HackTricks
Searchโ€ฆ
๐Ÿ‘ฝ
Network Services Pentesting
Web API Pentesting
Support HackTricks and get benefits!
โ€‹
โ€‹
Through Security Skills as a Service, we help organizations to defend against the Dark Hacking Arts. Security Skills as a Service is an offensive cybersecurity consultancy model that combines an Intelligent Platform with the top-class, globally distributed, offensive security engineers, delivering high-quality penetration testing results. Security Hubs bring together offensive penetration testing tactics with human behavioral science, providing real-time insights into threat actors' tradecraft and a complete assessment of any risks.
Security Skills as a Service | Security Hubs

Basic Information

Main:

Tricks

SOAP/XML

These kind of APIs may be vulnerable to XXE, but usually DTD Declarations are disallowed in the input from the user.
You could also try to use CDATA tags to insert payloads (as long as the XML is valid)

Check Access

Usually some API endpoints are gong to need more privileges that others. Always try to access the more privileged endpoints from less privileged (unauthorized) accounts to see if it's possible.

CORS

Always check the CORS configuration of the API, as if its allowing to end request with the credentials from the attacker domain, a lot of damage can be done via CSRF from authenticated victims.

Patterns

Search for API patterns inside the api and try to use it to discover more. If you find /api/albums/<album_id>/photos/<photo_id>** ** you could try also things like /api/posts/<post_id>/comment/. Use some fuzzer to discover this new endpoints.

Add parameters

Something like the following example might get you access to another userโ€™s photo album: /api/MyPictureList โ†’ /api/MyPictureList?user_id=<other_user_id>

Replace parameters

You can try to fuzz parameters or use parameters you have seen in a different endpoints to try to access other information
For example, if you see something like: /api/albums?album_id=<album id>
You could replace the album_id parameter with something completely different and potentially get other data: /api/albums?account_id=<account id>

Parameter pollution

/api/account?id=<your account id> โ†’ /api/account?id=<your account id>&id=<admin's account id>

Wildcard parameter

Try to use the following symbols as wildcards: *, %, _, .
  • /api/users/*
  • /api/users/%
  • /api/users/_
  • /api/users/.

HTTP request method change

You can try to use the HTTP methods: GET, POST, PUT, DELETE, PATCH, INVENTED to try check if the web server gives you unexpected information with them.

Request content-type

Try to play between the following content-types (bodifying acordinly the request body) to make the web server behave unexpectedly:
  • x-www-form-urlencoded --> user=test
  • application/xml --> <user>test</user>
  • application/json --> {"user": "test"}

Parameters types

If JSON data is working try so send unexpected data types like:
  • {"username": "John"}
  • {"username": true}
  • {"username": null}
  • {"username": 1}
  • {"username": [true]}
  • {"username": ["John", true]}
  • {"username": {"$neq": "lalala"}}
  • any other combination you may imagine
If you can send XML data, check for XXE injections.
If you send regular POST data, try to send arrays and dictionaries:
  • username[]=John
  • username[$neq]=lalala

Play with routes

/files/..%2f..%2f + victim ID + %2f + victim filename

Check possible versions

Old versions may be still be in use and be more vulnerable than latest endpoints
  • /api/v1/login
  • /api/v2/login\
  • /api/CharityEventFeb2020/user/pp/<ID>
  • /api/CharityEventFeb2021/user/pp/<ID>
โ€‹
โ€‹
Through Security Skills as a Service, we help organizations to defend against the Dark Hacking Arts. Security Skills as a Service is an offensive cybersecurity consultancy model that combines an Intelligent Platform with the top-class, globally distributed, offensive security engineers, delivering high-quality penetration testing results. Security Hubs bring together offensive penetration testing tactics with human behavioral science, providing real-time insights into threat actors' tradecraft and a complete assessment of any risks.
Security Skills as a Service | Security Hubs

๐Ÿ›ก๏ธ API Security Empire Cheat Sheet

Cheat Sheet Author: Momen Eldawakhly (Cyber Guy) In this repository you will find: Mindmaps, tips & tricks, resources and every thing related to API Security and API Penetration Testing. Our mindmaps and resources are based on OWASP TOP 10 API, our expereince in Penetration testing and other resources to deliver the most advanced and accurate API security and penetration testing resource in the WEB!!

๐Ÿšช First gate: {{Recon}}

The first gate to enter the API Security Empire is to know how to gather information about the API infrastructure and how to perform a powerfull recon on API to extract the hidden doors which made you compromise the whole infrastructure from, so, we provide this updated API Recon mindmap with the latest tools and methodologies in API recon:
โ€‹
โ€‹PDF Version | XMind Versionโ€‹

โš”๏ธ Weapons you will need:

๐Ÿ‹๏ธ Test your abilities and weapons:

๐Ÿšช Second gate: {{Attacking}}

Attacking RESTful & SOAP:

Attacking GraphQL:

Due to the limited attacks in the GraphQL we tried to generate all the possible attacks due to our experience in testing APIs in the coming mindmap:

Owasp API Security Top 10

Read this document to learn how to search and exploit Owasp Top 10 API vulnerabilities: https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdfโ€‹

API Security Checklist

GitHub - shieldfy/API-Security-Checklist: Checklist of the most important security countermeasures when designing, testing, and releasing your API
GitHub

List of possible API endpoints

Tools

  • โ€‹kiterunner: Great tool to discover API endpoints.
  • โ€‹automatic-api-attack-tool: Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.
  • โ€‹Astra: Another tool for api testing to find several different web vulnerabilities.
  • โ€‹Susanoo: Vulnerability API scanner.
  • โ€‹restler-fuzzer: RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service with an OpenAPI/Swagger specification, RESTler analyzes its entire specification, and then generates and executes tests that exercise the service through its REST API.
  • ****TnT-Fuzzer: TnT-Fuzzer is an OpenAPI (swagger) fuzzer written in python.
  • ****APIFuzzer: APIFuzzer reads your API description and step by step fuzzes the fields to validate if you application can cope with the fuzzed parameters.
  • ****API-fuzzer: API_Fuzzer gem accepts a API request as input and returns vulnerabilities possible in the API.
  • ****race-the-web: Tests for race conditions in web applications by sending out a user-specified number of requests to a target URL (or URLs) simultaneously, and then compares the responses from the server for uniqueness.\
โ€‹
โ€‹
Through Security Skills as a Service, we help organizations to defend against the Dark Hacking Arts. Security Skills as a Service is an offensive cybersecurity consultancy model that combines an Intelligent Platform with the top-class, globally distributed, offensive security engineers, delivering high-quality penetration testing results. Security Hubs bring together offensive penetration testing tactics with human behavioral science, providing real-time insights into threat actors' tradecraft and a complete assessment of any risks.
Security Skills as a Service | Security Hubs
Support HackTricks and get benefits!
Last modified 29d ago