Skip to content

Commit 923a9d5

Browse files
arjun-aktoarjun-akto
committed
pro tests added
1 parent 6f68974 commit 923a9d5

File tree

395 files changed

+47853
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

395 files changed

+47853
-0
lines changed

‎Broken-Function-Level-Authorization/BFLAReplaceAdminURLPaths.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
id: BFLA_REPLACE_ADMIN_IN_URL_PATHS
2+
info:
3+
name: "Broken Function Level Authorization - Vertical Privilege Escalation test by replacing URL subpaths with admin keyword for new URL path identification"
4+
description: >
5+
"In this test, attackers manipulate URL paths by replacing URL subpaths with "admin" keywords to access privileged functionalities. This tactic aims to bypass access controls and gain unauthorized entry to administrative features or sensitive data. By exploiting this vulnerability, attackers can escalate their privileges within the system and potentially compromise its security."
6+
details: >
7+
In this test, attackers exploit weaknesses in function level authorization by replacing URL subpaths with keywords like "admin" to access privileged functionalities. By replacing specific subpaths, they attempt to bypass access controls and gain unauthorized entry to administrative features or sensitive areas of the application. This tactic aims to escalate privileges within the system, potentially compromising its security and allowing for unauthorized access to critical resources."
8+
impact: >
9+
"The impact of this test can be significant. Attackers can exploit this vulnerability to gain unauthorized access to privileged functionalities, leading to data breaches, system compromise, and unauthorized actions. This can result in the exposure of sensitive information, compromise of user accounts, and damage to the organization's reputation and trust."
10+
11+
category:
12+
name: BFLA
13+
shortName: Broken Function Level Authorization
14+
displayName: Broken Function Level Authorization (BFLA)
15+
subCategory: BFLA_REPLACE_ADMIN_IN_URL_PATHS
16+
severity: HIGH
17+
tags:
18+
- Business logic
19+
- OWASP top 10
20+
- HackerOne top 10
21+
references:
22+
- "https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/"
23+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa5-broken-function-level-authorization.md"
24+
cwe:
25+
- CWE-285
26+
cve:
27+
- CVE-2022-48341
28+
attributes:
29+
nature: INTRUSIVE
30+
plan: PRO
31+
duration: FAST
32+
33+
34+
auth:
35+
authenticated: true
36+
api_selection_filters:
37+
response_code:
38+
gte: 200
39+
lt: 300
40+
method:
41+
neq: "OPTIONS"
42+
response_payload:
43+
length:
44+
gt: 0
45+
contains_all:
46+
- "{"
47+
- "}"
48+
execute:
49+
type: multiple
50+
requests:
51+
- req:
52+
- modify_header:
53+
${roles_access_context.MEMBER}: 1
54+
- modify_url:
55+
token_replace:
56+
location: 1
57+
replace_with: "admin"
58+
- success: vulnerable
59+
- failure: x2
60+
- req:
61+
- modify_header:
62+
${roles_access_context.MEMBER}: 1
63+
- modify_url:
64+
token_replace:
65+
location: 2
66+
replace_with: "admin"
67+
- success: vulnerable
68+
- failure: x3
69+
- req:
70+
- modify_header:
71+
${roles_access_context.MEMBER}: 1
72+
- modify_url:
73+
token_replace:
74+
location: 3
75+
replace_with: "admin"
76+
- success: vulnerable
77+
- failure: x4
78+
- req:
79+
- modify_header:
80+
${roles_access_context.MEMBER}: 1
81+
- modify_url:
82+
token_replace:
83+
location: 4
84+
replace_with: "admin"
85+
- success: vulnerable
86+
- failure: x5
87+
- req:
88+
- modify_header:
89+
${roles_access_context.MEMBER}: 1
90+
- modify_url:
91+
token_replace:
92+
location: 5
93+
replace_with: "admin"
94+
validate:
95+
response_code:
96+
gte: 200
97+
lt: 300
98+
url:
99+
endpoint_in_traffic_context: false
100+
response_payload:
101+
length:
102+
gt: 0
103+
percentage_match:
104+
lt: 10
105+
percentage_match_schema:
106+
gte: 90
107+
not_contains:
108+
- <html>
109+
- </html>
110+
- "unable"
111+
- "fail"
112+
- invalid
113+
contains_all:
114+
- "{"
115+
- "}"

