hacktricks/network-services-pentesting/pentesting-web/web-api-pentesting.md

253 lines
14 KiB
Markdown
Raw Normal View History

2022-05-16 08:29:00 +00:00
# Web API Pentesting
2022-04-28 16:01:33 +00:00
<details>
2022-12-11 19:30:44 +00:00
<summary><a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ HackTricks LIVE Twitch</strong></a> <strong>Wednesdays 5.30pm (UTC) 🎙️ -</strong> <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
2022-04-28 16:01:33 +00:00
2022-09-30 10:27:15 +00:00
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
2022-12-11 19:30:44 +00:00
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
2022-04-28 16:01:33 +00:00
</details>
2023-01-01 16:19:07 +00:00
![](<../.gitbook/assets/image (9) (1) (2).png>)
2022-06-06 22:28:05 +00:00
2023-01-01 16:19:07 +00:00
\
Use [**Trickest**](https://trickest.io/) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
Get Access Today:
2022-06-06 22:28:05 +00:00
2023-01-01 16:19:07 +00:00
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
2022-06-06 22:28:05 +00:00
2022-05-16 08:29:00 +00:00
## Basic Information
2021-06-08 18:47:44 +00:00
Main:
2022-05-16 08:29:00 +00:00
* **Web Services (SOAP/XML)**
* The documentation uses **WSDL** format and is usually saved in the `?wsdl` path like `https://api.example.com/api/?wsdl`
* An example of this documentation can be found in [http://www.dneonline.com/calculator.asmx](http://www.dneonline.com/calculator.asmx) (WSDL document in [http://www.dneonline.com/calculator.asmx?wsdl](http://www.dneonline.com/calculator.asmx?wsdl)) and you can see an example request calling the `Add` method in [http://www.dneonline.com/calculator.asmx?op=Add](http://www.dneonline.com/calculator.asmx?op=Add)
* For parsing these files and create example requests you and use the tool **SOAPUI** or the **WSDLer** Burp Suite Extension.
* **REST APIs (JSON)**
* The standard documentation is the WADL file. Find an example here: [https://www.w3.org/Submission/wadl/](https://www.w3.org/Submission/wadl/). However, there are other more developer friendly API representation engines like [https://swagger.io/tools/swagger-ui/](https://swagger.io/tools/swagger-ui/) (check the demo in the page)
* For parsing these files and create example requests you an use the tool **Postman**
2022-04-05 22:24:52 +00:00
* [**GraphQL**](graphql.md)
2022-12-21 10:38:32 +00:00
## Labs
* [**VAmPI**](https://github.com/erev0s/VAmPI)**:** VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs.
2022-05-16 08:29:00 +00:00
## Tricks
2022-05-16 08:29:00 +00:00
### SOAP/XML
These kind of APIs may be [**vulnerable to XXE**](../../pentesting-web/xxe-xee-xml-external-entity.md), but usually **DTD Declarations** are **disallowed** in the input from the user.
You could also try to use CDATA tags to insert payloads (as long as the XML is valid)
![](<../../.gitbook/assets/image (534).png>)
2022-05-16 08:29:00 +00:00
### Check Access
Usually some API endpoints are gong to need more privileges that others. Always try to access the more privileged endpoints from less privileged (unauthorized) accounts to see if it's possible.
2022-05-16 08:29:00 +00:00
### CORS
Always check the [**CORS**](../../pentesting-web/cors-bypass.md) configuration of the API, as if its allowing to end request with the credentials from the attacker domain, a lot of damage can be done via [**CSRF**](../../pentesting-web/csrf-cross-site-request-forgery.md) from authenticated victims.
2022-05-16 08:29:00 +00:00
### Patterns
Search for API patterns inside the api and try to use it to discover more.\
2022-05-16 08:29:00 +00:00
If you find _/api/albums/**\<album\_id>**/photos/**\<photo\_id>**_\*\* \*\* you could try also things like _/api/**posts**/\<post\_id>/**comment**/_. Use some fuzzer to discover this new endpoints.
