Blog ๐Ÿ‘จโ€๐Ÿ’ป

๐Ÿ”API Testing

API lร  mแป™t tแบญp hแปฃp cรกc commands, functions, protocol, objects ... giรบp hai phแบงn mแปm cรณ thแปƒ tฦฐฦกng tรกc trao ฤ‘แป•i dแปฏ liแป‡u vแป›i nhau .

API Recon

Trฦฐแป›c khi bแบฏt ฤ‘แบงu kiแปƒm thแปญ API, ฤ‘iแปu quan trแปng ฤ‘แบงu tiรชn lร  thu thแบญp thรดng tin vแป API ฤ‘แปƒ xรกc ฤ‘แป‹nh bแป mแบทt tแบฅn cรดng

Xรกc ฤ‘แป‹nh API Endpoint 

GET /api/books HTTP/1.1
Host: example.com

Trong trฦฐแปng hแปฃp nร y, API endpoint lร  /api/books, nรณ ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ lแบฅy danh sรกch sรกch tแปซ mแป™t thฦฐ viแป‡n. Mแป™t endpoint khรกc cรณ thแปƒ lร  /api/books/mystery, giรบp lแบฅy danh sรกch sรกch thuแป™c thแปƒ loแบกi trinh thรกm.

Tรฌm hiแปƒu cรกch tฦฐฦกng tรกc vแป›i API

  • Dแปฏ liแป‡u ฤ‘แบงu vร o mร  API xแปญ lรฝ:

    • Bao gแป“m cรกc tham sแป‘ bแบฏt buแป™c vร  khรดng bแบฏt buแป™c mร  API yรชu cแบงu.

  • Cรกc loแบกi yรชu cแบงu mร  API chแบฅp nhแบญn:

    • Bao gแป“m cรกc phฦฐฦกng thแปฉc HTTP ฤ‘ฦฐแปฃc hแป— trแปฃ nhฦฐ GET, POST, PUT, DELETE vร  cรกc ฤ‘แป‹nh dแบกng dแปฏ liแป‡u nhฦฐ JSON, XML.

  • Giแป›i hแบกn tแป‘c ฤ‘แป™ (Rate Limits) vร  cฦก chแบฟ xรกc thแปฑc:

    • Tรฌm hiแปƒu xem API cรณ giแป›i hแบกn sแป‘ lฦฐแปฃng yรชu cแบงu trong mแป™t khoแบฃng thแปi gian hay khรดng.

    • Xรกc ฤ‘แป‹nh cรกc phฦฐฦกng thแปฉc xรกc thแปฑc nhฦฐ API Key, OAuth, hoแบทc JWT.

API Document

Discovering API documentation

  1. Dรนng Burp Scanner ฤ‘แปƒ quรฉt

  2. Manual bแบฑng cรกc endpoint cรณ thแปƒ chแปฉa API Documenrt

/api
/swagger/index.html
/openapi.json

  1. Cรณ thแปƒ dรนng cรกc tool ฤ‘แปƒ fuzzing nรณ ra bแบฑng cรกch dรนng cรกc list API quen thuแป™c - wordlist

Lab: Exploiting an API endpoint using documentation

Machine-readable API Documentation

Cรดng cแปฅ phรขn tรญch vร  kiแปƒm thแปญ tร i liแป‡u API

  1. Burp Suite:

    • Burp Scanner:

      • Tแปฑ ฤ‘แป™ng quรฉt vร  kiแปƒm tra bแบฃo mแบญt tร i liแป‡u API theo chuแบฉn OpenAPI (Swagger).

      • Xรกc ฤ‘แป‹nh cรกc lแป— hแป•ng bแบฃo mแบญt nhฦฐ Injection, Broken Authentication, Rate Limiting.

    • OpenAPI Parser BApp:

      • Mแป™t tiแป‡n รญch mแปŸ rแป™ng trong Burp Suite giรบp phรขn tรญch tร i liแป‡u OpenAPI, tแปฑ ฤ‘แป™ng trรญch xuแบฅt cรกc endpoint vร  tแบกo yรชu cแบงu thแปญ nghiแป‡m.

  2. Postman:

    • Cรดng cแปฅ kiแปƒm thแปญ API phแป• biแบฟn, cho phรฉp nhแบญp tร i liแป‡u OpenAPI ฤ‘แปƒ tแปฑ ฤ‘แป™ng tแบกo yรชu cแบงu HTTP.

    • Hแป— trแปฃ kiแปƒm tra tรญnh ฤ‘รบng ฤ‘แบฏn cแปงa phแบฃn hแป“i vร  xรกc thแปฑc API bแบฑng cรกc phฦฐฦกng phรกp nhฦฐ OAuth, API Key, JWT.

