AtoB Challenge

The output of steps listed in the email is here (md).

Reports

Application

• SAST Report (json)
• DAST Scan Report Pls note the Anti-CSRF finding is a fasle positive.
• Insecure components (txt) (json): gunicorn, django-storages, django, whitenoise, bleach, requests, pillow
• Security Headers

AWS Infrastructure

• AWS Misconfigurations report
• S3 bukcet tacorala-badapp-static-a7868e5f239b2ad2 is world writable.

  ❯ aws s3 ls s3://tacorala-badapp-static-a7868e5f239b2ad2/arun.txt
  2022-03-28 11:03:19         22 arun.txt

• CloudTrail logging is disabled

  ❯ aws cloudtrail get-trail-status --name default
                      {
                          "IsLogging": false,
                          "LatestDeliveryError": "NoSuchBucket",
                          "LatestDeliveryTime": 1589840751.344,
                          "StopLoggingTime": 1563654418.197,
                          "LatestDeliveryAttemptTime": "2022-03-23T17:08:23Z",
                          "LatestNotificationAttemptTime": "",
                          "LatestNotificationAttemptSucceeded": "",
                          "LatestDeliveryAttemptSucceeded": "2020-05-18T22:25:51Z",
                          "TimeLoggingStarted": "",
                          "TimeLoggingStopped": "2019-07-20T20:26:58Z"
                      }

Links

• BadApp User
• BadApp Admin (user:admin , password:password)
• Security Headers