T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/recon.py:1174- Finding
Plaintext HTTP Exposes Reconnaissance Queries and Permits Response Tampering
- Content
View full analysis
dict: addr = normalize_ip(ip) # Request the extended field set (geo + ISP + AS + proxy/hosting flags). fields = "status,message,country,countryCode,regionName,city,lat,lon,timezone,isp,org,as,reverse,mobile,proxy,hosting,query" url = "http://ip-api.com/json/{ip}?fields={f}".format(ip=urllib.parse.quote(addr, safe=""), f=fields) obj = http_get_json(url, timeout=timeout, retries=retries) return parse_ip(obj) ``` ```python def fetch_cdx(url: str, cdx_limit: int = 10, count: bool = False, timeout=20.0, retries=3) -> dict: q = urllib.parse.quote(url, safe="") base = "http://web.archive.org/cdx/search/cdx?url={q}&output=json".format(q=q) fl = "&fl=timestamp,original,statuscode,mimetype" ``` ```python def fetch_wayback(url: str, cdx=True, cdx_limit=10, count=False, timeout=15.0, retries=3) -> dict: if not url or not isinstance(url, str) or " " in url: raise InputError("invalid URL: {!r}".format(url)) q = urllib.parse.urlencode({"url": url}) api = "http://archive.org/wayback/available?{q}".format(q=q) result = parse_wayback(http_get_json(api, timeout=timeout, retries=retries), url) ``` ### Technical Analysis The IP geolocation and Wayback requests use unencrypted HTTP. HTTP provides neither confidentiality nor authenticated integrity. Consequently, any party able to observe or modify traffic between the host and these services—including a malicious access point, local-network adversary, compromised proxy, or upstream network intermediary—can inspect the lookup target or alter the returned data. The issue applies even if an HTTP service normally redirects to HTTPS because the init ...[truncated 2110 chars]- Remediation
View remediation