Pentesting RESTful WebServices v1.0
14 likes13,742 views
This document discusses RESTful web services and provides guidance on testing them. It defines REST and its key aspects, including resources, verbs, media types and status codes. It outlines common problems with REST penetration testing and recommends using tools like cURL and browser add-ons for testing. The document also covers authentication, authorization, input validation, output encoding and other important areas to focus testing on.
![GET site.com/users/
{ users:[
{
"login": "MohammedAImran",
"id": "313",
"name": "Mohammed A. Imran",
"company": "CA Inc",
"email": "MohammedAbdullahImran@gmail.com"},
{
"login": "Raghunath",
"id": "311",
"name": " G Raghunath",
"company": "X Inc",
"email": "raghu@null.co.in"}]
}](https://image.slidesharecdn.com/pentesting-restful-webservicesv1-140407120957-phpapp01/85/Pentesting-RESTful-WebServices-v1-0-25-320.jpg)
Pentesting RESTful WebServices v1.0
- 2. Hello MOHAMMED A. IMRAN ApplicationSecurityEngineer,CAInc Null Hyderabad Lead OWASP Hyderabad Board Member @MohammedAImran MI Created and Designed using
- 3. LET’S TALK ABOUT ... PROBLEMS WITH REST WS TESTING TOOLS & TECHNIQUES WHAT IS RESTful WEB SERVICES? METHODOLOGY TO TEST RESTful WS
- 5. THEUGLYTRUTH SOAP Webservices VS RESTful Webservices Google Trends
- 8. Easy&Simple <?xml version="1.0"?> <soap:Envelope xmlns:soap="http://www.w3.org/2001/12/soap-envelope" soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding"> <soap:Body xmlns:m="http://www.mysite.com/users"> <m:GetUserDetails> <m:UserID>313</m:UserID> </m:GetUserDetails> </soap:Body> </soap:Envelope> GET /users/313/ VS
- 9. Lightweight <soap:Body xmlns:m="http://www.mysite.com/users"> <m:GetUserDetailsResponse> <m:UserName>MohammedAImran</m:UserName> <m:Type>user</m:Type> <m:SiteAdmin>false</m:SiteAdmin> <m:UserName>Mohammed A.Imran</m:UserName> <m:Company>CA Inc</m:Company> <m:Email> [email protected] </m:Email> </m:GetUserDetailsResponse> </soap:Body> { "login": "MohammedAImran", "type": "User", "site_admin": false, "name": "Mohammed A. Imran", "company": "CA Inc", "email": "[email protected]" } VS Note: REST can also use XML as media type
- 10. Manymorereasonstouse... ● Easy to understand & document ● Easy on limited bandwidth ● READS can be cached and hence reduces the bandwidth ● Better browser support since data format mostly is json ● Can be used by mobile devices ● Loosely coupled
- 11. ButwhatisREST ?
- 12. Representational state transfer (REST) is an architectural style consisting of a coordinated set of constraints applied to components, connectors, and data elements, within a distributed hypermedia system. “
- 13. What?Letmeexplain... REST is an architectural style with some imposed constraints in how data is accessed and represented while developing web services or applications. It uses HTTP 1.1 as inspiration.
