Skip to content

Commit 3d27d7d

Browse files
notshivanshnotshivansh
authored
Merge pull request #209 from akto-api-security/feature/more_tests
add more tests
2 parents 3243624 + 0db5d4b commit 3d27d7d

File tree

4 files changed

+281
-3
lines changed

4 files changed

+281
-3
lines changed

‎Broken-Object-Level-Authorization/BOLAURLReplaceUserIDQueryParam.yml‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
id: BOLA_REPLACE_USER_ID_QUERY_PARAM
2+
info:
3+
name: "Exploiting BOLA by replacing User IDs for Unauthorized Access."
4+
description: >
5+
This test checks for Broken Object Level Authorization (BOLA) vulnerabilities by modifying URL query parameters related to user identification (such as UserId, user_id, etc.) and replacing their values with common privileged identifiers (e.g., admin, root, superuser). The goal is to determine if unauthorized access to resources is possible by manipulating these parameters.
6+
details: >
7+
The test targets API endpoints that use user-related query parameters. It systematically replaces these parameters with values like "admin" or "root" and sends requests to the server. The test then validates the responses to ensure that unauthorized access is not granted. It checks for successful response codes (2xx), non-empty payloads, and ensures the response does not contain error or denial messages, nor does it closely match the original user's data, indicating a possible privilege escalation or data leak.
8+
impact: >
9+
If the test is successful, it indicates that attackers could gain unauthorized access to sensitive data or perform actions as privileged users by simply modifying query parameters. This could lead to data breaches, unauthorized transactions, or compromise of user accounts, highlighting a critical need to enforce strict object-level authorization on all endpoints that accept user-identifying parameters.
10+
category:
11+
name: BOLA
12+
shortName: BOLA
13+
displayName: Broken Object Level Authorization (BOLA)
14+
subCategory: BOLA_REPLACE_USER_ID_QUERY_PARAM
15+
severity: HIGH
16+
tags:
17+
- Business logic
18+
- OWASP top 10
19+
- HackerOne top 10
20+
references:
21+
- "https://www.akto.io/blog/bola-exploitation-using-unauthorized-uuid-on-api-endpoint"
22+
- "https://www.akto.io/blog/what-is-broken-object-level-authorization-bola"
23+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa1-broken-object-level-authorization.md"
24+
- "https://cwe.mitre.org/data/definitions/284.html"
25+
- "https://cwe.mitre.org/data/definitions/285.html"
26+
- "https://cwe.mitre.org/data/definitions/639.html"
27+
cwe:
28+
- CWE-284
29+
- CWE-285
30+
- CWE-639
31+
cve:
32+
- CVE-2022-34770
33+
34+
attributes:
35+
nature: INTRUSIVE
36+
plan: PRO
37+
duration: FAST
38+
39+
auth:
40+
authenticated: true
41+
api_selection_filters:
42+
response_code:
43+
gte: 200
44+
lt: 300
45+
method:
46+
neq: "OPTIONS"
47+
response_payload:
48+
length:
49+
gt: 0
50+
not_contains:
51+
- Error
52+
- Internal Server
53+
- Failed
54+
- Unauthorized
55+
- access denied
56+
- Forbidden
57+
- Method Not allowed
58+
- Gateway timeout
59+
- request timeout
60+
- server error
61+
- server busy
62+
- authentication error
63+
- authorization error
64+
- validation error
65+
- Permission Denied
66+
- invalid token
67+
- token expired
68+
- session expired
69+
- session timeout
70+
- unexpected error
71+
- unable to process request
72+
- bad request
73+
- service unavailable
74+
- account is locked
75+
- account is blocked
76+
- multiple failed attempts
77+
- failure
78+
- not available
79+
- not found
80+
query_param:
81+
for_one:
82+
key:
83+
regex: "^UserId$|^UserID$|^User-ID$|^user_id$|^user-id$|^userid$|^username$|^Username$|^USERNAME$|^uId$|^uid$|^UID$|^member_id$|^MemberId$|^memberId$|^profile_id$|^ProfileId$|^profileId$|^userIdentifier$|^UserIdentifier$|^user_identifier$|^account_id$|^AccountID$|^account-id$|^account_id$|^customer_id$|^CustomerID$|^customer-id$|^customer_id$"
84+
extract: userKey
85+
value:
86+
not_contains: ${attempt_Ids}
87+
88+
wordLists:
89+
attempt_Ids:
90+
- superuser
91+
- master
92+
- admin
93+
- root
94+
95+
execute:
96+
type: single
97+
requests:
98+
- req:
99+
- modify_query_param:
100+
userKey: ${attempt_Ids}
101+
102+
validate:
103+
response_code:
104+
gte: 200
105+
lt: 300
106+
response_payload:
107+
length:
108+
gt: 0
109+
percentage_match:
110+
gt: 40
111+
percentage_match_schema:
112+
gte: 90
113+
not_contains:
114+
- Error
115+
- Internal Server
116+
- Failed
117+
- Unauthorized
118+
- access denied
119+
- Forbidden
120+
- Method Not allowed
121+
- Gateway timeout
122+
- request timeout
123+
- server error
124+
- server busy
125+
- authentication error
126+
- authorization error
127+
- validation error
128+
- Permission Denied
129+
- invalid token
130+
- token expired
131+
- session expired
132+
- session timeout
133+
- unexpected error
134+
- unable to process request
135+
- bad request
136+
- service unavailable
137+
- account is locked
138+
- account is blocked
139+
- multiple failed attempts
140+
- failure
141+
- not available
142+
- not found
143+
- "<html>"
144+
- "</html>"

