Automating REST Security Part 2: Tool-based Analysis With REST-Attacker

Our previous blog post described the challenges in analyzing REST API implementations. Despite the lack of REST standardization, we learned that similarities between implementations exist and that we can utilize them for tool-based REST security analysis.

This blog post will now look at our own implementation. REST-Attacker is a free software analysis tool specifically built to analyze REST API implementations and their access control measures. Using REST-Attacker as an example, this blog post will discuss how a REST security tool can work and where it can improve or streamline the testing process, especially in terms of automation.

Author

Christoph Heine

Overview

 Premise

REST-Attacker was developed as part of a master's thesis at the Chair for Network & Data Security at the Ruhr University Bochum. The primary motivation behind creating REST-Attacker was to evaluate how far we could push automation for REST security analysis. Hence, REST-Attacker provides several automation features such as automated test generation, test execution, and API communication. The tool essentially takes a "lazy tester" approach that tries to minimize the necessary amount of manual interaction as much as possible.

Creating a test run requires an OpenAPI file describing the REST API. Optional configuration, such as authentication credentials, can be provided to access protected API endpoints or run advanced test cases. Based on the API description and configuration, the tool can automatically generate complete test runs and execute them automatically. For this purpose, the current release version provides 32 built-in security test cases for analyzing various security issues and best practices.

How Testing Works

REST-Attacker can be used as a stand-alone CLI tool or as a Python module for integration in your own toolchain. In this blog post, we will mainly focus on running the tool via CLI. If you want to learn more about advanced usage, we recommend you read the docs.

Starting a basic test run looks like this:

python3 -m rest_attacker openapi.json --generate 

openapi.json is an OpenAPI file that describes the API we want to test. The --generate flag activates load-time test generation to automatically create a test run. In practice, this means that the tool passes the OpenAPI file to a test generation function of every available test case, which then returns a list of tests for the specific API. After creating the test run, REST-Attacker executes all tests one by one and saves the results.

There's also a second option for run-time test generation using the --propose flag:

python3 -m rest_attacker openapi.json --generate --propose 

In comparison to --generate, which creates tests from the OpenAPI description before starting the test run, --propose generates tests during a test run by considering the results of already executed tests. This option can be useful for some test cases where we want to take the responses of the API into account and run a follow-up test based on the observed behavior.

Both test generation methods can significantly speed up testing because they allow the creation of entire test runs without manual input. However, their feasibility often heavily depends on the verbosity and accuracy of the configuration data. Remember that many definitions, such as security requirements, are optional in the OpenAPI format, i.e., services can choose to omit them. API descriptions can also be outdated or contain errors, particularly if they are unofficial user-created versions. Despite all these limitations, an automated generation often works surprisingly well.

If you don't want to use the tool's generators, test runs can also be specified manually. For this purpose, you just pass a list of tests, including their serialized input parameters, via a config file:

python3 -m rest_attacker openapi.json --run example_run.json 

Advanced Automation

So far, we have only covered the automation of the test generation. However, what's even more interesting is that we can also automate much of the test execution process in REST-Attacker. The challenging part here is the streamlining of API communication. If you remember our previous blog post, you know that it basically involves these three steps:

  1. Preparing API request parameters
  2. Preparing access control data (handling authentication/authorization)
  3. Sending the request

Since most REST APIs are HTTP-based, step 3. is relatively trivial as any standard HTTP library will do the job. For example, REST-Attacker uses the popular Python requests module for its request backend. Step 1. is part of the test generation process and can be realized by using information from the machine-readable OpenAPI file, which we've already discussed. In the final step, we have to look at the access control (step 2.), which is especially relevant for security testing. Unfortunately, it is a bit more complex.

The problem is generally not that REST APIs use different access control methods. They are either standardized (HTTP Basic Auth, OAuth2) or extremely simple (API keys). Instead, complications often arise from the API-specific configuration and requirements for how these methods should be used and how credentials are integrated into the API request. For example, implementations may decide:

  • where credentials are located in the HTTP request (e.g., header, query, cookie, ...)
  • how credentials are encoded/formatted (e.g., Base64 encoding or use of keywords)
  • whether a combination of methods is required (e.g., API key + OAuth2)
  • (OAuth2) which authorization flows are supported
  • (OAuth2) which access scopes are supported
  • ...

Thereby, we cannot rely on an access control method, e.g., OAuth2, being used in the same way across different APIs. Furthermore, a lot of this information cannot be described in the OpenAPI format, so we have to find another solution. In REST-Attacker, we solve this problem with an additional custom configuration for access control. An example can be seen below (unfold it):