  3. SoapUI:

    • Kiแปƒm thแปญ API SOAP vร  REST vแป›i cรกc kแป‹ch bแบฃn tแปฑ ฤ‘แป™ng dแปฑa trรชn tร i liแป‡u API.

    • Cho phรฉp mรด phแปng cรกc yรชu cแบงu phแปฉc tแบกp vร  thแปฑc hiแป‡n kiแปƒm thแปญ chแปฉc nฤƒng.

Quy trรฌnh kiแปƒm thแปญ API dแปฑa trรชn tร i liแป‡u

  1. Phรขn tรญch tร i liแป‡u API:

    • Sแปญ dแปฅng Burp hoแบทc Postman ฤ‘แปƒ nhแบญp vร  trรญch xuแบฅt cรกc endpoint.

    • Xรกc ฤ‘แป‹nh cรกc thรดng sแป‘ ฤ‘แบงu vร o, phฦฐฦกng thแปฉc HTTP ฤ‘ฦฐแปฃc hแป— trแปฃ vร  quy tแบฏc xรกc thแปฑc.

  2. Gแปญi yรชu cแบงu kiแปƒm thแปญ:

    • Kiแปƒm tra API bแบฑng cรกch gแปญi yรชu cแบงu thรดng qua Postman hoแบทc SoapUI.

    • Phรขn tรญch phแบฃn hแป“i vร  kiแปƒm tra lแป—i logic hoแบทc bแบฃo mแบญt.

  3. Kiแปƒm tra bแบฃo mแบญt tแปฑ ฤ‘แป™ng:

    • Sแปญ dแปฅng Burp Scanner ฤ‘แปƒ phรกt hiแป‡n lแป— hแป•ng nhฦฐ SQL Injection, XSS, Authentication Bypass.

    • Kiแปƒm tra tรญnh chแป‘ng chแป‹u cแปงa API vแป›i giแป›i hแบกn tแป‘c ฤ‘แป™ (rate limiting) vร  kiแปƒm tra lแป—i xแปญ lรฝ ฤ‘แบงu vร o.

Identifying API endpoints

  • Tแปฑ ฤ‘แป™ng quรฉt bแบฑng Burp Scanner:

    • Burp Scanner cรณ thแปƒ thแปฑc hiแป‡n quรก trรฌnh crawling (thu thแบญp dแปฏ liแป‡u) ฤ‘แปƒ phรกt hiแป‡n cรกc endpoint API.

    • Sau khi quรฉt, kiแปƒm tra cรกc kแบฟt quแบฃ liรชn quan ฤ‘แบฟn cรกc endpoint ฤ‘รกng ngแป hoแบทc chฦฐa ฤ‘ฦฐแปฃc ghi nhแบญn.

  • Duyแป‡t แปฉng dแปฅng thแปง cรดng bแบฑng Burp's browser:

    • Sแปญ dแปฅng trรฌnh duyแป‡t proxy cแปงa Burp ฤ‘แปƒ quan sรกt cรกc yรชu cแบงu gแปญi ฤ‘i trong thแปi gian thแปฑc vร  tรฌm kiแบฟm dแบฅu hiแป‡u cแปงa API.

Tรฌm kiแบฟm trong file JavaScript:

  • Nhiแปu endpoint API cรณ thแปƒ ฤ‘ฦฐแปฃc tham chiแบฟu trong cรกc file JavaScript tแบฃi xuแป‘ng tแปซ trรฌnh duyแป‡t.

  • Dรนng cรดng cแปฅ JS Link Finder BApp cแปงa Burp Suite ฤ‘แปƒ tแปฑ ฤ‘แป™ng phรขn tรญch vร  trรญch xuแบฅt cรกc ฤ‘ฦฐแปng dแบซn API tแปซ mรฃ nguแป“n JavaScript.

  • Cลฉng cรณ thแปƒ kiแปƒm tra thแปง cรดng bแบฑng cรกch duyแป‡t vร  phรขn tรญch cรกc file .js trong Burp Suite.

Interacting with API endpoints

  • Xรกc ฤ‘แป‹nh cรกc endpoint API vร  sแปญ dแปฅng Burp Repeater, Burp Intruder ฤ‘แปƒ kiแปƒm tra.

  • Quan sรกt hร nh vi cแปงa API vร  phรกt hiแป‡n bแป mแบทt tแบฅn cรดng tiแปm แบฉn.

  • Kiแปƒm tra phแบฃn hแป“i cแปงa API khi thay ฤ‘แป•i phฦฐฦกng thแปฉc HTTP vร  loแบกi dแปฏ liแป‡u.

  • Phรขn tรญch kแปน thรดng bรกo lแป—i vร  phแบฃn hแป“i ฤ‘แปƒ thu thแบญp thรดng tin hแปฏu รญch.