- 14. Insimpleterms REST = RFC 2616Well, almost
- 15. Insimpleterms... REST = HTTP Protocol with constraints
- 16. Architectureconstraints ● Uniform interface ● Client-server ● Stateless ● Cache-able ● Layered system ● Code on demand(optional)
- 17. RESTStyleconsistsof... Resources VERBS Media Types Status Codes
- 18. RESTStyleconsistsof... Resource URLs VERBS Media Types Status Codes
- 20. RESTStyleconsistsof... Resources VERBS Media Types Status Codes
- 22. POST = CREATECreate a new some resource * * POST can be used for both create and update
- 23. POST http://mysite.com/users/ { "login": "MohammedAImran", "id": "313", "name": "Mohammed A. Imran", "company": "CA Inc", "email": "[email protected]" }
- 24. GET = READFetch some resource
- 25. GET site.com/users/ { users:[ { "login": "MohammedAImran", "id": "313", "name": "Mohammed A. Imran", "company": "CA Inc", "email": "[email protected]"}, { "login": "Raghunath", "id": "311", "name": " G Raghunath", "company": "X Inc", "email": "[email protected]"}] }
- 26. GET site.com/users/313 { "login": "MohammedAImran", "id": "313", "name": "Mohammed A. Imran", "company": "CA Inc", "email": "[email protected]" }
- 27. PUT =UPDATE/MODIFYUpdate some resource * PUT can be used for both create and update *
- 28. DELETE = DELETEDelete a resource
- 29. RESTStyleconsistsof... Resources VERBS Media Types Status Codes
- 30. HATEOAS Hypermedia As The Engine Of Application State
- 33. RESTStyleconsistsof... Resources VERBS Media Types Status Codes
- 34. StatusCodes 400 Bad Request 401 Unauthorized 403 Forbidden 404 Not Found 405 Method Not Allowed 409 Conflict 200 OK 201 Created 204 No Content 304 Not Modified 500 Internal Server Error 501 Not Implemented
- 36. DifficultyindoingRESTPT ● Many JSON variables to fuzz and difficult to find which ones are optional and to be fuzzed ● Custom authentication ● Statelessness ● Non common HTTP status codes which tools are used to
- 37. DifficultyindoingRESTPT... ● Not so good automated tool support ● Every API is different from other and hence need custom tweaking for tools ● Heavy reliance on Ajax frameworks for creating PUT and DELETE requests as most browsers don’t support them
- 39. Authentication
- 41. Authentication... ● REST APIs rely heavily on SSL ● Often basic authentication is coupled with SSL ( Bruteforce ? ) ● Often custom token authentication schemes are built and used ( a sure recipe for disaster) ● Never pass username/password, tokens, keys in URL (use POST instead ) ● Implementing authentication tokens in Headers takes away headache of having a CSRF token
- 42. SessionManagement ● Check all session based attacks on tokens as well ● Session timeout ● Session brute force ● Generally tokens are stored in local storage of browsers, make sure you delete the token after log-out and upon browser window close ● Invalidate the token at server side upon on logout
- 43. Authorization ● Privilege escalation (Horizontal and Vertical) ● Make sure there is a tight access control on DELETE, PUT methods ● Use role based authentication ● Since usually the consumers of the REST APIs are machines, there are no checks if service is heavily used, could lead to DoS or BruteForce. ● Protect administrative functionality
- 44. CVE-2010-0738
- 46. NOTE All attacks which are possible on any web application are possible with REST APIs as well.
- 47. InputValidation ● SQL Injection ● XSS ● Command Injection ● XPATH Injection However XSS becomes difficult to fuzz because of JSON and you might want to scan with sql injection and xss profiles separately
- 48. Outputencoding ● If you application has a web interface then might want to use the following headers: – X-Content-Type-Options: nosniff – X-Frame-Options: DENY/SAMEORIGIN/ALLOW-FROM ● JSON Encoding
- 49. Cryptography ● Use TLS with good key size (384 bits preferably) ● Use client side certificates possible however not usually seen for APIs ● Use strong hashing algorithms(scrypt/bcrypt/SHA512) ● Use strong encryption mechanisms (AES)
- 50. Fewnotes... ● Use proxy to determine the attack surface and to understand the application ● Identify URLs, Resources, status codes and data needed ● Every part of the http protocol is potential for fuzzing in RESTful APIs (dont forget headers) ● WAF evasion is possible since json is not well understood by WAFs
- 51. Tools&Techniques
- 52. Command-line-Fu
- 53. cURLPrimer cURL -b or - -cookie ”COOKIE HERE” -h or - -header “Authorization: Custom SW1yYW5XYXNIZXJlCg==” -X or - -request PUT/POST/DELETE -i or - -include //include response headers -d or - -data “username=imran&password=Imran” or - -data @filecontaining-data -x or - - proxy 127.0.0.1:8080 -A or - -user-agent ”Firefox 27.0”
- 54. cURLPrimer... ● cURL is great for automation if you know how service works. ● cURL libraries are available for majority of the languages like php, python and many more... ● You can perform complex operations and script them pretty fast.
- 55. cURLExamples #!/bin/bash users="Imran Jaya Raghu Vinayak" for dirName in $users do curl -i -H “Authorization: Custom SW1yYW5XYXNIZXJlCg==” "http://www.mysite.com/users/$dirName" --proxy 127.0.0.1:8080 done
- 56. GraphicalTools
- 57. FirefoxAdd-on
- 58. FirefoxAdd-on... ● If you need graphical interface, browser add-ons provide GUI, however not as powerful as the cURL command. ● Specialized developer tools ( SOAP UI ) can also be used for testing.
- 59. AutomatedTools
- 61. AppScanScan...
- 64. Credits * All icons are taken from The Noun project, credit goes to respective artists * OWASP Cheat sheet series