Skip to content

Commit a81c28a

Browse files
notshivanshnotshivansh
committed
add more tests
1 parent 3243624 commit a81c28a

File tree

3 files changed

+212
-3
lines changed

3 files changed

+212
-3
lines changed

‎Broken-Object-Level-Authorization/BOLAURLReplaceUserIDQueryParam.yml‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
id: BOLA_REPLACE_USER_ID_QUERY_PARAM
2+
info:
3+
name: "Exploiting BOLA by replacing User IDs for Unauthorized Access."
4+
description: >
5+
This test checks for Broken Object Level Authorization (BOLA) vulnerabilities by modifying URL query parameters related to user identification (such as UserId, user_id, etc.) and replacing their values with common privileged identifiers (e.g., admin, root, superuser). The goal is to determine if unauthorized access to resources is possible by manipulating these parameters.
6+
details: >
7+
The test targets API endpoints that use user-related query parameters. It systematically replaces these parameters with values like "admin" or "root" and sends requests to the server. The test then validates the responses to ensure that unauthorized access is not granted. It checks for successful response codes (2xx), non-empty payloads, and ensures the response does not contain error or denial messages, nor does it closely match the original user's data, indicating a possible privilege escalation or data leak.
8+
impact: >
9+
If the test is successful, it indicates that attackers could gain unauthorized access to sensitive data or perform actions as privileged users by simply modifying query parameters. This could lead to data breaches, unauthorized transactions, or compromise of user accounts, highlighting a critical need to enforce strict object-level authorization on all endpoints that accept user-identifying parameters.
10+
category:
11+
name: BOLA
12+
shortName: BOLA
13+
displayName: Broken Object Level Authorization (BOLA)
14+
subCategory: BOLA_REPLACE_USER_ID_QUERY_PARAM
15+
severity: HIGH
16+
tags:
17+
- Business logic
18+
- OWASP top 10
19+
- HackerOne top 10
20+
references:
21+
- "https://www.akto.io/blog/bola-exploitation-using-unauthorized-uuid-on-api-endpoint"
22+
- "https://www.akto.io/blog/what-is-broken-object-level-authorization-bola"
23+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa1-broken-object-level-authorization.md"
24+
- "https://cwe.mitre.org/data/definitions/284.html"
25+
- "https://cwe.mitre.org/data/definitions/285.html"
26+
- "https://cwe.mitre.org/data/definitions/639.html"
27+
cwe:
28+
- CWE-284
29+
- CWE-285
30+
- CWE-639
31+
cve:
32+
- CVE-2022-34770
33+
34+
attributes:
35+
nature: INTRUSIVE
36+
plan: PRO
37+
duration: FAST
38+
39+
auth:
40+
authenticated: true
41+
api_selection_filters:
42+
response_code:
43+
gte: 200
44+
lt: 300
45+
method:
46+
neq: "OPTIONS"
47+
response_payload:
48+
length:
49+
gt: 0
50+
not_contains:
51+
- Error
52+
- Internal Server
53+
- Failed
54+
- Unauthorized
55+
- access denied
56+
- Forbidden
57+
- Method Not allowed
58+
- Gateway timeout
59+
- request timeout
60+
- server error
61+
- server busy
62+
- authentication error
63+
- authorization error
64+
- validation error
65+
- Permission Denied
66+
- invalid token
67+
- token expired
68+
- session expired
69+
- session timeout
70+
- unexpected error
71+
- unable to process request
72+
- bad request
73+
- service unavailable
74+
- account is locked
75+
- account is blocked
76+
- multiple failed attempts
77+
- failure
78+
- not available
79+
- not found
80+
query_param:
81+
for_one:
82+
key:
83+
regex: "^UserId$|^UserID$|^User-ID$|^user_id$|^user-id$|^userid$|^username$|^Username$|^USERNAME$|^uId$|^uid$|^UID$|^member_id$|^MemberId$|^memberId$|^profile_id$|^ProfileId$|^profileId$|^userIdentifier$|^UserIdentifier$|^user_identifier$|^account_id$|^AccountID$|^account-id$|^account_id$|^customer_id$|^CustomerID$|^customer-id$|^customer_id$"
84+
extract: userKey
85+
value:
86+
not_contains: ${attempt_Ids}
87+
88+
wordLists:
89+
attempt_Ids:
90+
- superuser
91+
- master
92+
- admin
93+
- root
94+
95+
execute:
96+
type: single
97+
requests:
98+
- req:
99+
- modify_query_param:
100+
userKey: ${attempt_Ids}
101+
102+
validate:
103+
response_code:
104+
gte: 200
105+
lt: 300
106+
response_payload:
107+
length:
108+
gt: 0
109+
percentage_match:
110+
gt: 40
111+
percentage_match_schema:
112+
gte: 90
113+
not_contains:
114+
- Error
115+
- Internal Server
116+
- Failed
117+
- Unauthorized
118+
- access denied
119+
- Forbidden
120+
- Method Not allowed
121+
- Gateway timeout
122+
- request timeout
123+
- server error
124+
- server busy
125+
- authentication error
126+
- authorization error
127+
- validation error
128+
- Permission Denied
129+
- invalid token
130+
- token expired
131+
- session expired
132+
- session timeout
133+
- unexpected error
134+
- unable to process request
135+
- bad request
136+
- service unavailable
137+
- account is locked
138+
- account is blocked
139+
- multiple failed attempts
140+
- failure
141+
- not available
142+
- not found
143+
- "<html>"
144+
- "</html>"