  • Sแปญ dแปฅng thรดng tin thu ฤ‘ฦฐแปฃc ฤ‘แปƒ xรขy dแปฑng yรชu cแบงu HTTP hแปฃp lแป‡.

Identifying supported HTTP methods

  • HTTP method xรกc ฤ‘แป‹nh hร nh ฤ‘แป™ng ฤ‘ฦฐแปฃc thแปฑc hiแป‡n trรชn mแป™t tร i nguyรชn.

  • Vรญ dแปฅ vแป cรกc HTTP method phแป• biแบฟn:

    • GET: Lแบฅy dแปฏ liแป‡u tแปซ mแป™t tร i nguyรชn.

    • PATCH: Thay ฤ‘แป•i mแป™t phแบงn cแปงa tร i nguyรชn.

    • OPTIONS: Lแบฅy thรดng tin vแป cรกc phฦฐฦกng thแปฉc HTTP ฤ‘ฦฐแปฃc hแป— trแปฃ trรชn tร i nguyรชn.

  • Mแป™t endpoint API cรณ thแปƒ hแป— trแปฃ nhiแปu phฦฐฦกng thแปฉc HTTP khรกc nhau, do ฤ‘รณ cแบงn kiแปƒm tra tแบฅt cแบฃ cรกc phฦฐฦกng thแปฉc tiแปm nฤƒng ฤ‘แปƒ khรกm phรก thรชm chแปฉc nฤƒng cแปงa endpoint vร  mแปŸ rแป™ng bแป mแบทt tแบฅn cรดng.

  • Vรญ dแปฅ, endpoint /api/tasks cรณ thแปƒ hแป— trแปฃ cรกc phฦฐฦกng thแปฉc sau:

    • GET /api/tasks: Lแบฅy danh sรกch cรดng viแป‡c.

    • POST /api/tasks: Tแบกo mแป™t cรดng viแป‡c mแป›i.

    • DELETE /api/tasks/1: Xรณa mแป™t cรดng viแป‡c.

  • Burp Intruder cรณ sแบตn danh sรกch cรกc HTTP method ฤ‘แปƒ tแปฑ ฤ‘แป™ng kiแปƒm tra hร ng loแบกt phฦฐฦกng thแปฉc khรกc nhau.

  • Lฦฐu รฝ:

    • Khi kiแปƒm tra cรกc phฦฐฦกng thแปฉc HTTP, nรชn thแปญ nghiแป‡m trรชn cรกc ฤ‘แป‘i tฦฐแปฃng cรณ mแปฉc ฤ‘แป™ ฦฐu tiรชn thแบฅp ฤ‘แปƒ trรกnh tรกc ฤ‘แป™ng khรดng mong muแป‘n nhฦฐ thay ฤ‘แป•i dแปฏ liแป‡u quan trแปng hoแบทc tแบกo ra quรก nhiแปu bแบฃn ghi.

Identifying supported content types

  • Cรกc endpoint API thฦฐแปng yรชu cแบงu dแปฏ liแป‡u theo mแป™t ฤ‘แป‹nh dแบกng cแปฅ thแปƒ.

  • API cรณ thแปƒ phแบฃn hแป“i khรกc nhau tรนy thuแป™c vร o kiแปƒu nแป™i dung (content type) ฤ‘ฦฐแปฃc gแปญi trong yรชu cแบงu.

  • Viแป‡c thay ฤ‘แป•i kiแปƒu nแป™i dung cรณ thแปƒ giรบp bแบกn:

    • Kรญch hoแบกt lแป—i ฤ‘แปƒ thu thแบญp thรดng tin hแปฏu รญch.

    • Bypass cรกc biแป‡n phรกp phรฒng thแปง khรดng chแบทt chแบฝ.

    • Khai thรกc sแปฑ khรกc biแป‡t trong logic xแปญ lรฝ, vรญ dแปฅ: API cรณ thแปƒ an toร n khi xแปญ lรฝ JSON nhฦฐng dแป… bแป‹ tแบฅn cรดng injection khi xแปญ lรฝ XML.

  • ฤแปƒ thay ฤ‘แป•i kiแปƒu nแป™i dung, cแบงn chแป‰nh sแปญa tiรชu ฤ‘แป Content-Type vร  ฤ‘แป‹nh dแบกng lแบกi phแบงn thรขn (body) cแปงa yรชu cแบงu cho phรน hแปฃp.

  • Cรดng cแปฅ Content Type Converter BApp cรณ thแปƒ tแปฑ ฤ‘แป™ng chuyแปƒn ฤ‘แป•i dแปฏ liแป‡u trong yรชu cแบงu giแปฏa XML vร  JSON, giรบp dแป… dร ng thแปญ nghiแป‡m nhiแปu ฤ‘แป‹nh dแบกng khรกc nhau.