{     "schemes": {         "scheme0": {             "type": "header",             "key_id": "authorization",             "payload": "token {0}",             "params": {                 "0": {                     "id": "access_token",                     "from": [                         "token0",                     ]                 }             }         }     },     "creds": {         "client0": {             "type": "oauth2_client",             "description": "OAuth Client",             "client_id": "aabbccddeeff123456789",             "client_secret": "abcdef12345678998765431fedcba",             "redirect_uri": "https://localhost:1234/test/",             "authorization_endpoint": "https://example.com/login/oauth/authorize",             "token_endpoint": "https://example.com/login/oauth/token",             "grants": [                 "code",                 "token"             ],             "scopes": [                 "user"             ],             "flags": []         }     },     "required_always": {         "setting0": [             "scheme0"         ]     },     "required_auth": {},     "users": {         "user0": {             "account_id": "user",             "user_id": "userXYZ",             "owned_resources": {},             "allowed_resources": {},             "sessions": {                 "gbrowser": {                     "type": "browser",                     "exec_path": "/usr/bin/chromium",                     "local_port": "1234"                 }             },             "credentials": [                 "client0"             ]         }     } } 

The config file contains everything required for getting access to the API. schemes define location and encoding of credentials in the HTTP request, while credentials contain login credentials for either users or OAuth2 clients. There are also definitions for the required access control schemes for general access to the API (required_always) as well as for user-protected access (required_auth). For the purpose of authorization, we can additionally provide user definitions with session information. The latter can be used to create or access an active user session to retrieve OAuth2 tokens from the service.

Starting REST-Attacker with an access control config is similar as before. Instead of only passing the OpenAPI file, we use a folder that contains all configuration files:

python3 -m rest_attacker cfg/example --generate 

REST-Attacker completely handles all access control requirements in the background. Manual intervention is sometimes necessary, e.g., when there's a confirmation page for OAuth2 authorization. However, most of the steps, from selecting the proper access control schemes to retrieving OAuth2 tokens and creating the request payload, are all handled by REST-Attacker.

Interpreting Results

After a test run, REST-Attacker exports the test results to a report file. Every report gives a short summary of the test run and the results for each executed test case. Here you can see an example of a report file (unfold it):

{     "type": "report",     "stats": {         "start": "2022-07-16T14-27-20Z",         "end": "2022-07-16T14-27-25Z",         "planned": 1,         "finished": 1,         "skipped": 0,         "aborted": 0,         "errors": 0,         "analytical_checks": 0,         "security_checks": 1     },     "reports": [         {             "check_id": 0,             "test_type": "security",             "test_case": "https.TestHTTPAvailable",             "status": "finished",             "issue": "security_flaw",             "value": {                 "status_code": 200             },             "curl": "curl -X GET http://api.example.com/user",             "config": {                 "request_info": {                     "url": "http://api.example.com",                     "path": "/user",                     "operation": "get",                     "kwargs": {                         "allow_redirects": false                     }                 },                 "auth_info": {                     "scheme_ids": null,                     "scopes": null,                     "policy": "DEFAULT"                 }             }         }     ] } 

Individual test reports contain a basic classification of the detected behavior in the issue parameter and the detailed reasons for this interpretation in the value object. The meaning of the classification depends on the test case ID, which is stored in the test_case parameter. In the example above, the https.TestHTTPAvailable checks if an API endpoint is accessible via plain HTTP without transport security (which is generally considered unsafe). The API response is an HTTP message with status code 200, so REST-Attacker classifies the behavior as a flaw.

By default, reports also contain every test's configuration parameters and can be supplied back to the tool as a manual test run configuration. This is very useful if we want to reproduce a run to see if detected issues have been fixed.

python3 -m rest_attacker openapi.json --run report.json 

Conclusion

By now, you should know what REST API tools like REST-Attacker are capable of and how they can automate the testing process. In our next and final blog post, we will take a deeper look at practical testing with the REST-Attacker. To do this, we will present security test categories that are well-suited for tool-based analysis and investigate how we can apply them to test several real-world API implementations.

Acknowledgement

The REST-Attacker project was developed as part of a master's thesis at the Chair of Network & Data Security of the Ruhr University Bochum. I would like to thank my supervisors Louis Jannett, Christian Mainka, Vladislav Mladenov, and Jörg Schwenk for their continued support during the development and review of the project.

