microsoft / restler-fuzzer

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.52k stars 284 forks source link

microsoft/restler always gives 400 Invalid Request #776

Open IrfanSyed-PSC opened 1 year ago

IrfanSyed-PSC commented 1 year ago

Description

After building restler, I compiled the code and then perform test operation

restler/Restler test --host myhost.net --grammar_file $PWD/Compile/grammar.py --dictionary_file $PWD/Compile/dict.json --settings $PWD/auth_settings.json

Every time for "test", I get the following error for all the API's.

"response": "HTTP/1.1 400 Invalid Request\r\nDate: Mon, 12 Jun 2023 18:34:46 GMT\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nConnection: close\r\nContent-Length: 87\r\nContent-Type: text/html\r\n\r\n400 Invalid RequestInvalid Request: ??\r\n"

I played back the same request in the curl command as mentioned in specov.min.json and it works fine there. Am I missing something when making a HTTPS call to my endpoint ? I do not see anything wrong. As this is happening for every API in the openapi specification, I think somethings wrong with the configuration.

I tried this with running the server on a https and http. Same result. There is no trace of request reaching the server.

Appreciate if someone can help !

IrfanSyed-PSC commented 1 year ago

After more debugging, found that it is failing because it cannot digest the value returned by the authentication function. This is the error I am getting while getting the token.

Using Token authentication method: TokenAuthMethod.MODULE with error invalid decimal literal (, line 1) 2023-06-13 23:49:27.025: Authentication failed when refreshing token:

I can see that the token is a valid bearer token and I can log the returned value successfully. Why would I see this error ? Is there a specific format while we return the token ?

Below is the function that gets called to get authorization token.

`

def acquire_token(data, log):

Define the request payload with username and password

payload = {
    "username": "user",
    "password": "password"
}

# Make a POST request to retrieve the token
response = requests.post("http://localhost/api/v1/auth", json=payload)

# Check if the request was successful
if response.status_code == 201:
    # Parse the token data from the response
    body = response.json()
    token_data = body['token']
    log('returning token' + token_data)
    token_lines = ["Authorization: Bearer " + token_data]
    log("\n".join(token_lines))
    return "\n".join(token_lines)
else:
    # Handle the case when the request fails
    log('err')
    raise Exception(f"Failed to retrieve token. Status code: {response.status_code}")

`

alezac89 commented 12 months ago

Hello,

try something like that.

return "{u'app1': {\"header\":\"value\"}}\nAuthorization: Bearer " + token_data

It looks like it needs some Metadata at the start of what the function returns.