How to check a re-test result

When you re-test a finding, ensure that the re-test is executing and wait for it to finish to determine whether the vulnerability is fixed.

Step 1: Validate the re-test is executing

You will need the findings and target identifiers to start a re-test. You obtain them after starting a re-test.

In this request, the finding identifier is 1 and the target identifier is 2oir9t8RKxdr.

Request

curl https://api.probely.com/targets/2oir9t8RKxdr/findings/1 \
  -X GET \
  -H 'Authorization: JWT <YOUR_API_TOKEN>' \
  -H 'Content-Type: application/json

The response will return the finding and it must have the retesting property set as true, meaning that the re-test is executing. If it is false, you missed the re-test.

note

Please note that you will find some values truncated (ending with ...) to facilitate reading because they were too long. However, the values will be complete in the response you will get.

Response

{
    "id": 1,
    "target": {
        "id": "2oir9t8RKxdr",
        "name": "",
        "site": {
            "id": "UYzh6mLxffx9",
            "name": "My target",
            "desc": "",
            "url": "http://example.com",
            "host": "example.com",
            ...
        },
        ...
    },
    "scans": [
        "1WUWTpK9zZmQ",
        "2Mkr8fzTZqUf",
        "3d7BuuDmTurH",
        "3yxFhVNbF9N9",
        "49v8fkNSnLtz",
        "HCk5RHWDESYz",
        "LU7aqVDVcygF",
        "M6BqwS5ra8AH",
        "p2PaP4HYq9ih",
        "w2gDDvPoP7ga"
    ],
    "labels": [],
    "fix": "This problem can be fixed by sending...",
    "requests": [
        {
            "request": "```\nGET...```",
            "response": "```\nHTTP/1.1 200 OK...```"
        }
    ],
    "evidence": "Response headers, missing ...",
    "extra": "",
    "definition": {
        "id": "qXu26S0jS04A",
        "name": "Referrer policy not defined",
        "desc": "The application does not prevent..."
    },
    "url": "http://example.com/",
    "path": "http://example.com/",
    "method": "get",
    "insertion_point": "",
    "parameter": "",
    "value": "",
    "params": {},
    "assignee": null,
    "state": "notfixed",
    "severity": 10,
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
    "last_found": "2024-06-04T16:29:55.858900Z",
    "retesting": true,
    "new": false,
    ...
}

Step 2: Check the re-test result

Repeat the request regularly until retesting becomes false, meaning the re-test is finished.

Request

curl https://api.probely.com/targets/2oir9t8RKxdr/findings/1 \
  -X GET \
  -H 'Authorization: JWT <YOUR_API_TOKEN>' \
  -H 'Content-Type: application/json

The response will return the finding with the result in the state property:

• fixed - The vulnerability is fixed.
• notfixed - The vulnerability is not fixed.

note

Please note that you will find some values truncated (ending with ...) to facilitate reading because they were too long. However, the values will be complete in the response you will get.

Response

{
    "id": 1,
    "target": {
        "id": "2oir9t8RKxdr",
        "name": "",
        "site": {
            "id": "UYzh6mLxffx9",
            "name": "My target",
            "desc": "",
            "url": "http://example.com",
            "host": "example.com",
            ...
        },
        ...
    },
    "scans": [
        "1WUWTpK9zZmQ",
        "2Mkr8fzTZqUf",
        "3d7BuuDmTurH",
        "3yxFhVNbF9N9",
        "49v8fkNSnLtz",
        "HCk5RHWDESYz",
        "LU7aqVDVcygF",
        "M6BqwS5ra8AH",
        "p2PaP4HYq9ih",
        "w2gDDvPoP7ga"
    ],
    "labels": [],
    "fix": "This problem can be fixed by sending...",
    "requests": [
        {
            "request": "```\nGET...```",
            "response": "```\nHTTP/1.1 200 OK...```"
        }
    ],
    "evidence": "Response headers, missing ...",
    "extra": "",
    "definition": {
        "id": "qXu26S0jS04A",
        "name": "Referrer policy not defined",
        "desc": "The application does not prevent..."
    },
    "url": "http://example.com/",
    "path": "http://example.com/",
    "method": "get",
    "insertion_point": "",
    "parameter": "",
    "value": "",
    "params": {},
    "assignee": null,
    "state": "fixed",
    "severity": 10,
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
    "last_found": "2024-06-04T16:29:55.858900Z",
    "retesting": false,
    "new": false,
    ...
}

If the vulnerability is not fixed, you can review your implementation and, when done, start another re-test and check the results again like what is explained here in this tutorial.