4.6 KiB
Web API Pentesting
Basic Information
Main:
- Web Services (SOAP/XML)
- The documentation uses WSDL format and is usually saved in the
?wsdl
path likehttps://api.example.com/api/?wsdl
- An example of this documentation can be found in http://www.dneonline.com/calculator.asmx
WSDL document in [http://www.dneonline.com/calculator.asmx?wsdl](http://www.dneonline.com/calculator.asmx?wsdl)
and you can see an example request calling theAdd
method in http://www.dneonline.com/calculator.asmx?op=Add
- The documentation uses WSDL format and is usually saved in the
- REST APIs (JSON)
- The standard documentation is the WADL file. Find an example here: https://www.w3.org/Submission/wadl/. However, there are other more developer friendly API representation engines like https://swagger.io/tools/swagger-ui/
check the demo in the page
- The standard documentation is the WADL file. Find an example here: https://www.w3.org/Submission/wadl/. However, there are other more developer friendly API representation engines like https://swagger.io/tools/swagger-ui/
Tricks
Public and private endpoints
Create a list with the public and private endpoints to know which information should be confidential and try to access it in "unathorized" ways.
Patterns
Search for API patterns inside the api and try to use it to discover more.
If you find /api/albums/<album_id>/photos/<photo_id> ****you could try also things like /api/posts/<post_id>/comment/. Use some fuzzer to discover this new endpoints.
Add parameters
Something like the following example might get you access to another user’s photo album:
/api/MyPictureList → /api/MyPictureList?user_id=<other_user_id>
Replace parameters
You can try to fuzz parameters or use parameters you have seen in a different endpoints to try to access other information
For example, if you see something like: /api/albums?album_id=<album id>
You could replace the album_id
parameter with something completely different and potentially get other data: /api/albums?account_id=<account id>
Parameter pollution
/api/account?id=<your account id> → /api/account?id=<your account id>&id=<admin's account id>
Wildcard parameter
Try to use the following symbols as wildcards: *, %, _, .
- /api/users/*
- /api/users/%
- /api/users/_
- /api/users/.
HTTP requet method change
You can try to use the HTTP methods: GET, POST, PUT, DELETE, PATCH, INVENTED to try check if the web server gives you unexpected information with them.
Request content-type
Try to play between the following content-types bodifying acordinly the request body
to make the web server behave unexpectedly:
- x-www-form-urlencoded --> user=test
- application/xml --> <user>test</user>
- application/json --> {"user": "test"}
Parameters types
If JSON data is working try so send unexpected data types like:
- {"username": "John"}
- {"username": true}
- {"username": null}
- {"username": 1}
- {"username": [true]}
- {"username": ["John", true]}
- {"username": {"$neq": "lalala"}}
- any other combination you may imagine
If you can send XML data, check for XXE injections.
If you send regular POST data, try to send arrays and dictionaries:
- username[]=John
- username[$neq]=lalala
Play with routes
/files/..%2f..%2f + victim ID + %2f + victim filename
Check possible versions
Old versions may be still be in use and be more vulenrable than latest endpoints
/api/v1/login
/api/v2/login
/api/CharityEventFeb2020/user/pp/<ID>
/api/CharityEventFeb2021/user/pp/<ID>
Owasp API Security Top 10
Read this document to learn how to search and exploit Owasp Top 10 API vulnerabilities: https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf
API Security Checklist
{% embed url="https://github.com/shieldfy/API-Security-Checklist" %}
List of possible API endpoints
https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d
Tools
https://github.com/imperva/automatic-api-attack-tool: Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.
https://github.com/flipkart-incubator/Astra: Another tool for api testing