akto icon indicating copy to clipboard operation
akto copied to clipboard

Published 20 hours ago • verified publisher icon akto-api-security

⛏️ Write a test to check whether we can create/update an object with invalid UPI Id

Open ankush-jain-akto opened this issue 1 year ago • 6 comments

💭 Introduction: We want to test to check whether an attacker can create/update entity with an invalid UPI Id.

🎯 Requirements:

  1. Filters - API with UPI ID as an input in GET query parameter or JSON body parameter

  2. Execute - It should replace the value with

  • special characters
  • A very long string (> 255 characters)
  • Use whitespaces
  • Invalid UPI
  • A negative integer
  • A very long integer causing integer overflow
  • Zero
  • NULL
  1. Validation - If the application responds with a exception trace, it is a vulnerability.

📚 Reading You can find a detailed documentation of test editor rules here Find 100+ examples of YAML tests here

✅ Task summary:

  • [ ] Ask to be assigned to the issue.
  • [ ] Wait to be assigned. We will try to assign in less than 2 hours.
  • [ ] Signup for Akto
  • [ ] Fork the tests-library repository, create a new branch and commit the yaml file which will be called in your test.
  • [ ] Submit both the PR here.

✌🏻 Hints: You can build the yaml template by referring this link

🙋🏼‍♂️ Questions: If you have questions, need any help, or just want to hang out, make sure to join us on our Discord server.

ankush-jain-akto avatar Oct 09 '23 05:10 ankush-jain-akto

Hi!

I would like to be assigned this issue. this is my first time participating in Hacktoberfest, I am a CS undergrad student and would like to contribute

the1andonlymanojos avatar Oct 10 '23 18:10 the1andonlymanojos

Hi @the1andonlymanojos - Assigned it to you. Good luck 👍 Let me know, happy to come on a call and help 😃

ankush-jain-akto avatar Oct 11 '23 05:10 ankush-jain-akto

https://github.com/akto-api-security/tests-library/pull/19

the1andonlymanojos avatar Oct 11 '23 17:10 the1andonlymanojos

Hey, I'd like to work on this issue.

SanjeedhaShriya avatar Oct 15 '23 16:10 SanjeedhaShriya

akto-api-security/tests-library#19

is the PR alright? is anything wrong with it?

the1andonlymanojos avatar Oct 16 '23 14:10 the1andonlymanojos

@the1andonlymanojos

  1. Test template has some missing fields.
  2. Refer this template https://github.com/akto-api-security/tests-library/blob/master/Local-File-Inclusion/LFIInParameter.yaml. Instead of copy pasting multiple "req" you can use them once with lists.
  3. You are just filtering endpoints based on UPI_ID but not extracting them to a variable to be used in execution phase.

Make sure to run the template on a sample API before you make the PR.

avneesh-akto avatar Oct 19 '23 06:10 avneesh-akto