‎Broken-User-Authentication/NoSQLiErrorBasedParamMongoSpecialCharacters.yml‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ info:
1212
shortName: Broken Authentication
1313
displayName: Broken User Authentication (BUA)
1414
subCategory: NOSQLI_ERROR_BASED_PARAM_MONGO_SPECIAL_CHARACTERS
15-
severity: MEDIUM
15+
severity: HIGH
1616
tags:
1717
- Injection Attack
1818
- OWASP Top 10
@@ -80,21 +80,32 @@ api_selection_filters:
8080
- request_payload:
8181
for_one:
8282
key:
83-
regex: .*
83+
contains_either: ${attempt_Ids}
8484
extract: changed_body_key
8585
- query_param:
8686
for_one:
8787
key:
88-
regex: .*
88+
contains_either: ${attempt_Ids}
8989
extract: changed_query_key
9090
wordLists:
91+
attempt_Ids:
92+
- "name"
93+
- "username"
94+
- "email"
95+
- "password"
96+
- "userId"
97+
- "userID"
98+
- "user-id"
99+
- "userid"
100+
- "id"
91101
specialCharacters:
92102
- "'"
93103
- "\""
94104
- "$"
95105
- "."
96106
- ">"
97107
- "[\",\"]"
108+
- "{\"$ne\": null}"
98109
- "{\"$gt\": \"\"}"
99110
- "{\"$ne\": \"nonexistentname\"}"
100111
- "{\"$where\": \"function() { throw 'Error'; }\"}"
@@ -120,6 +131,13 @@ validate:
120131
regex: "(?i)unterminated string literal"
121132
- response_payload:
122133
regex: "Cast to string failed for value"
134+
- response_payload:
135+
length:
136+
gt: 0
137+
percentage_match:
138+
- gte: 30
139+
percentage_match_schema:
140+
- gte: 50
123141
response_payload:
124142
not_contains:
125143
- failed

‎Security-Misconfiguration/StackTraceExposedChangeAuth.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
id: STACK_TRACE_EXPOSED_CHANGE_AUTH
2+
info:
3+
name: "Stack Trace Exposure via Auth Header Manipulation"
4+
description: >
5+
This test checks if stack traces or debugging information are exposed in API responses when the authentication header is replaced or tampered with. It targets endpoints that return a successful (2xx) response and inspects the payload for stack trace indicators such as "stack", "trace", or "stacktrace".
6+
details: >
7+
The test sends requests to API endpoints with the authentication header replaced, simulating an unauthorized or malformed authentication attempt. If the server responds with a 2xx status code, the response payload is analyzed for the presence of stack trace keywords. Exposure of such information can reveal sensitive implementation details, making the application more vulnerable to attacks.
8+
impact: >
9+
If stack traces or debugging information are exposed in API responses, attackers can gain insights into the application's internal logic, error handling, and potential vulnerabilities. This can facilitate further exploitation, information disclosure, and compromise of the application's security posture. Preventing stack trace exposure is essential to maintaining robust security and protecting sensitive data.
10+
category:
11+
name: SM
12+
shortName: Misconfiguration
13+
displayName: Security Misconfiguration (SM)
14+
subCategory: STACK_TRACE_EXPOSED_CHANGE_AUTH
15+
severity: MEDIUM
16+
references:
17+
- "https://github.com/OWASP/API-Security/blob/master/editions/2023/en/0xa8-security-misconfiguration.md"
18+
cwe:
19+
- CWE-200
20+
- CWE-16
21+
cve:
22+
- CVE-2021-43798
23+
24+
attributes:
25+
nature: INTRUSIVE
26+
plan: PRO
27+
duration: FAST
28+
29+
api_selection_filters:
30+
method:
31+
neq: "OPTIONS"
32+
response_code:
33+
gte: 200
34+
lt: 300
35+
36+
execute:
37+
type: single
38+
requests:
39+
- req:
40+
- replace_auth_header: true
41+
42+
validate:
43+
response_payload:
44+
contains_either:
45+
- "stack"
46+
- "trace"
47+
- stacktrace

0 commit comments

Comments
 (0)