2022-05-16 08:29:00 +00:00
### Add parameters
Something like the following example might get you access to another users photo album:\
2021-11-30 16:46:07 +00:00
_/api/MyPictureList → /api/MyPictureList?**user\_id=\<other\_user\_id>**_
2022-05-16 08:29:00 +00:00
### Replace parameters
2021-11-30 16:46:07 +00:00
You can try to **fuzz parameters** or **use** parameters **you have seen** in a different endpoints to try to access other information
2021-11-30 16:46:07 +00:00
For example, if you see something like: _/api/albums?**album\_id=\<album id>**_
2021-11-30 16:46:07 +00:00
You could **replace** the **`album_id`** parameter with something completely different and potentially get other data: _/api/albums?**account\_id=\<account id>**_
2022-05-16 08:29:00 +00:00
### Parameter pollution
2022-05-16 08:29:00 +00:00
/api/account?**id=\<your account id>** → /api/account?**id=\<your account id>\&id=\<admin's account id>**
2022-05-16 08:29:00 +00:00
### Wildcard parameter
2021-03-04 11:50:43 +00:00
2021-11-30 16:46:07 +00:00
Try to use the following symbols as wildcards: **\***, **%**, **\_**, **.**
2021-03-04 11:50:43 +00:00
2022-04-05 22:24:52 +00:00
* /api/users/\*
2021-03-04 11:50:43 +00:00
* /api/users/%
* /api/users/\_
* /api/users/.
2022-05-16 08:29:00 +00:00
### HTTP request method change
You can try to use the HTTP methods: **GET, POST, PUT, DELETE, PATCH, INVENTED** to try check if the web server gives you unexpected information with them.
2022-05-16 08:29:00 +00:00
### Request content-type
Try to play between the following content-types (bodifying acordinly the request body) to make the web server behave unexpectedly:
2021-11-30 16:46:07 +00:00
* **x-www-form-urlencoded** --> user=test
2022-05-16 08:29:00 +00:00
* **application/xml** --> \<user>test\</user>
* **application/json** --> {"user": "test"}
2022-05-16 08:29:00 +00:00
### Parameters types
2021-03-04 11:50:43 +00:00
2021-11-30 16:46:07 +00:00
If **JSON** data is working try so send unexpected data types like:
2021-03-04 11:50:43 +00:00
* {"username": "John"}
* {"username": true}
2021-03-05 12:03:56 +00:00
* {"username": null}
2021-03-04 11:50:43 +00:00
* {"username": 1}
* {"username": \[true]}
* {"username": \["John", true]}
2022-05-16 08:29:00 +00:00
* {"username": {"$neq": "lalala"\}}
2021-03-04 11:50:43 +00:00
* any other combination you may imagine
2021-11-30 16:46:07 +00:00
If you can send **XML** data, check for [XXE injections](../../pentesting-web/xxe-xee-xml-external-entity.md).
2021-03-04 11:50:43 +00:00
If you send regular POST data, try to send arrays and dictionaries:
* username\[]=John
* username\[$neq]=lalala
2021-03-04 11:50:43 +00:00
2022-05-16 08:29:00 +00:00
### Play with routes
`/files/..%2f..%2f + victim ID + %2f + victim filename`
2022-05-16 08:29:00 +00:00
### Check possible versions
2021-09-14 10:56:33 +00:00
Old versions may be still be in use and be more vulnerable than latest endpoints
* `/api/v1/login`
2022-05-16 08:29:00 +00:00
* `/api/v2/login`\\
2022-04-05 22:24:52 +00:00
* `/api/CharityEventFeb2020/user/pp/<ID>`
* `/api/CharityEventFeb2021/user/pp/<ID>`
2022-09-27 09:36:19 +00:00
### Check possible versions (automated approach)
2022-09-30 10:27:15 +00:00
2022-09-27 09:36:19 +00:00
AutoRepeater Burp Extension: Add a replacement rule
2022-09-30 10:27:15 +00:00
2022-09-27 09:36:19 +00:00
* `Type: Request String`
* `Match: v2 (higher version)`
* `Replace: v1 (lower version)`
2023-01-01 16:19:07 +00:00
![](<../.gitbook/assets/image (9) (1) (2).png>)
2022-06-06 22:28:05 +00:00
2023-01-01 16:19:07 +00:00
\
Use [**Trickest**](https://trickest.io/) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
Get Access Today:
2022-06-06 22:28:05 +00:00
2023-01-01 16:19:07 +00:00
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
2022-06-06 22:28:05 +00:00
2022-05-16 08:29:00 +00:00
## 🛡️ API Security Empire Cheat Sheet
\
Cheat Sheet Author: [Momen Eldawakhly (Cyber Guy)](https://www.linkedin.com/in/momen-eldawakhly-3b6250204)\
\
2022-05-08 16:39:22 +00:00
In this repository you will find: Mindmaps, tips & tricks, resources and every thing related to API Security and API Penetration Testing. Our mindmaps and resources are based on OWASP TOP 10 API, our expereince in Penetration testing and other resources to deliver the most advanced and accurate API security and penetration testing resource in the WEB!!