‎Broken-User-Authentication/NoSQLiErrorBasedParamMongoSpecialCharacters.yml‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ info:
1212
shortName: Broken Authentication
1313
displayName: Broken User Authentication (BUA)
1414
subCategory: NOSQLI_ERROR_BASED_PARAM_MONGO_SPECIAL_CHARACTERS
15-
severity: MEDIUM
15+
severity: HIGH
1616
tags:
1717
- Injection Attack
1818
- OWASP Top 10
@@ -80,21 +80,32 @@ api_selection_filters:
8080
- request_payload:
8181
for_one:
8282
key:
83-
regex: .*
83+
contains_either: ${attempt_Ids}
8484
extract: changed_body_key
8585
- query_param:
8686
for_one:
8787
key:
88-
regex: .*
88+
contains_either: ${attempt_Ids}
8989
extract: changed_query_key
9090
wordLists:
91+
attempt_Ids:
92+
- "name"
93+
- "username"
94+
- "email"
95+
- "password"
96+
- "userId"
97+
- "userID"
98+
- "user-id"
99+
- "userid"
100+
- "id"
91101
specialCharacters:
92102
- "'"
93103
- "\""
94104
- "$"
95105
- "."
96106
- ">"
97107
- "[\",\"]"
108+
- "{\"$ne\": null}"
98109
- "{\"$gt\": \"\"}"
99110
- "{\"$ne\": \"nonexistentname\"}"
100111
- "{\"$where\": \"function() { throw 'Error'; }\"}"
@@ -120,6 +131,13 @@ validate:
120131
regex: "(?i)unterminated string literal"
121132
- response_payload:
122133
regex: "Cast to string failed for value"
134+
- response_payload:
135+
length:
136+
gt: 0
137+
percentage_match:
138+
- gte: 30
139+
percentage_match_schema:
140+
- gte: 50
123141
response_payload:
124142
not_contains:
125143
- failed

