jake/clawdbot-workspace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
clawdbot-workspace/pentest-realwave/INJECTION-REPORT.md

17 KiB
Raw Blame History

RealWave.com Injection Stress Test Report

Date: 2026-02-07
Target: https://www.realwave.com/
IP: 162.43.207.214
Tester: Clawdbot Subagent (authorized by Jake Shore)
Status: COMPLETE

Executive Summary

RealWave.com has a solid defensive posture against injection attacks at the web application layer. The Angular SPA architecture + IIS catch-all routing means most server-side injection vectors are neutralized — the server returns the same static index.html (63,342 bytes) for virtually all requests, with no server-side parameter reflection.

However, several medium and informational-severity findings were identified that need attention.

🔴 CRITICAL FINDINGS (0)

No critical injection vulnerabilities were found.

🟠 HIGH FINDINGS (2)

H1: No Rate Limiting on API or SignalR Endpoints

  • Severity: HIGH
  • Evidence: 50 rapid requests to /api/Academy/AgentLibrary — all returned 401 with zero throttling. 20 rapid requests to /chatHub/negotiate — same result.
  • Impact: Enables brute-force attacks against authentication, credential stuffing, and API abuse once auth tokens are obtained.
  • Recommendation: Implement rate limiting (e.g., ASP.NET Rate Limiting middleware, Azure API Management, or IIS Dynamic IP Restrictions).

H2: GHL Webhook Accepts Unsanitized XSS Payloads

  • Severity: HIGH
  • Endpoint: POST https://services.leadconnectorhq.com/hooks/8jJylXIxcMrt2E2RW0hW/webhook-trigger/TojDcSAx1jRu84taBZ9s
  • Payload: {"name":"<script>alert(1)</script>","email":"test@test.com","phone":"555-0000"}
  • Response: {"status":"Success: request sent to trigger execution server","id":"01zSwhlq5XbbYpB9wAvq"} (HTTP 200)
  • Impact: If GHL renders these values in any admin dashboard, email template, or CRM view without sanitization, this is Stored XSS in the GHL ecosystem. An attacker could inject malicious scripts via webhook submissions that execute when staff view the data.
  • Recommendation: Validate/sanitize all webhook input data before storing. Contact GHL support re: their output encoding in CRM views. Consider adding a webhook secret/HMAC to prevent unauthorized submissions.

🟡 MEDIUM FINDINGS (3)

M1: Missing Security Headers

  • Severity: MEDIUM
  • Evidence: Response headers lack:
    • Content-Security-Policy — CONFIRMED MISSING
    • X-Frame-Options — Not set
    • X-Content-Type-Options — Not set
    • Strict-Transport-Security — Not set
    • Referrer-Policy — Not set
    • Permissions-Policy — Not set
  • Headers present: Server: Microsoft-IIS/10.0, X-Powered-By: ASP.NET
  • Impact: Without CSP, any XSS that lands (e.g., via DOM manipulation in Angular) has unrestricted access. Missing X-Frame-Options allows clickjacking.
  • Recommendation: Add all OWASP-recommended security headers via IIS web.config. Priority: CSP and HSTS.

M2: Server Version Disclosure

  • Severity: MEDIUM
  • Evidence: Every response includes Server: Microsoft-IIS/10.0 and X-Powered-By: ASP.NET
  • Impact: Reveals exact server technology, making targeted exploits easier.
  • Recommendation: Remove X-Powered-By header and customize/suppress Server header in IIS configuration.

M3: No WAF/CDN Protection

  • Severity: MEDIUM
  • Evidence: Direct IP access (162.43.207.214), no Cloudflare/AWS WAF/Azure Front Door detected. All 50 rapid-fire requests succeeded with no blocking.
  • Impact: Server is directly exposed to DDoS, scanner bots, and automated attacks.
  • Recommendation: Deploy a WAF/CDN (Cloudflare, Azure Front Door, etc.) in front of the server.

🔵 LOW / INFORMATIONAL FINDINGS (4)

I1: Angular SPA Catch-All Routing (Positive Finding)

  • Severity: INFORMATIONAL (POSITIVE)
  • Evidence: IIS is configured to serve index.html for all unmatched routes. This means:
    • URL parameter injection payloads are not reflected server-side
    • Path-based injections return the SPA shell, not error pages with reflection
    • No server-side template injection possible via URL
  • Note: This is good security hygiene for an SPA.