2022-05-16 08:29:00 +00:00
### 🚪 First gate: `{{Recon}}`
2022-05-08 16:39:22 +00:00
The first gate to enter the API Security Empire is to know how to gather information about the API infrastructure and how to perform a powerfull recon on API to extract the hidden doors which made you compromise the whole infrastructure from, so, we provide this updated API Recon mindmap with the latest tools and methodologies in API recon:
2022-05-16 08:29:00 +00:00
\
![](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap.png)
[**PDF Version**](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap.pdf) **|** [**XMind Version**](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap.xmind)
#### ⚔️ Weapons you will need:
2022-05-08 16:39:22 +00:00
2022-05-16 08:29:00 +00:00
* [BurpSuite](https://portswigger.net/burp/releases)
* [FFUF](https://github.com/ffuf/ffuf)
* [Arjun](https://github.com/InsiderPhD/Arjun)
* [Postman](https://www.postman.com/downloads/)
* [SecLists](https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content)
* [FuzzDB](https://github.com/fuzzdb-project/fuzzdb)
* [SoapUI](https://www.soapui.org/downloads/soapui/)
* [GraphQL Voyager](https://apis.guru/graphql-voyager/)
* [Kiterunner](https://github.com/assetnote/kiterunner)
* [unfurl](https://github.com/tomnomnom/unfurl)
2022-05-08 16:39:22 +00:00
2022-05-16 08:29:00 +00:00
#### 🏋️ Test your abilities and weapons:
2022-05-08 16:39:22 +00:00
2022-05-16 08:29:00 +00:00
* [vapi](https://github.com/roottusk/vapi)
* [Generic-University](https://github.com/InsiderPhD/Generic-University)
2022-05-08 16:39:22 +00:00
2022-05-16 08:29:00 +00:00
### 🚪 Second gate: `{{Attacking}}`
2022-05-08 16:39:22 +00:00
2022-05-16 08:29:00 +00:00
#### Attacking RESTful & SOAP:
![](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap%20ATTACK.png)\
2022-08-29 15:44:50 +00:00
[**PDF Version**](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap%20ATTACK.pdf) **|** [**XMind Version**](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap%20ATTACK.xmind)\\
2022-05-16 08:29:00 +00:00
#### Attacking GraphQL:
2022-05-08 16:39:22 +00:00
Due to the limited attacks in the GraphQL we tried to generate all the possible attacks due to our experience in testing APIs in the coming mindmap:
2022-05-16 08:29:00 +00:00
![](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap%20%7B%7BGraphQL%20Attacking%7D%7D.png)\
2022-08-29 15:44:50 +00:00
[**PDF Version**](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap%20%7B%7BGraphQL%20Attacking%7D%7D.pdf) **|** [**XMind Version**](https://github.com/Cyber-Guy1/API-SecurityEmpire/blob/main/assets/API%20Pentesting%20Mindmap%20%7B%7BGraphQL%20Attacking%7D%7D.xmind)\\
2022-05-08 16:39:22 +00:00
2022-05-16 08:29:00 +00:00
## Owasp API Security Top 10
2021-11-30 16:46:07 +00:00
Read this document to learn how to **search** and **exploit** Owasp Top 10 API vulnerabilities: [https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf](https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf)
2022-05-16 08:29:00 +00:00
## API Security Checklist
{% embed url="https://github.com/shieldfy/API-Security-Checklist" %}
2022-09-27 09:36:19 +00:00
## Logger++ Filters for Hunting API Vulnerabilities
2022-09-30 10:27:15 +00:00