More info


  1. Pentest Tools Free
  2. Pentest Tools Url Fuzzer
  3. Hack Rom Tools
  4. Hacking Tools For Mac
  5. Best Pentesting Tools 2018
  6. Hack Tools 2019
  7. Hak5 Tools
  8. Hacking Tools For Windows
  9. Hacker Tools Mac
  10. Hacking Tools Usb
  11. Hacking Tools For Windows Free Download
  12. Hacks And Tools
  13. Bluetooth Hacking Tools Kali
  14. Tools 4 Hack
  15. Hack Tools For Games
  16. Pentest Tools Windows
  17. Physical Pentest Tools
  18. Hacking Tools For Pc
  19. Hack Tools For Ubuntu
  20. Pentest Tools Subdomain
  21. Hack Tools
  22. Pentest Tools Android
  23. Game Hacking
  24. Pentest Reporting Tools
  25. Hacking Tools Pc
  26. Hacking Tools For Pc
  27. Pentest Tools Subdomain
  28. Hacking Tools 2019
  29. Hacker Tools Linux
  30. Bluetooth Hacking Tools Kali
  31. Physical Pentest Tools
  32. Hacking Tools Mac
  33. Best Hacking Tools 2019
  34. Hacker Tools 2020
  35. Hacker Tools
  36. Hack Rom Tools
  37. What Are Hacking Tools
  38. Tools Used For Hacking
  39. Hacker Tools Github
  40. Hacking Tools And Software
  41. Hacker Tools Windows
  42. Hack Tools 2019
  43. Growth Hacker Tools
  44. What Are Hacking Tools
  45. Hack Tools Pc
  46. Hack Tool Apk No Root
  47. Hacker Tools Apk Download
  48. Hacker Tools For Pc
  49. Hacking Tools 2020
  50. Hacking Tools Github
  51. Hack App
  52. Pentest Tools Download
  53. Hacking Tools For Beginners
  54. Hacking Tools Usb
  55. Hacker Tools Free Download
  56. Hack Tools Download
  57. Hacking Tools Free Download
  58. Hacker Tool Kit
  59. Hack Tools 2019
  60. Hacker Tools For Windows
  61. Computer Hacker
  62. Hacker
  63. Hacker Tools Free
  64. Hack Tool Apk No Root
  65. Hack App
  66. Tools 4 Hack
  67. Hacker Tools Linux
  68. Hacker Tools For Ios
  69. Hacker Tools 2020
  70. Hacker Security Tools
  71. Hacking Apps
  72. Hacking Tools For Games
  73. Bluetooth Hacking Tools Kali
  74. Android Hack Tools Github
  75. Hacker Techniques Tools And Incident Handling
  76. Nsa Hack Tools Download
  77. Pentest Tools Port Scanner
  78. Hacker Tools Mac
  79. Pentest Tools Website Vulnerability
  80. Hacking Apps
  81. Android Hack Tools Github
  82. Easy Hack Tools
  83. Bluetooth Hacking Tools Kali
  84. Hacker Techniques Tools And Incident Handling
  85. Hackers Toolbox
  86. Hacker Security Tools
  87. Hacking Tools For Pc
  88. Hacking App
  89. Hack Tool Apk No Root
  90. Hacker Search Tools
  91. Pentest Tools Url Fuzzer
  92. Hacking Tools Usb
  93. Hacking Tools 2019
  94. Hacking Tools Mac
  95. Hack Tools
  96. Hacking App
  97. Hacker Tools For Windows
  98. Hack Tools For Games
  99. Hacker Tools Software
  100. Best Hacking Tools 2020
  101. Hack Tools Download
  102. Pentest Tools Windows
  103. Hackrf Tools
  104. Hack Tools For Ubuntu
  105. Pentest Tools Subdomain
  106. Pentest Tools Windows
  107. Hacking Tools For Pc
  108. Hacker Tools List
  109. Free Pentest Tools For Windows
  110. Pentest Tools Find Subdomains
  111. Hackers Toolbox
  112. Pentest Reporting Tools
  113. Pentest Tools Kali Linux
  114. Pentest Tools Windows
  115. Hack Tools 2019
  116. Pentest Tools Port Scanner
  117. Hacking Tools For Beginners
  118. Bluetooth Hacking Tools Kali
  119. Hacker Tools
  120. Computer Hacker
  121. What Are Hacking Tools
  122. Beginner Hacker Tools
  123. Pentest Box Tools Download
  124. Pentest Reporting Tools
  125. Hack Rom Tools
  126. Hacker Tools Hardware
  127. Pentest Tools Port Scanner
  128. Hacker Tools 2020
  129. Hack Tool Apk No Root
  130. Tools Used For Hacking
  131. Pentest Automation Tools
  132. Hacking Tools Name
  133. Hack Tools Download
  134. Hacking Tools Windows
  135. Underground Hacker Sites
  136. Hacking Tools Download
  137. Kik Hack Tools
  138. Easy Hack Tools
  139. Hackers Toolbox
  140. Hack Tools Download
  141. Pentest Tools Alternative
  142. Hackrf Tools
  143. Hacking Tools For Beginners
  144. Hacking Tools Windows
  145. Hack And Tools
  146. Install Pentest Tools Ubuntu
  147. Hacking Apps
  148. Hacking Tools Download
  149. Pentest Tools Framework
  150. Pentest Tools Nmap
  151. Hackers Toolbox
  152. Hacking Tools Github
  153. Hack Rom Tools
  154. Beginner Hacker Tools
  155. Hacking Tools Windows 10
  156. Hacking Tools
  157. Nsa Hack Tools
  158. Hacking Tools For Windows
  159. Pentest Tools Github
  160. Hacker Tools 2020
  161. Pentest Tools For Mac
  162. Pentest Tools Review
  163. Pentest Tools Website Vulnerability
  164. Hacking Tools For Mac
  165. Kik Hack Tools
  166. Ethical Hacker Tools
  167. Hacking Tools Online
  168. Hacker Tools Free
  169. Pentest Tools Android
  170. Hack Tools Pc
  171. Pentest Tools Bluekeep
  172. Underground Hacker Sites
  173. Pentest Tools Website

0 comments:

Post a Comment