I2: API Endpoints Return Clean 401s

  • Severity: INFORMATIONAL (POSITIVE)
  • Evidence: All API endpoints (/api/Academy/AgentLibrary, /api/Academy/Lessons, /api/subscriptions/customers) return HTTP 401 with empty body — no error messages, no stack traces, no SQL error details.
  • Impact: Minimal information leakage through API error responses.

I3: CRLF Injection Blocked by HTTP.sys

  • Severity: INFORMATIONAL (POSITIVE)
  • Evidence: CRLF attempts (%0d%0a) return HTTP 400 Bad Request from Microsoft-HTTPAPI/2.0 (kernel-level HTTP.sys), blocking header injection before it reaches IIS.

I4: Path Traversal Blocked

  • Severity: INFORMATIONAL (POSITIVE)
  • Evidence:
    • ..%2f sequences → 403 Forbidden (blocked by HTTP.sys)
    • ..%5c (backslash) → 403 Forbidden
    • %00 null byte → 403 Forbidden
    • ..// sequences → 200 (returns SPA shell, not actual file)
  • Impact: IIS/HTTP.sys effectively blocks path traversal attacks.

I5: robots.txt Leaks Some Internal Routes

  • Severity: LOW
  • robots.txt content: 
    User-agent: meta-externalfetcher
User-agent: facebookexternalhit/*
User-agent: facebookcatalog
Allow: /document
Allow: /image
  • Impact: Reveals /document and /image routes exist. Minor information disclosure.

Phase-by-Phase Test Results

Phase 1: URL Parameter Injection (8 tests)

Test Payload HTTP Code Reflected? Result
q_xss ?q=<script>alert(1)</script> 200 NO PASS — Static SPA shell returned
redirect_js ?redirect=javascript:alert(1) 200 NO PASS — Static SPA shell returned
callback_img ?callback=<img+src=x+onerror=alert(1)> 200 NO PASS — Static SPA shell returned
search_svg ?search=<svg/onload=alert(1)> 200 NO PASS — Static SPA shell returned
id_sqli ?id=1' OR 1=1-- 200 NO PASS — Static SPA shell returned
page_lfi ?page=../../../../etc/passwd 200 NO PASS — Static SPA shell returned
url_ssrf ?url=http://169.254.169.254/latest/meta-data/ 200 NO PASS — Static SPA shell returned
template_ssti ?template={{7*7}} 200 NO PASS — Static SPA shell returned

Analysis: IIS serves the pre-built Angular index.html for all routes. URL parameters are never processed server-side and never reflected in the HTML. No server-side XSS, SQLi, LFI, SSRF, or SSTI possible via URL params.

Phase 2: Angular Route/Hash Injection (3 tests)

Test Payload HTTP Code Result
returnUrl_js /login?returnUrl=javascript:alert(1) 200 PASS — SPA shell, no redirect
hash_script /#/<script>alert(1)</script> 200 PASS — SPA shell, hash not processed server-side
open_redirect /login?next=//evil.com 200 PASS — No redirect, SPA shell returned

Analysis: No open redirect. Hash fragments and query params handled client-side by Angular. Server does not process or redirect based on these values. Angular's built-in sanitization would need browser testing to verify client-side behavior (browser tool unavailable).

Phase 3: API Endpoint Injection (10 tests)

Test Method Payload HTTP Code Body Result
sqli_agentlib GET ?id=1'OR'1'='1 401 Empty PASS — Auth gate blocks before processing
sqli_lessons GET ?id=1;DROP TABLE users-- 401 Empty PASS
sqli_customers GET ?email=test@test.com' OR '1'='1 401 Empty PASS
xss_user_path GET /api/user/<script>alert(1)</script> 400 "Bad Request - Invalid URL" PASS — HTTP.sys blocks bad chars in path
xss_post_agentlib POST {"name":"<script>alert(1)</script>"} 401 Empty PASS
ssti_lessons_1 GET ?q={{7*7}} 401 Empty PASS
ssti_lessons_2 GET ?q=${7*7} 401 Empty PASS
cmdi_file_1 GET ?file=;ls -la 401 Empty PASS
cmdi_file_2 GET ?file=|cat /etc/passwd 401 Empty PASS

Analysis: All API endpoints require authentication and reject unauthenticated requests with clean 401 responses containing no body/error details. The auth middleware runs before any parameter processing, making these injection vectors unreachable without valid credentials. HTTP.sys blocks malicious characters in URL paths at the kernel level (400 Bad Request).