‎Broken-Object-Level-Authorization/BOLAAddCustomHeader.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
id: BOLA_ADD_CUSTOM_HEADER
2+
info:
3+
name: "Exploiting BOLA by adding Custom Header for Unauthorized Access."
4+
description: >
5+
"In this exploitation scenario, attackers target Broken Object Level Authorization (BOLA) by adding custom headers to their requests, attempting to gain unauthorized access. By manipulating request headers, adversaries seek to exploit weaknesses in authorization mechanisms, potentially bypassing security controls. This method underscores the need for thorough security assessments, emphasizing the importance of secure header handling and robust access controls to mitigate the risks associated with unauthorized access and BOLA vulnerabilities."
6+
details: >
7+
"Attackers exploit Broken Object Level Authorization (BOLA) by adding custom headers to their requests, attempting unauthorized access. Manipulating headers aims to exploit vulnerabilities in the system's authorization mechanisms, highlighting the need for robust security assessments and secure header handling. Thorough security measures are essential to prevent unauthorized access, addressing the risks associated with BOLA vulnerabilities and custom header manipulation."
8+
impact: >
9+
"Exploiting Broken Object Level Authorization by adding custom headers can have a profound impact, potentially leading to unauthorized access and compromise of sensitive data. Successful manipulation may enable malicious actions within the system, emphasizing the critical need for stringent security measures, robust access controls, and secure handling of custom headers to prevent and mitigate the risks associated with
10+
Broken Object Level Authorization vulnerabilities."
11+
category:
12+
name: BOLA
13+
shortName: BOLA
14+
displayName: Broken Object Level Authorization (BOLA)
15+
subCategory: BOLA_ADD_CUSTOM_HEADER
16+
severity: HIGH
17+
tags:
18+
- Business logic
19+
- OWASP top 10
20+
- HackerOne top 10
21+
references:
22+
- "https://www.akto.io/blog/bola-exploitation-using-unauthorized-uuid-on-api-endpoint"
23+
- "https://www.akto.io/blog/what-is-broken-object-level-authorization-bola"
24+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa1-broken-object-level-authorization.md"
25+
- "https://cwe.mitre.org/data/definitions/284.html"
26+
- "https://cwe.mitre.org/data/definitions/285.html"
27+
- "https://cwe.mitre.org/data/definitions/639.html"
28+
cwe:
29+
- CWE-284
30+
- CWE-285
31+
- CWE-639
32+
cve:
33+
- CVE-2022-34770
34+
attributes:
35+
nature: NON_INTRUSIVE
36+
plan: PRO
37+
duration: FAST
38+
39+
40+
inactive: true
41+
auth:
42+
authenticated: true
43+
api_selection_filters:
44+
response_code:
45+
gte: 200
46+
lt: 300
47+
method:
48+
neq: "OPTIONS"
49+
response_payload:
50+
length:
51+
gt: 0
52+
not_contains:
53+
- Error
54+
- Internal Server
55+
- Failed
56+
- Unauthorized
57+
- access denied
58+
- Forbidden
59+
- Method Not allowed
60+
- Gateway timeout
61+
- request timeout
62+
- server error
63+
- server busy
64+
- authentication error
65+
- authorization error
66+
- validation error
67+
- Permission Denied
68+
- invalid token
69+
- token expired
70+
- session expired
71+
- session timeout
72+
- unexpected error
73+
- unable to process request
74+
- bad request
75+
- service unavailable
76+
- account is locked
77+
- account is blocked
78+
- multiple failed attempts
79+
wordLists:
80+
headerValues:
81+
source: sample_data
82+
key:
83+
regex: X-User-ID|Customer|Member|Client|Account|Subscriber|User-Hash
84+
location: header
85+
all_apis: true
86+
execute:
87+
type: multiple
88+
requests:
89+
- req:
90+
- add_header:
91+
X-User-ID: "${headerValues}"
92+
- add_header:
93+
X-Customer-ID: "${headerValues}"
94+
- add_header:
95+
X-Member-ID: "${headerValues}"
96+
- add_header:
97+
X-Client-ID: "${headerValues}"
98+
- add_header:
99+
X-Account-ID: "${headerValues}"
100+
- add_header:
101+
X-Subscriber-ID: "${headerValues}"
102+
- add_header:
103+
X-User-Hash: "${headerValues}"
104+
validate:
105+
response_code:
106+
gte: 200
107+
lt: 300
108+
response_payload:
109+
length:
110+
gt: 0
111+
percentage_match_schema:
112+
gte: 90
113+
percentage_match:
114+
lt: 10
115+
not_contains:
116+
- Error
117+
- Internal Server
118+
- Failed
119+
- Unauthorized
120+
- access denied
121+
- Forbidden
122+
- Method Not allowed
123+
- Gateway timeout
124+
- request timeout
125+
- server error
126+
- server busy
127+
- authentication error
128+
- authorization error
129+
- validation error
130+
- Permission Denied
131+
- invalid token
132+
- token expired
133+
- session expired
134+
- session timeout
135+
- unexpected error
136+
- unable to process request
137+
- bad request
138+
- service unavailable
139+
- account is locked
140+
- account is blocked
141+
- multiple failed attempts
142+
- "<html>"
143+
- "</html>"