2022-09-27 09:36:19 +00:00
[https://github.com/bnematzadeh/LoggerPlusPlus-API-Filters](https://github.com/bnematzadeh/LoggerPlusPlus-API-Filters)
2022-05-16 08:29:00 +00:00
## List of possible API endpoints
[https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d](https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d)
2022-05-16 08:29:00 +00:00
## Tools
2022-06-21 16:32:08 +00:00
* [**kiterunner**](https://github.com/assetnote/kiterunner): Great tool to **discover API endpoints.**
2022-09-05 10:17:20 +00:00
```bash
kr scan https://domain.com/api/ -w routes-large.kite -x 20 # Downloaded from kiterunner repo
kr scan https://domain.com/api/ -A=apiroutes-220828 -x 20
kr brute https://domain.com/api/ -A=raft-large-words -x 20 -d=0
kr brute https://domain.com/api/ -w /tmp/lang-english.txt -x 20 -d=0
```
2022-06-21 16:32:08 +00:00
* [**automatic-api-attack-tool**](https://github.com/imperva/automatic-api-attack-tool): Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.
* [**Astra**](https://github.com/flipkart-incubator/Astra): Another tool for api testing to find several different web vulnerabilities.
* [**Susanoo**](https://github.com/ant4g0nist/Susanoo): Vulnerability API scanner.
* [**restler-fuzzer**](https://github.com/microsoft/restler-fuzzer): RESTler is the _first stateful REST API fuzzing tool_ for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service with an OpenAPI/Swagger specification, RESTler analyzes its entire specification, and then generates and executes tests that exercise the service through its REST API.
2022-08-29 15:44:50 +00:00
* [**TnT-Fuzzer**](https://github.com/Teebytes/TnT-Fuzzer)**:** TnT-Fuzzer is an OpenAPI (swagger) fuzzer written in python.
* [**APIFuzzer**](https://github.com/KissPeter/APIFuzzer)**:** APIFuzzer reads your API description and step by step fuzzes the fields to validate if you application can cope with the fuzzed parameters.
* [**API-fuzzer**](https://github.com/Fuzzapi/API-fuzzer): API\_Fuzzer gem accepts a API request as input and returns vulnerabilities possible in the API.
* [**race-the-web**](https://github.com/TheHackerDev/race-the-web): Tests for race conditions in web applications by sending out a user-specified number of requests to a target URL (or URLs) _simultaneously_, and then compares the responses from the server for uniqueness.
2022-04-28 16:01:33 +00:00
2023-01-01 16:19:07 +00:00
![](<../.gitbook/assets/image (9) (1) (2).png>)
2022-06-06 22:28:05 +00:00
2023-01-01 16:19:07 +00:00
\
Use [**Trickest**](https://trickest.io/) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
Get Access Today:
2022-06-06 22:28:05 +00:00
2023-01-01 16:19:07 +00:00
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
2022-06-06 22:28:05 +00:00
2022-04-28 16:01:33 +00:00
<details>
2022-12-11 19:30:44 +00:00
<summary><a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ HackTricks LIVE Twitch</strong></a> <strong>Wednesdays 5.30pm (UTC) 🎙️ -</strong> <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
2022-04-28 16:01:33 +00:00
2022-09-30 10:27:15 +00:00
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
2022-12-11 19:30:44 +00:00
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
2022-04-28 16:01:33 +00:00
</details>