
                    ]
                }
            },
            {
                "request": {
                    "url": "http://exec/last_payload.php/",
                    "method": "GET",
                    "headers": [
                        [
                            "accept",
                            "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
                        ],
                        [
                            "accept-encoding",
                            "gzip, deflate, br"
                        ],
                        [
                            "accept-language",
                            "en-US"
                        ],
                        [
                            "connection",
                            "keep-alive"
                        ],
                        [
                            "host",
                            "exec"
                        ],
                        [
                            "user-agent",
                            "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0"
                        ]
                    ]
                },
                "response": {
                    "status_code": 200,
                    "body": "<!DOCTYPE html>\n<html>\n    <head>\n        <meta charset=\"UTF-8\"/>\n        <title>CMD Injections</title>\n    </head>\n\n    <body>\n        <p>Here you can use the abc attribute to inject commands</p>\n</body>\n</html>\n",
                    "headers": [
                        [
                            "connection",
                            "Keep-Alive"
                        ],
                        [
                            "content-encoding",
                            "gzip"
                        ],
                        [
                            "content-length",
                            "163"
                        ],
                        [
                            "content-type",
                            "text/html; charset=UTF-8"
                        ],
                        [
                            "server",
                            "Apache/2.4.56 (Debian)"
                        ],
                        [
                            "vary",
                            "Accept-Encoding"
                        ],
                        [
                            "x-powered-by",
                            "PHP/8.1.18"
                        ]
                    ]
                }
            }
        ]
    }
}