Lab: Finding and exploiting an unused API endpoint

Using Intruder to find hidden endpoints

  • Dรนng Burp Intruder ฤ‘แปƒ tรฌm endpoint แบฉn sau khi xรกc ฤ‘แป‹nh cรกc endpoint ban ฤ‘แบงu.

  • Kiแปƒm tra biแบฟn thแปƒ cแปงa endpoint bแบฑng cรกch thรชm cรกc chแปฉc nฤƒng phแป• biแบฟn nhฦฐ delete, add.

  • Sแปญ dแปฅng wordlists vแป›i cรกc quy ฦฐแป›c ฤ‘แบทt tรชn API phแป• biแบฟn vร  thuแบญt ngแปฏ ngร nh.

  • Bแป• sung tแปซ khรณa liรชn quan dแปฑa trรชn thรดng tin thu thแบญp ban ฤ‘แบงu - wordlist

Mass assignment vulnerabilities

Mass Assignment lร  mแป™t kแปน thuแบญt trong lแบญp trรฌnh web cho phรฉp gรกn giรก trแป‹ cho nhiแปu thuแป™c tรญnh cแปงa mแป™t ฤ‘แป‘i tฦฐแปฃng (object) cรนng lรบc, thฦฐแปng bแบฑng cรกch sแปญ dแปฅng dแปฏ liแป‡u tแปซ request cแปงa ngฦฐแปi dรนng (vรญ dแปฅ: JSON, form data). Nรณ giรบp lแบญp trรฌnh viรชn giแบฃm thiแปƒu cรดng sแปฉc viแบฟt code khi xแปญ lรฝ nhiแปu trฦฐแปng dแปฏ liแป‡u cรนng mแป™t lรบc.

Identifying hidden parameters

  • Xรกc ฤ‘แป‹nh tham sแป‘ แบฉn: Cรกc tham sแป‘ แบฉn cรณ thแปƒ ฤ‘ฦฐแปฃc phรกt hiแป‡n bแบฑng cรกch kiแปƒm tra thแปง cรดng cรกc ฤ‘แป‘i tฦฐแปฃng do API trแบฃ vแป.

  • Vรญ dแปฅ:

    • Yรชu cแบงu PATCH /api/users/ ฤ‘แปƒ cแบญp nhแบญt username vร  email vแป›i dแปฏ liแป‡u JSON:

      {
    "username": "wiener",
    "email": "wiener@example.com"
}

    • Mแป™t yรชu cแบงu ฤ‘แป“ng thแปi GET /api/users/123 trแบฃ vแป:

      {
    "id": 123,
    "name": "John Doe",
    "email": "john@example.com",
    "isAdmin": "false"
}

  • ฤiแปu nร y cho thแบฅy cรกc tham sแป‘ แบฉn nhฦฐ id vร  isAdmin cรณ thแปƒ tแป“n tแบกi vร  ฤ‘ฦฐแปฃc rร ng buแป™c vร o ฤ‘แป‘i tฦฐแปฃng ngฦฐแปi dรนng nแป™i bแป™, bรชn cแบกnh cรกc tham sแป‘ ฤ‘ฦฐแปฃc cแบญp nhแบญt nhฦฐ username vร  email.

  • Kแบฟt luแบญn: Kiแปƒm tra phแบฃn hแป“i tแปซ API cรณ thแปƒ giรบp phรกt hiแป‡n tham sแป‘ แบฉn, cho phรฉp khai thรกc hoแบทc kiแปƒm tra lแป— hแป•ng bแบฃo mแบญt liรชn quan ฤ‘แบฟn mass assignment.

Kiแปƒm tra lแป— hแป•ng Mass Assignment

Kiแปƒm tra lแป— hแป•ng Mass Assignment

  • Bฦฐแป›c 1: Thแปญ thรชm tham sแป‘ แบฉn vร o yรชu cแบงu PATCH

    • Gแปญi yรชu cแบงu cแบญp nhแบญt thรดng tin ngฦฐแปi dรนng vแป›i tham sแป‘ isAdmin ฤ‘ฦฐแปฃc thรชm vร o:

      {
    "username": "wiener",
    "email": "wiener@example.com",
    "isAdmin": false
}

    • Nแบฟu แปฉng dแปฅng chแบฅp nhแบญn yรชu cแบงu mร  khรดng cรณ phแบฃn hแป“i lแป—i, cรณ thแปƒ tham sแป‘ nร y ฤ‘ang ฤ‘ฦฐแปฃc xแปญ lรฝ nแป™i bแป™.

