-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathCheck.Pasv.Java.ViewState.php
More file actions
30 lines (22 loc) · 4.09 KB
/
Check.Pasv.Java.ViewState.php
File metadata and controls
30 lines (22 loc) · 4.09 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
<?php
/* Watcher test findings */
header('Content-Type: text/html; charset=utf-8');
?>
<html>
<head>
<title>Watcher test page for JavaServer Faces ViewState</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>
<body>
<h1>Check.Pas.Java.ViewState.cs</h1>
<p>1 alert, 1 issue.</p>
<p>There's two tests, one on this page for a compressed ViewState, and another by following the link below for an uncompressed ViewState.</p>
<p>In the wild, you can find pages with ViewState by search for <strong>inurl:.jsf</strong> since many JSF pages produce this.</p>
<ol>
<li><strong>JavaServer Faces ViewState </strong> is compressed with GZIP and insecure.</li>
</ol>
<br />
<a href="Check.Pasv.Java.ViewState.Uncompressed.php">Click here to test an uncompressed ViewState</a>
<input type="hidden" name="javax.faces.ViewState" id="javax.faces.ViewState" value="H4sIAAAAAAAAANWab2wcRxXA5y7/nBBVaSJCQuvEsVM3Vc57/3fvCFZj1/+O2k7kf0mTlMv4bu5unb3dze6s79IoUQoCpEZCRYWqlQKtBJX4kH6hn+gHKEICUakggviChBQhJIREQUJILf0AzJv7s3vnO9+d1+bckzzePc/Me+/33sx7s+v7H6JdloEOXZ5ewatYULCaFc4tr5AUPfPyry++ccB8SvEiVNQRQr2mgcIpLS+YlipkcIqYAtZ1RU5hKmuqME8xJTNYxVliJPK6cnLBIGRWS5N/Zd79yduByZ/uh3kKcQSfU5qRFfAKLkZWzIyQMXCeFDTjGv9KGGHNkkwKc5pG0d7kavmyaF5Ht5G3EOQzDIC+xbIeTCtdU4lKhRzNK8IUayY0I492ryTldDBQGSmycR7kazHyGS2fx2p61KJUU5GXqK6Gp0lluMT1fqrF8HMW1S26QIq0pH0o4HJ8yN34sEv5YdHl+Ji78RGX+kdc8otEXI53yS9S5VdaeafbGg+rB5dniFYJ+tn4R9CJxjMsJs5jWMeUGOVxQXeaR6Mux0sux8fdjRdd2i+GXY53yU90yU90yU8Kuo1cKeyM3KNtR67kcs1KLvesWKBowXj4eKtXO6pXPfaVruvOHMlS9KN2Ih/VNIVg9YM+487v733ydy/yXEK7VrFikaLu4Ro+gWD8vqmFmenk6Mh84hmKHvGnyaoMmhZBQTbjAT6jRWVFmNZSWCG3P3706r3Av//mRTsTqCeHzVyK5flptCelWSo1blB0kJcTftDCP08NWc2emUY9cGux+gAkn2bdV7EhY5Xy26L+X/ahCFFIufDVUK0xCZUSVloc/NObP/joxW/EmDGJijEVFXm/WSu/TIyv3/9O72e+/fBupXghDFSV2i64eJI3un3JxA02dhQvbaY0JU2MebxKjOfef2f4lXsfzHiRdxrtTSnYNGdZ/JTN2meyPmk+phZEua4q6nrVMg51igGcwfquPX/42c8PX/3tDuSdQPsUDacncIpqRgLtpTmDmDmmQFF/+iw3YX+hh7UH4NKOlSMNouawHSvc42J5gt18AvjxUnTEWdYphJrCzMjcs8nEGEU94XCIJfFgqlGvkfPnpxPjY8wc/5q/yawGFMZIBlsKnSh9eXKE1Ys3FrRrRJ2695uxM+qrb5aKwgAa9F8YHx1KzE74q9hNfyqnaSYpxVwpGlkBNvix943+YlGnleoOrBqFZpC7kZaCoeJF2A90vkpOOKpVf3GoUCgMZdgfhyxDISoEcFqv/zTgaV8dq17tbsnYA18PV2my1ALLtqT/F5itlZivmHDQaUKplGSQD9kxM2IY+Ma0bNLiiw96X/8l/u4OWA87TfkFwuPdU9gJLVcnTFHAOR9ZhaCeITSnpceLOgstkyEZSQEYmJKoxKha5GFyn1zjXKIICzhbPwUqfTzgVAMdLclkXev7/cj//t0/fxT5ppf3O1TtZ/f4/tdemv/npQdf5MuXaXC8okGD2eCw8ce527H9z73yD5AMmi8WjqPHBm6aEIRk0STGKNsHBZPQUjDdQqj+0FPepd5+sPSXv/benKzsGx6KeteyK7Eah2tdLxauoEvthW/f2aDkk0J9uIb1cP86mkKoOzYpiEr7jqLDfjmf9WcUnDV5mySqoKvZ+kCumYCiPeNqVpHNHFtDprWcl2nV3WhzAz1CnIGeZhsiOxDZgQ7NLJ/pXH3MQjPniEK4WuDtxda+hW6XKtpc6dBFocDmuuh4vYvSJCmrMP8qacdXY8SiZioH3yShudrART2NqoRm+33FRWImTHAqLML907zz2cIpdKwRpzxRrZodeKBYX6JcKq2WUkquc1wY1vBgk11kCQY020SOVDeHum6FfXcuP3zvP9/yllf8EpNwzLFL1HWHTWLHuz9cPv7Er16rbBK3Cz50ZOBmXuC+YOk6CcLMlCHr9JazpCglbgijBJpcH0/f2XjAFwpE+jgGCJvG0/fb53tQ5StN8xdUhZWoGKyJr02Og1CKxwE0hYa+hYsX1joWft3i7Z1CEPWCwYqWldVkjiiKllQ1mmT3WZKW1SZQZ9CzLaHGfGLYybSpCBtsCHR6uXaz+eoWo5RwgEg4knEuKQkNNTIPp+EnOYpVtr9ExFhRDLSzwtrwQjmqc8FkXluWFWImNVa0whGhiQPm0PmGm6PGSm6VjjmPAyyDhXzRmvBuJKfffnwEOn2vG16QYk4vTKLhdbwwqWlZhYykTaKydCCr10YVLXUNvBKMbpJXhtDRMi3T0nXNoCRd4dbELQtorgO3RGO+aLTOL2sl2Y7h2/79bjgmEK7uNG9tlKaEBsDGNQayzEoNLW3x7N2E65fRlQ64iqwcEJ1cW8i0CfP4+3ETwvxucKsIE/eEWbzOatdk3OfvA6vTsqkr+EYSThibEq9i1BGvTSX1289xQa1fdCNeg/HtT1MSO6PJk+PvukHTUWdsmGYUnZjX1Bt944acMk1NbZ9qs3NAY6rxkKPsaCnRphsBNR92g25Y+tTQZVXyxujyzPVhN+imQu7pCujz5ewMhDCVlxXSohBYRPMdYA3GfVGxrhBoIMrmyfPUJ13hmXbPM4ZOgpFrLWynFEii5zsgGwr6pLiTbCuhVcZRyF6ePTbQukd8pbcWa2sD2/T1Xwi0ehpTwk3WvFdoF7KImL0GuW4RkwqcTpGexzR3i6NiB1xhxcw0Rvw8utwJYna6kGzErUTagIMA+LNbHrGZmqclXT9UBNDjMxrVDE3poLK4gBY78Eg47IvGKh5ZT5jtiyj4YqAbG0osWNlQPI9vY6ZiqGOmkNc9gW4wjUfcM93i8jcUi3VU/kahovcMd4VmZtvTDAc6O0yIfO/9UjdoYrz9aUYjndGEpyOeC92guRx1T9OPHpvHedNSs+3zXEILHfCUAo4SYR1ZNlGej9JdILpcqq3dEf0/HcfCMWlDxzGRZ6br3aAbDX9q6EZYGbUhujxT3e4KXeKe7mn0ufIJNGMZNEeMFifdjt5ERCSW9UN1J916Of32v5OBJXe7QVKMuyfJ4hQsrDOvnTNuZ3Eaq3/cva5Emy7PWq/V0PX0bPGBdllKbfcDbSQW3NiBVoKq2/PWlsdmsPRIq3ygDaFT7dq2GWdXvmZDybysynkrnwQ4skHyIHMzzlmReKAGfnNhNnZI2J53urFLBKsPwzz3Xb6Ab2BjUpHNZv/VcBEtdQI15JMCTqhNpfXb/9AKVr3XhGrdq7D/AUKgCZuTMgAA" />
</body>
</html>