It seems to me that you are vulnerable to some type of open redirect. See teh link below, where you would obviously change the username and password to yours. it lands me on the index. Or maybe that's what's supposed to happen. I don't know. Just thought it was weird i could manipulate the URL like that and get a valid page.
http://jlp4t5i2pvwdvkx3.onion:8080/?...sword=password
This doesn't seem to work for me. It takes me to the login.
Ran some basic XSS and SQLi as well. But if you really want me to have a go at it, let me use my fuzzers and intercepting proxies.
Well I'm not sure how much it can really handle as far as load goes. It'd be interesting to find out though. Not right now though. Let me work on the small bugs.
Also, here is what one of my security logs looks like...
!!!Security: Wrong Param
!!!Requested: {accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, accept-encoding=gzip, deflate, host=jlp4t5i2pvwdvkx3.onion:8080, http-client-ip=127.0.0.1, accept-language=en-US,en;q=0.5, dnt=1, remote-addr=127.0.0.1, user-agent=this is a test ua <img src=x onerror= alert(999999) >, connection=keep-alive}
!!!Requested: GET / topic=true§ion=introductions&topicTitle=1%20-%20clickd%20link%20on%20reddit&username=Sophia&password=REMOVED&=&
{topicTitle=1 - clickd link on reddit, password=REMOVED, =, topic=true, username=Sophia, section=introductions}
..................../..\..................
....................\../..................
.....................\/...................
!!!Security: Wrong Param
!!!Requested: {accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, accept-encoding=gzip, deflate, host=jlp4t5i2pvwdvkx3.onion:8080, http-client-ip=127.0.0.1, accept-language=en-US,en;q=0.5, dnt=1, remote-addr=127.0.0.1, user-agent=this is a test ua <img src=x onerror= alert(999999) >, connection=keep-alive}
!!!Requested: GET / topic=true§ion=introductions&topicTitle=1%20-%20clickd%20link%20on%20reddit&username=Sophia&password=REMOVED&=1%20AND%20ASCII(LOWER(SUBSTRING((SELECT%20TOP%201%20name%20FROM%20sysobjects%20WHERE%20xtype=%27U%27),%201,%201)))%20%3E%20116&=INBOX&=CHAT&=SETTINGS&=ABOUT
{topicTitle=1 - clickd link on reddit, password=REMOVED, =ABOUT, topic=true, username=Sophia, section=introductions}
..................../..\..................
....................\../..................
.....................\/...................
!!!Security: Wrong Param
!!!Requested: {accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, accept-encoding=gzip, deflate, host=jlp4t5i2pvwdvkx3.onion:8080, http-client-ip=127.0.0.1, accept-language=en-US,en;q=0.5, dnt=1, remote-addr=127.0.0.1, user-agent=this is a test ua <img src=x onerror= alert(999999) >, connection=keep-alive}
!!!Requested: GET / topic=true§ion=introductions&topicTitle=1%20-%20clickd%20link%20on%20reddit&username=Sophia&password=REMOVED&=&
{topicTitle=1 - clickd link on reddit, password=REMOVED, =, topic=true, username=Sophia, section=introductions}
..................../..\..................
....................\../..................
.....................\/...................
!!!Security: Wrong Param
!!!Requested: {accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, accept-encoding=gzip, deflate, host=jlp4t5i2pvwdvkx3.onion:8080, http-client-ip=127.0.0.1, accept-language=en-US,en;q=0.5, dnt=1, remote-addr=127.0.0.1, user-agent=this is a test ua <img src=x onerror= alert(999999) >, connection=keep-alive}
!!!Requested: GET / topic=true§ion=introductions&topicTitle=1%20-%20clickd%20link%20on%20reddit&username=Sophia&password=REMOVED&=1%27%20AND%201=(SELECT%20COUNT(*)%20FROM%20tablenames);%20--&=INBOX&=CHAT&=SETTINGS&=ABOUT
{topicTitle=1 - clickd link on reddit, password=REMOVED, =ABOUT, topic=true, username=Sophia, section=introductions}
..................../..\..................
....................\../..................
.....................\/...................
I set it up so that any parameters that aren't part of the application will trigger an error response(or not;) and so that I understand(hopefully) what's going on. Error reports are the same.