  • Bฦฐแป›c 2: Kiแปƒm tra phแบฃn hแป“i vแป›i giรก trแป‹ khรดng hแปฃp lแป‡

    • Gแปญi yรชu cแบงu PATCH vแป›i giรก trแป‹ khรดng hแปฃp lแป‡ cho isAdmin:

      {
    "username": "wiener",
    "email": "wiener@example.com",
    "isAdmin": "foo"
}

    • Nแบฟu แปฉng dแปฅng phแบฃn hแป“i khรกc nhau giแปฏa giรก trแป‹ hแปฃp lแป‡ vร  khรดng hแปฃp lแป‡, ฤ‘iแปu nร y cรณ thแปƒ cho thแบฅy tham sแป‘ ฤ‘ang tรกc ฤ‘แป™ng ฤ‘แบฟn logic xแปญ lรฝ cแปงa แปฉng dแปฅng.

  • Bฦฐแป›c 3: Khai thรกc lแป— hแป•ng bแบฑng cรกch thay ฤ‘แป•i giรก trแป‹ thร nh true

    • Gแปญi yรชu cแบงu PATCH vแป›i giรก trแป‹ isAdmin lร  true:

      {
    "username": "wiener",
    "email": "wiener@example.com",
    "isAdmin": true
}

    • Nแบฟu tham sแป‘ nร y khรดng ฤ‘ฦฐแปฃc kiแปƒm tra vร  xรกc thแปฑc ฤ‘รบng cรกch, ngฦฐแปi dรนng cรณ thแปƒ ฤ‘ฦฐแปฃc cแบฅp quyแปn admin ngoร i รฝ muแป‘n.

  • Bฦฐแป›c 4: Kiแปƒm tra quyแปn truy cแบญp

    • ฤฤƒng nhแบญp vร o แปฉng dแปฅng bแบฑng tร i khoแบฃn wiener vร  kiแปƒm tra xem cรณ thแปƒ truy cแบญp cรกc tรญnh nฤƒng dร nh cho admin hay khรดng.

    • Nแบฟu cรณ thแปƒ truy cแบญp, chแปฉng tแป แปฉng dแปฅng ฤ‘รฃ bแป‹ khai thรกc lแป— hแป•ng mass assignment.

Kแบฟt luแบญn: Nแบฟu แปฉng dแปฅng khรดng kiแปƒm tra vร  lแปc tham sแป‘ แบฉn hแปฃp lรฝ, kแบป tแบฅn cรดng cรณ thแปƒ lแปฃi dแปฅng ฤ‘แปƒ chiแบฟm quyแปn kiแปƒm soรกt hoแบทc thay ฤ‘แป•i dแปฏ liแป‡u quan trแปng.

Lab: Exploiting a mass assignment vulnerability

Preventing vulnerabilities in APIs

Khi thiแบฟt kแบฟ API, yแบฟu tแป‘ bแบฃo mแบญt cแบงn ฤ‘ฦฐแปฃc chรบ trแปng ngay tแปซ giai ฤ‘oแบกn ฤ‘แบงu. ฤแปƒ ฤ‘แบฃm bแบฃo an toร n, hรฃy thแปฑc hiแป‡n cรกc bฦฐแป›c sau:

  1. Bแบฃo vแป‡ tร i liแป‡u API:

    • Nแบฟu API cแปงa bแบกn khรดng dร nh cho cรดng khai, hรฃy bแบฃo mแบญt tร i liแป‡u ฤ‘แปƒ hแบกn chแบฟ truy cแบญp trรกi phรฉp.

  2. Cแบญp nhแบญt tร i liแป‡u thฦฐแปng xuyรชn:

    • ฤแบฃm bแบฃo tร i liแป‡u luรดn phแบฃn รกnh ฤ‘รบng hiแป‡n trแบกng cแปงa API, giรบp cรกc tester hแปฃp phรกp dแป… dร ng kiแปƒm tra vร  xรกc ฤ‘แป‹nh bแป mแบทt tแบฅn cรดng.

  3. Hแบกn chแบฟ phฦฐฦกng thแปฉc HTTP:

    • Chแป‰ cho phรฉp nhแปฏng HTTP method cแบงn thiแบฟt (nhฦฐ GET, POST) bแบฑng cรกch sแปญ dแปฅng danh sรกch cho phรฉp (allowlist).

  4. Xรกc thแปฑc loแบกi nแป™i dung (Content-Type):

    • Kiแปƒm tra vร  ฤ‘แบฃm bแบฃo rแบฑng mแป—i yรชu cแบงu (request) hoแบทc phแบฃn hแป“i (response) chแป‰ chแปฉa loแบกi nแป™i dung phรน hแปฃp vแป›i dแปฑ kiแบฟn.

  5. แบจn thรดng tin trong lแป—i:

    • Thay vรฌ cung cแบฅp thรดng bรกo lแป—i chi tiแบฟt, hรฃy sแปญ dแปฅng cรกc thรดng bรกo lแป—i chung chung ฤ‘แปƒ trรกnh rรฒ rแป‰ thรดng tin mร  kแบป tแบฅn cรดng cรณ thแปƒ lแปฃi dแปฅng.