Phase 4: SignalR Hub Injection (8 tests)

Test Hub Payload HTTP Code Result
chatHub_xss chatHub uid=<script>alert(1)</script> 401 PASS — Auth required
chatHub_sqli chatHub uid=1' OR '1'='1 401 PASS
chatHub_ssti chatHub uid={{7*7}} 401 PASS
uiHub_lfi uiHub uid=../../etc/passwd 401 PASS
uiHub_xss uiHub uid=<img src=x onerror=alert(1)> 401 PASS

Note: Initial tests without Content-Length: 0 returned 411 Length Required from HTTP.sys. With proper headers, all returned 401 — SignalR hubs require authentication.

Phase 5: HTTP Header Injection (5 tests)

Test Injection HTTP Code Result
Host: evil.com Host header 503 PASS — IIS rejects mismatched Host header
X-Forwarded-Host: evil.com Header injection 200 PASS — Header ignored, normal SPA served
X-Forwarded-For: 127.0.0.1 IP spoof for API 401 PASS — No IP-based auth bypass
CRLF Set-Cookie %0d%0aSet-Cookie: hacked=true 400 PASS — HTTP.sys blocks CRLF
CRLF X-Injected %0d%0aX-Injected: true 400 PASS — HTTP.sys blocks CRLF

Analysis: HTTP.sys provides kernel-level protection against CRLF injection. IIS properly validates Host headers (503 for mismatch). No header injection possible.

Phase 6: Path Traversal (8 tests)

Test Payload HTTP Code Result
..%2f encoded /..%2f..%2f..%2fetc%2fpasswd 403 PASS — HTTP.sys blocks
..// double /....//....//....//etc/passwd 200 PASS — Returns SPA shell
%252e%252e%252f triple Triple-encoded 404 PASS — IIS returns 404
assets/..%2f..%2fweb.config Asset traversal 403 PASS — HTTP.sys blocks
assets/../../../web.config Normalized traversal 404 PASS — IIS normalizes and returns 404
..%5c backslash Windows-style traversal 403 PASS — HTTP.sys blocks
..\..\ backslash Windows backslash 403 PASS — HTTP.sys blocks
%00 null byte Null byte injection 403 PASS — HTTP.sys blocks

Analysis: IIS/HTTP.sys has robust path traversal protection. All encoded traversal attempts are blocked at the kernel level (403). Normalized paths resolve to 404 or the SPA shell. No actual file system traversal achieved.

Phase 7: GHL Form / Webhook Injection (2 tests)

Test Endpoint Payload HTTP Code Result
Webhook XSS leadconnectorhq.com webhook {"name":"<script>alert(1)</script>"} 200 ⚠️ FAIL — Payload accepted and stored
GHL form submit link.realwave.com/widget/form/submit XSS in name field 404 PASS — Endpoint doesn't exist at that path

Analysis: The GHL webhook accepted the XSS payload without sanitization and returned {"status":"Success"}. This means malicious content is now stored in the GHL CRM. If GHL renders this unsanitized in any admin view, it's Stored XSS. See finding H2.

Phase 8: Browser-Based Testing

STATUS: Browser tool (clawd profile) was unavailable during testing. DOM-based XSS testing via browser was not performed.

Recommendation: Perform follow-up browser testing to check:

  1. Angular template injection via DOM manipulation
  2. Client-side routing behavior with XSS payloads in hash fragments
  3. Form input fields for client-side XSS
  4. Firebase Auth error message rendering

Phase 9: IIS/ASP.NET Path Fuzzing (21 paths tested)

Path Status Notes
/web.config 404 Protected
/Web.config 404 Protected
/Global.asax 404 Protected
/elmah.axd 404 Not installed or protected
/trace.axd 404 Not installed or protected
/iisstart.htm 404 Removed
/_vti_bin/ 200 Returns SPA shell (catch-all routing, not actual vti content)
/aspnet_client/ 200 Returns SPA shell (catch-all routing)
/Telerik.Web.UI.WebResource.axd 404 Not installed
/ScriptResource.axd 404 Not installed
/appsettings.json 404 Protected
/swagger/index.html 404 Not exposed
/swagger/v1/swagger.json 404 Not exposed
/api/swagger.json 404 Not exposed
/.env 404 Protected
/.git/config 200 False positive — Returns SPA shell (catch-all routing), not actual git config
/.git/HEAD 200 False positive — Returns SPA shell
/robots.txt 200 Contains basic Facebook crawler rules
/sitemap.xml 404 Not present
/.well-known/security.txt 404 Not present
/security.txt 404 Not present