‎Security-Misconfiguration/StackTraceExposedChangeAuth.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
id: STACK_TRACE_EXPOSED_CHANGE_AUTH
2+
info:
3+
name: "Stack Trace Exposure via Auth Header Manipulation"
4+
description: >
5+
This test checks if stack traces or debugging information are exposed in API responses when the authentication header is replaced or tampered with. It targets endpoints that return a successful (2xx) response and inspects the payload for stack trace indicators such as "stack", "trace", or "stacktrace".
6+
details: >
7+
The test sends requests to API endpoints with the authentication header replaced, simulating an unauthorized or malformed authentication attempt. If the server responds with a 2xx status code, the response payload is analyzed for the presence of stack trace keywords. Exposure of such information can reveal sensitive implementation details, making the application more vulnerable to attacks.
8+
impact: >
9+
If stack traces or debugging information are exposed in API responses, attackers can gain insights into the application's internal logic, error handling, and potential vulnerabilities. This can facilitate further exploitation, information disclosure, and compromise of the application's security posture. Preventing stack trace exposure is essential to maintaining robust security and protecting sensitive data.
10+
category:
11+
name: SM
12+
shortName: Misconfiguration
13+
displayName: Security Misconfiguration (SM)
14+
subCategory: STACK_TRACE_EXPOSED_CHANGE_AUTH
15+
severity: MEDIUM
16+
references:
17+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa8-security-misconfiguration.md"
18+
cwe:
19+
- CWE-200
20+
- CWE-16
21+
cve:
22+
- CVE-2021-43798
23+
24+
attributes:
25+
nature: INTRUSIVE
26+
plan: PRO
27+
duration: FAST
28+
29+
api_selection_filters:
30+
method:
31+
neq: "OPTIONS"
32+
response_code:
33+
gte: 200
34+
lt: 300
35+
36+
execute:
37+
type: single
38+
requests:
39+
- req:
40+
- replace_auth_header: true
41+
42+
validate:
43+
response_payload:
44+
contains_either:
45+
- "stack"
46+
- "trace"
47+
- stacktrace

‎Server-Side-Request-Forgery/StandardSSRF.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
id: STANDARD_SSRF
3+
info:
4+
name: SSRF test by injecting internal URLs into query and body parameters
5+
description: >
6+
This test checks for Server-Side Request Forgery (SSRF) vulnerabilities by injecting internal URLs (such as https://test-services.akto.io) into query and body parameters of API requests. It validates whether the server makes unauthorized requests to these URLs, indicating a potential SSRF risk.
7+
details: >
8+
The test identifies parameters in the request payload or query string that accept URLs. It then replaces these parameters with internal URLs containing a random UUID and sends the request to the server. The test follows redirects and monitors if the server attempts to access the injected URL, confirming SSRF behavior. Successful exploitation is validated by checking for a 2xx response and verifying that the injected URL was hit by the server.
9+
impact: >
10+
If SSRF is possible, attackers can force the server to make requests to internal or external resources, potentially accessing sensitive data, cloud metadata, or internal services. This can lead to data breaches, privilege escalation, and compromise of internal infrastructure. Preventing SSRF is critical to maintaining the security and integrity of web applications and backend systems.
11+
category:
12+
name: SSRF
13+
shortName: Server Side Request Forgery
14+
displayName: Server Side Request Forgery (SSRF)
15+
subCategory: STANDARD_SSRF
16+
severity: MEDIUM
17+
tags:
18+
- Business logic
19+
- OWASP top 10
20+
- HackerOne top 10
21+
references:
22+
- https://github.com/OWASP/API-Security/blob/master/2023/en/src/0xa6-server-side-request-forgery.md
23+
- https://www.akto.io/blog/how-to-prevent-server-side-request-forgery-ssrf-as-a-developer
24+
cwe:
25+
- CWE-918
26+
cve:
27+
- CVE-2022-4725
28+
api_selection_filters:
29+
response_code:
30+
and:
31+
gte: 200
32+
lt: 205
33+
or:
34+
- request_payload:
35+
for_one:
36+
key:
37+
regex: .*
38+
extract: param_key
39+
value:
40+
regex: http
41+
- query_param:
42+
for_one:
43+
key:
44+
regex: .*
45+
extract: param_key
46+
value:
47+
regex: http
48+
49+
wordLists:
50+
redirect_urls:
51+
- https://test-services.akto.io/health
52+
53+
execute:
54+
type: single
55+
requests:
56+
- req:
57+
- send_ssrf_req:
58+
url: "https://test-services.akto.io/store_uuid/${random_uuid}"
59+
redirect_url: "${redirect_urls}"
60+
- follow_redirect: true
61+
- modify_query_param:
62+
param_key: "https://test-services.akto.io/${random_uuid}"
63+
- modify_body_param:
64+
param_key: "https://test-services.akto.io/${random_uuid}"
65+
validate:
66+
response_code:
67+
gte: 200
68+
lt: 300
69+
ssrf_url_hit: "${random_uuid}"

0 commit comments

Comments
 (0)