  6. Bแบฃo mแบญt trรชn tแบฅt cแบฃ cรกc phiรชn bแบฃn API:

    • Khรดng chแป‰ tแบญp trung vร o phiรชn bแบฃn production, mร  mแปi phiรชn bแบฃn (bao gแป“m cแบฃ phiรชn bแบฃn cลฉ hoแบทc beta) ฤ‘แปu cแบงn ฤ‘ฦฐแปฃc รกp dแปฅng cรกc biแป‡n phรกp bแบฃo vแป‡ tฦฐฦกng tแปฑ.

  7. Ngฤƒn ngแปซa lแป— hแป•ng "Mass Assignment":

    • Sแปญ dแปฅng danh sรกch cho phรฉp (allowlist) ฤ‘แปƒ giแป›i hแบกn cรกc thuแป™c tรญnh mร  ngฦฐแปi dรนng cรณ thแปƒ cแบญp nhแบญt. ฤแป“ng thแปi, chแบทn nhแปฏng thuแป™c tรญnh nhแบกy cแบฃm bแบฑng danh sรกch chแบทn (blocklist) ฤ‘แปƒ ngฤƒn chแบทn truy cแบญp khรดng mong muแป‘n.

Server-side parameter pollution

Mแป™t sแป‘ hแป‡ thแป‘ng chแปฉa cรกc API nแป™i bแป™ khรดng ฤ‘ฦฐแปฃc truy cแบญp trแปฑc tiแบฟp tแปซ internet. Lแป— hแป•ng Server-side Parameter Pollution (SSPP) xแบฃy ra khi mแป™t trang web nhรบng ฤ‘แบงu vร o cแปงa ngฦฐแปi dรนng vร o yรชu cแบงu gแปญi ฤ‘แบฟn API nแป™i bแป™ mร  khรดng thแปฑc hiแป‡n mรฃ hรณa ฤ‘แบงy ฤ‘แปง. ฤiแปu nร y cho phรฉp kแบป tแบฅn cรดng thao tรบng hoแบทc tiรชm cรกc tham sแป‘ khรกc, dแบซn ฤ‘แบฟn:

  • Ghi ฤ‘รจ cรกc tham sแป‘ hiแป‡n cรณ.

  • Thay ฤ‘แป•i hร nh vi cแปงa แปฉng dแปฅng.

  • Truy cแบญp dแปฏ liแป‡u trรกi phรฉp.

Testing the query string

1. Kiแปƒm tra cแบฏt chuแป—i truy vแบฅn (Truncating query strings)

Khi kiแปƒm tra khแบฃ nฤƒng cแบฏt chuแป—i truy vแบฅn, bแบกn cรณ thแปƒ thรชm kรฝ tแปฑ ฤ‘แบทc biแป‡t nhฦฐ #, &, hoแบทc = vร o ฤ‘แบงu vร o cแปงa mรฌnh ฤ‘แปƒ quan sรกt phแบฃn hแป“i tแปซ แปฉng dแปฅng.

Vรญ dแปฅ minh hแปa: แปจng dแปฅng dแป… bแป‹ tแบฅn cรดng cho phรฉp tรฌm kiแบฟm ngฦฐแปi dรนng bแบฑng tรชn ฤ‘ฤƒng nhแบญp:

GET /userSearch?name=peter&back=/home

Mรกy chแปง sแบฝ gแปญi yรชu cแบงu nแป™i bแป™ sau:

GET /users/search?name=peter&publicProfile=true

ฤแปƒ thแปญ cแบฏt chuแป—i truy vแบฅn, bแบกn cรณ thแปƒ thรชm kรฝ tแปฑ # (ฤ‘รฃ mรฃ hรณa URL):

GET /userSearch?name=peter%23foo&back=/home

Mรกy chแปง sau ฤ‘รณ cรณ thแปƒ gแปญi yรชu cแบงu nแป™i bแป™ nhฦฐ sau:

GET /users/search?name=peter#foo&publicProfile=true

  • Lฦฐu รฝ: Kรฝ tแปฑ # cแบงn ฤ‘ฦฐแปฃc mรฃ hรณa URL (vรญ dแปฅ %23). Nแบฟu khรดng, แปฉng dแปฅng phรญa front-end sแบฝ coi ฤ‘รณ lร  "fragment identifier" vร  khรดng chuyแปƒn nรณ ฤ‘แบฟn API nแป™i bแป™.

