Nowadays REST APIs are behind each mobile and nearly all of web applications. As such they bring a wide range of possibilities in cases of communication and integration with given system. But with great power comes great responsibility. This talk aims to provide general guidance related do API security assessment and covers common API vulnerabilities. We will look at an API interface from the perspective of potential attacker.
I will show:
how to find hidden API interfaces
ways to detect available methods and parameters
fuzzing and pentesting techniques for API calls
typical problems
I will share several interesting cases from public bug bounty reports and personal experience, for example:
* how I got various credentials with one API call
* how to cause DoS by running Garbage Collector from API
3. www.securing.pl
KA-BOOM
„Whenever a user Forgets his password on Facebook, he has an option to
reset the password by entering his phone number/ email address on:
https://www.facebook.com/login/identify?ctx=recover&lwv=110
Facebook will then send a 6 digit code on his phone number/email address
which user has to enter in order to set a new password.
I tried to brute the 6 digit code on www.facebook.com and was blocked after
10-12 invalid attempts.”
4. www.securing.pl
KA-BOOM
„Then i looked out for the same issue on beta.facebook.com and
mbasic.beta.facebook.com and interestingly rate limiting was missing on
forgot password endpoints.”
9. www.securing.pl
REST API
• Is everywhere (web&mobile)
• Is build on top of existing applications
• More and more companies allow to use it’s API
• Applications are more interconnected
• Microservices
11. www.securing.pl
• Senior IT Security Specialist, SecuRing
• Web & mobile application security
• OWASP Poland member
• Ex developer
• Bug hunter
Who am I
14. www.securing.pl
REST API 101
• REST – representational state transfer
• Data usually is sent as JSON
• HTTP methods have a meaning (usually):
• GET - list (collection), retrieve data (element)
• PUT – replace (all data is changed)
• PATCH – update
• POST – create (new element)
• DELETE
17. www.securing.pl
• Sometimes no known endpoints
• Sometimes no docs
• Sometimes no keys/credentials
• Sometimes no sample calls !!
REST API Bug bounty
47. www.securing.pl
• Still no docs?
• Error messages to the rescue!
• Brute force parameter names!
Finding sample calls
48. www.securing.pl
• Still no docs?
• Error messages to the rescue!
• Brute force parameter names!
• Analyze JS code (see JS-Scan)
• Dissect mobile app ( Apk-Scan for Android apps hadrcoded URL’s)
Finding sample calls
50. www.securing.pl
Finding keys
• Check mobile application
• Check GitHub (truffleHog to the rescue):
• Scan public repos of a company
• Scan public repos of a company devs
52. www.securing.pl
Finding keys
• Check mobile application
• Check GitHub (truffleHog to the rescue):
• Scan public repos of a company
• Scan public repos of a company devs
53. www.securing.pl
Finding keys
• Check mobile application
• Check GitHub (truffleHog to the rescue):
• Scan public repos of a company
• Scan public repos of a company devs
57. www.securing.pl
„Jolokia is a JMX-HTTP bridge giving an alternative to JSR-160 connectors. It
is an agent based approach with support for many platforms. In addition to
basic JMX operations it enhances JMX remoting with unique features like
bulk requests and fine grained security policies.”
#1 Jolokia
58. www.securing.pl
„Jolokia is a JMX-HTTP bridge giving an alternative to JSR-160 connectors. It
is an agent based approach with support for many platforms. In addition to
basic JMX operations it enhances JMX remoting with unique features like
bulk requests and fine grained security policies.”
https://example.com/jolokia/write/Tomcat:port=19880,type=Connector/xp
oweredBy/true
#1 Jolokia
59. www.securing.pl
„Jolokia is a JMX-HTTP bridge giving an alternative to JSR-160 connectors. It
is an agent based approach with support for many platforms. In addition to
basic JMX operations it enhances JMX remoting with unique features like
bulk requests and fine grained security policies.”
https://example.com/jolokia/write/Tomcat:port=19880,type=Connector/xp
oweredBy/true
X-Powered-By:Servlet/3.1 JSP/2.3 (Apache Tomcat/8.0.20 Java/Oracle
Corporation/1.8.0_60-b27)
#1 Jolokia
64. www.securing.pl
#2 REST API wrongly placed
• A form
• Putting ID and solving CAPTCHA
• Secured (no way to brute force ID)
65. www.securing.pl
#2 REST API wrongly placed
• A form
• Putting ID and solving CAPTCHA
• Secured (no way to brute force ID)
• A mobile app with the same feature
66. www.securing.pl
#2 REST API wrongly placed
• A form
• Putting ID and solving CAPTCHA
• Secured (no way to brute force ID)
• A mobile app with the same feature
• No CAPTCHA
67. www.securing.pl
#2 REST API wrongly placed
• A form
• Putting ID and solving CAPTCHA
• Secured (no way to brute force ID)
• A mobile app with the same feature
• No CAPTCHA
• No rate limiting
68. www.securing.pl
#2 REST API wrongly placed
• A form
• Putting ID and solving CAPTCHA
• Secured (no way to brute force ID)
• A mobile app with the same feature
• No CAPTCHA
• No rate limiting
• Brute force &profit report to client !