search

imperva / automatic-api-attack-tool

Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.
MIT License
451 stars 91 forks source link

API Authentication is not possible? #5

Open danilobasanta opened 4 years ago

danilobasanta commented 4 years ago

API Authentication is not possible? The most API evaluation requires previus authentication to consume many other functions...

thenorthernpole commented 4 years ago

I am sorry, I haven't got a notification about this issue, and thus am responding only now. Could you please give an example?

0x3f8 commented 4 years ago

An example would be calling the API and providing a cookie or in many cases a bearer token in the headers such as in this sample request

GET /dev HTTP/1.1
Host: some.api.endpoint.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Connection: close
Upgrade-Insecure-Requests: 1

As a side note: you can run the app through the burp proxy and inject the headers. There are options to capture cookies and extensions to inject other headers as needed, so it's a workaround.

thenorthernpole commented 4 years ago

Will implement. Any preferred way to specify the headers/query params? (such security tokens may appear also in query params). I thought of a cURL-like way.

0x3f8 commented 4 years ago

I have no preferences but a cURL like way would be convenient and lower the barrier of entry for anyone already familiar with that tool :)

Thanks for the quick response!