  • Dแบฅu hiแป‡u khai thรกc thร nh cรดng:

    • Nแบฟu phแบฃn hแป“i trแบฃ vแป kแบฟt quแบฃ cho ngฦฐแปi dรนng "peter" mร  khรดng cแบงn kiแปƒm tra publicProfile, truy vแบฅn ฤ‘รฃ bแป‹ cแบฏt thร nh cรดng.

    • Nแบฟu phแบฃn hแป“i trแบฃ vแป lแป—i nhฦฐ "Invalid name", cรณ thแปƒ foo ฤ‘รฃ bแป‹ xแปญ lรฝ nhฦฐ mแป™t phแบงn cแปงa tรชn ngฦฐแปi dรนng.

2. Tiรชm tham sแป‘ khรดng hแปฃp lแป‡ (Injecting invalid parameters)

Bแบกn cรณ thแปƒ sแปญ dแปฅng kรฝ tแปฑ & (ฤ‘รฃ mรฃ hรณa URL) ฤ‘แปƒ thรชm tham sแป‘ mแป›i vร o yรชu cแบงu nแป™i bแป™.

Vรญ dแปฅ: Sแปญa chuแป—i truy vแบฅn nhฦฐ sau:

GET /userSearch?name=peter%26foo=xyz&back=/home

Khi ฤ‘รณ, API nแป™i bแป™ sแบฝ nhแบญn yรชu cแบงu:

GET /users/search?name=peter&foo=xyz&publicProfile=true

  • Quan sรกt phแบฃn hแป“i:

    • Nแบฟu khรดng cรณ thay ฤ‘แป•i, tham sแป‘ foo cรณ thแปƒ ฤ‘รฃ ฤ‘ฦฐแปฃc tiรชm nhฦฐng bแป‹ แปฉng dแปฅng bแป qua.

    • Tiแบฟp tแปฅc thแปญ nghiแป‡m ฤ‘แปƒ hiแปƒu rรต cรกch tham sแป‘ nร y ฤ‘ฦฐแปฃc xแปญ lรฝ.

3. Tiรชm tham sแป‘ hแปฃp lแป‡ (Injecting valid parameters)

Khi tรฌm ra cรกc tham sแป‘ hแปฃp lแป‡ cรณ thแปƒ tiรชm, bแบกn cรณ thแปƒ thรชm chรบng vร o yรชu cแบงu nแป™i bแป™.

Vรญ dแปฅ: Nแบฟu phรกt hiแป‡n tham sแป‘ email, bแบกn cรณ thแปƒ thรชm nรณ:

GET /userSearch?name=peter%26email=foo&back=/home

Yรชu cแบงu nแป™i bแป™ sแบฝ trแปŸ thร nh:

GET /users/search?name=peter&email=foo&publicProfile=true

  • Quan sรกt phแบฃn hแป“i:

    • Nแบฟu tham sแป‘ email ฤ‘ฦฐแปฃc xแปญ lรฝ, bแบกn cรณ thแปƒ kiแปƒm tra xem nรณ แบฃnh hฦฐแปŸng thแบฟ nร o ฤ‘แบฟn phแบฃn hแป“i.

4. Ghi ฤ‘รจ tham sแป‘ hiแป‡n cรณ (Overriding existing parameters)

ฤแปƒ kiแปƒm tra lแป— hแป•ng, bแบกn cรณ thแปƒ thแปญ tiรชm mแป™t tham sแป‘ trรนng tรชn ฤ‘แปƒ ghi ฤ‘รจ giรก trแป‹ ban ฤ‘แบงu.

Vรญ dแปฅ: Sแปญa chuแป—i truy vแบฅn nhฦฐ sau:

GET /userSearch?name=peter%26name=carlos&back=/home

Yรชu cแบงu nแป™i bแป™ sแบฝ trแปŸ thร nh:

GET /users/search?name=peter&name=carlos&publicProfile=true

  • Cรกch xแปญ lรฝ phแปฅ thuแป™c cรดng nghแป‡ web:

    • PHP: Chแป‰ xแปญ lรฝ tham sแป‘ cuแป‘i cรนng (carlos).

    • ASP.NET: Kแบฟt hแปฃp cแบฃ hai tham sแป‘ (peter,carlos).

    • Node.js / Express: Chแป‰ xแปญ lรฝ tham sแป‘ ฤ‘แบงu tiรชn (peter).

  • Dแบฅu hiแป‡u khai thรกc:

    • Nแบฟu ghi ฤ‘รจ thร nh cรดng, bแบกn cรณ thแปƒ thแปญ thรชm tham sแป‘ nhฦฐ name=administrator ฤ‘แปƒ thแปฑc hiแป‡n hร nh vi khai thรกc (vรญ dแปฅ: ฤ‘ฤƒng nhแบญp dฦฐแป›i quyแปn admin).