Analysis: IIS is properly configured to block access to sensitive files (web.config, Global.asax, .env, appsettings.json). The 200s for _vti_bin/, aspnet_client/, .git/config, .git/HEAD are all false positives — they return the Angular SPA shell due to catch-all routing, not actual sensitive file content.

Phase 10: Rate Limiting (70 total requests)

Target Requests Results Rate Limited?
/api/Academy/AgentLibrary 50 rapid All 401 NO ❌
/chatHub/negotiate 20 rapid All 401 NO ❌

Analysis: Zero rate limiting detected. All 70 requests completed successfully with consistent 401 responses and no throttling, blocking, or captcha challenges. See finding H1.

Overall Pass/Fail Summary

Category Tests Passed Failed Notes
URL Parameter Injection 8 8 0 Static SPA, no reflection
Angular Route Injection 3 3 0 Server-side safe
API Injection (SQLi/XSS/SSTI/CMDi) 10 10 0 Auth gate blocks all
SignalR Hub Injection 5 5 0 Auth required
HTTP Header Injection 5 5 0 HTTP.sys blocks
Path Traversal 8 8 0 HTTP.sys/IIS blocks
GHL Webhook Injection 2 1 1 Webhook accepts XSS
IIS Path Fuzzing 21 21 0 Sensitive files blocked
Rate Limiting 2 0 2 No rate limiting at all
Security Headers 1 0 1 All missing
TOTAL 65 61 4 93.8% pass rate

Prioritized Recommendations

Immediate (This Week)

  1. Add security headers via IIS web.config:

    <httpProtocol>
  <customHeaders>
    <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self' https://www.googletagmanager.com https://code.jquery.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://link.realwave.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com wss://*.realwave.com;" />
    <add name="X-Frame-Options" value="DENY" />
    <add name="X-Content-Type-Options" value="nosniff" />
    <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
    <add name="Permissions-Policy" value="camera=(), microphone=(), geolocation=()" />
    <remove name="X-Powered-By" />
  </customHeaders>
</httpProtocol>

  2. Add HSTS:

    <rewrite>
  <outboundRules>
    <rule name="HSTS">
      <match serverVariable="RESPONSE_Strict-Transport-Security" pattern=".*" />
      <action type="Rewrite" value="max-age=31536000; includeSubDomains" />
    </rule>
  </outboundRules>
</rewrite>

  3. Suppress server version:

    <security>
  <requestFiltering removeServerHeader="true" />
</security>

Short-Term (This Month)

  1. Implement rate limiting on all API endpoints and SignalR hubs
  2. Add webhook authentication (HMAC signature verification) to the GHL webhook
  3. Sanitize GHL webhook input — strip HTML tags from name/email/phone fields before storing
  4. Add security.txt at /.well-known/security.txt

Medium-Term

  1. Deploy WAF/CDN (Cloudflare recommended) in front of the server
  2. Perform authenticated penetration testing — all API/SignalR endpoints are behind auth; the real attack surface is post-authentication
  3. Browser-based DOM XSS testing — Angular's bypassSecurityTrustHtml or innerHTML bindings need manual review

Technical Notes

  • Server fingerprint: IIS 10.0, ASP.NET, HTTP.sys (kernel-level HTTP processing)
  • SPA framework: Angular (pre-rendered, with Firebase Auth)
  • Key JS files: main.65fba4543aaecdb5.js, runtime.c5795ac5d6fe72dc.js, polyfills.3a9bb28188fb46f8.js
  • External dependencies: jQuery 3.7.1, Bootstrap 5.1.3, Font Awesome 6.4.0, Monaco Editor, GHL form embed
  • Google Analytics: G-70DG95YYYQ
  • GHL Location ID: 8jJylXIxcMrt2E2RW0hW

Report generated by Clawdbot Security Testing Subagent All testing was authorized by site owner Jake Shore