‎Broken-Object-Level-Authorization/BOLAAddCustomHeaderDELETE.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
id: BOLA_ADD_CUSTOM_HEADER_DELETE
2+
info:
3+
name: "Exploiting BOLA by adding Custom Header for Unauthorized Access for DELETE method APIs"
4+
description: >
5+
"In this exploitation scenario for DELETE method APIs, attackers target Broken Object Level Authorization (BOLA) by adding custom headers to their requests, attempting to gain unauthorized access. By manipulating request headers, adversaries seek to exploit weaknesses in authorization mechanisms, potentially bypassing security controls. This method underscores the need for thorough security assessments, emphasizing the importance of secure header handling and robust access controls to mitigate the risks associated with unauthorized access and BOLA vulnerabilities."
6+
details: >
7+
"Attackers exploit Broken Object Level Authorization (BOLA) by adding custom headers to their requests (having DELETE HTTP method), attempting unauthorized access. Manipulating headers aims to exploit vulnerabilities in the system's authorization mechanisms, highlighting the need for robust security assessments and secure header handling. Thorough security measures are essential to prevent unauthorized access, addressing the risks associated with BOLA vulnerabilities and custom header manipulation."
8+
impact: >
9+
"Exploiting Broken Object Level Authorization by adding custom headers can have a profound impact, potentially leading to unauthorized access and compromise of sensitive data. Successful manipulation may enable malicious actions within the system, emphasizing the critical need for stringent security measures, robust access controls, and secure handling of custom headers to prevent and mitigate the risks associated with Broken Object Level Authorization vulnerabilities."
10+
category:
11+
name: BOLA
12+
shortName: BOLA
13+
displayName: Broken Object Level Authorization (BOLA)
14+
subCategory: BOLA_ADD_CUSTOM_HEADER_DELETE
15+
severity: CRITICAL
16+
tags:
17+
- Business logic
18+
- OWASP top 10
19+
- HackerOne top 10
20+
references:
21+
- "https://www.akto.io/blog/bola-exploitation-using-unauthorized-uuid-on-api-endpoint"
22+
- "https://www.akto.io/blog/what-is-broken-object-level-authorization-bola"
23+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa1-broken-object-level-authorization.md"
24+
- "https://cwe.mitre.org/data/definitions/284.html"
25+
- "https://cwe.mitre.org/data/definitions/285.html"
26+
- "https://cwe.mitre.org/data/definitions/639.html"
27+
cwe:
28+
- CWE-284
29+
- CWE-285
30+
- CWE-639
31+
cve:
32+
- CVE-2022-34770
33+
attributes:
34+
nature: INTRUSIVE
35+
plan: PRO
36+
duration: FAST
37+
38+
39+
inactive: true
40+
auth:
41+
authenticated: true
42+
api_selection_filters:
43+
response_code:
44+
gte: 200
45+
lt: 300
46+
method:
47+
eq: DELETE
48+
response_payload:
49+
length:
50+
eq: 0
51+
not_contains:
52+
- Error
53+
- Internal Server
54+
- Failed
55+
- Unauthorized
56+
- access denied
57+
- Forbidden
58+
- Method Not allowed
59+
- Gateway timeout
60+
- request timeout
61+
- server error
62+
- server busy
63+
- authentication error
64+
- authorization error
65+
- validation error
66+
- Permission Denied
67+
- invalid token
68+
- token expired
69+
- session expired
70+
- session timeout
71+
- unexpected error
72+
- unable to process request
73+
- bad request
74+
- service unavailable
75+
- account is locked
76+
- account is blocked
77+
- multiple failed attempts
78+
wordLists:
79+
headerValues:
80+
source: sample_data
81+
key:
82+
regex: X-User-ID|Customer|Member|Client|Account|Subscriber|User-Hash
83+
location: header
84+
all_apis: true
85+
execute:
86+
type: single
87+
requests:
88+
- req:
89+
- add_header:
90+
X-User-ID: "${headerValues}"
91+
- add_header:
92+
X-Customer-ID: "${headerValues}"
93+
- add_header:
94+
X-Member-ID: "${headerValues}"
95+
- add_header:
96+
X-Client-ID: "${headerValues}"
97+
- add_header:
98+
X-Account-ID: "${headerValues}"
99+
- add_header:
100+
X-Subscriber-ID: "${headerValues}"
101+
- add_header:
102+
X-User-Hash: "${headerValues}"
103+
validate:
104+
response_code:
105+
gte: 200
106+
lt: 300
107+
response_payload:
108+
length:
109+
eq: 0
110+
not_contains:
111+
- Error
112+
- Internal Server
113+
- Fail
114+
- Unauthorized
115+
- access denied
116+
- Forbidden
117+
- Method Not allowed
118+
- Gateway timeout
119+
- request timeout
120+
- server error
121+
- server busy
122+
- authentication error
123+
- authorization error
124+
- validation error
125+
- Permission Denied
126+
- invalid token
127+
- token expired
128+
- session expired
129+
- session timeout
130+
- unexpected error
131+
- unable to process request
132+
- bad request
133+
- service unavailable
134+
- account is locked
135+
- account is blocked
136+
- multiple failed attempts

0 commit comments

Comments
 (0)