Lab: Exploiting server-side parameter pollution in a query string

Testing for server-side parameter pollution in REST paths

Mแป™t API RESTful cรณ thแปƒ sแปญ dแปฅng tรชn vร  giรก trแป‹ tham sแป‘ trong ฤ‘ฦฐแปng dแบซn URL thay vรฌ chuแป—i truy vแบฅn. Vรญ dแปฅ, xรฉt ฤ‘ฦฐแปng dแบซn sau:

/api/users/123

ฤฦฐแปng dแบซn URL cรณ thแปƒ ฤ‘ฦฐแปฃc phรขn tรญch nhฦฐ sau:

  • /api lร  ฤ‘iแปƒm cuแป‘i gแป‘c cแปงa API.

  • /users lร  tร i nguyรชn, trong trฦฐแปng hแปฃp nร y lร  ngฦฐแปi dรนng.

  • /123 lร  tham sแป‘, แปŸ ฤ‘รขy lร  ฤ‘แป‹nh danh cho ngฦฐแปi dรนng cแปฅ thแปƒ.

Vรญ dแปฅ vแป แปฉng dแปฅng dแป… bแป‹ tแบฅn cรดng: Mแป™t แปฉng dแปฅng cho phรฉp chแป‰nh sแปญa hแป“ sฦก ngฦฐแปi dรนng theo tรชn ฤ‘ฤƒng nhแบญp. Yรชu cแบงu ฤ‘ฦฐแปฃc gแปญi ฤ‘แบฟn endpoint sau:

GET /edit_profile.php?name=peter

Yรชu cแบงu phรญa mรกy chแปง sแบฝ lร :

GET /api/private/users/peter

Kแบป tแบฅn cรดng cรณ thแปƒ thao tรบng tham sแป‘ ฤ‘ฦฐแปng dแบซn phรญa mรกy chแปง ฤ‘แปƒ khai thรกc API. ฤแปƒ kiแปƒm tra lแป— hแป•ng nร y, bแบกn cรณ thแปƒ thรชm cรกc chuแป—i path traversal ฤ‘แปƒ thay ฤ‘แป•i tham sแป‘ vร  quan sรกt cรกch แปฉng dแปฅng phแบฃn hแป“i.

Vรญ dแปฅ thแปญ nghiแป‡m: Bแบกn cรณ thแปƒ gแปญi giรก trแป‹ mรฃ hรณa URL peter/../admin cho tham sแป‘ name:

GET /edit_profile.php?name=peter%2f..%2fadmin

ฤiแปu nร y cรณ thแปƒ dแบซn ฤ‘แบฟn yรชu cแบงu phรญa mรกy chแปง sau:

GET /api/private/users/peter/../admin

  • Nแบฟu API hoแบทc mรกy chแปง phรญa back-end chuแบฉn hรณa ฤ‘ฦฐแปng dแบซn (normalize path), nรณ cรณ thแปƒ giแบฃi quyแบฟt thร nh:

    GET /api/private/users/admin

Lab: Exploiting server-side parameter pollution in a REST URL

{
  "error": "Unexpected response from API server: {
    \"openapi\": \"3.0.0\",
    \"info\": {
      \"title\": \"User API\",
      \"version\": \"2.0.0\"
    },
    \"paths\": {
      \"/api/internal/v1/users/{username}/field/{field}\": {
        \"get\": {
          \"tags\": [
            \"users\"
          ],
          \"summary\": \"Find user by username\",
          \"description\": \"API Version 1\",
          \"parameters\": [
            {
              \"name\": \"username\",
              \"in\": \"path\",
              \"description\": \"Username\",
              \"required\": true,
              \"schema\": {
                \"type\": \"string\"
              }
            },
            {
              \"name\": \"field\",
              \"in\": \"path\",
              \"description\": \"Field to retrieve (e.g., email, passwordResetToken)\",
              \"required\": true,
              \"schema\": {
                \"type\": \"string\"
              }
            }
          ]
        }
      }
    }
  }"
}

Endpoint phรขn tรญch chi tiแบฟt:

  • /api/internal/v1/users/{username}/field/{field}:

    • Method: "get" (phฦฐฦกng thแปฉc GET ฤ‘แปƒ lแบฅy dแปฏ liแป‡u tแปซ server).

    • Parameters:

      • "username":

        • Loแบกi tham sแป‘: "in": "path" (tham sแป‘ nแบฑm trong URL).

        • Bแบฏt buแป™c ("required": true).

        • Cรณ mรด tแบฃ: "description": "Username".

      • "field":

        • ฤรขy lร  mแป™t tham sแป‘ khรกc trong endpoint, cho phรฉp bแบกn xรกc ฤ‘แป‹nh loแบกi thรดng tin cแบงn lแบฅy tแปซ API (vรญ dแปฅ: email, token...).

PreviousServer-side topicsNextRace conditions

Last updated