Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

⛏️ Write a test to check whether we can create/update an object with invalid SSN #631

Open
5 tasks
ankush-jain-akto opened this issue Oct 9, 2023 · 15 comments
Open
5 tasks

⛏️ Write a test to check whether we can create/update an object with invalid SSN #631

ankush-jain-akto opened this issue Oct 9, 2023 · 15 comments
Assignees
@sivangbagri @saitejavarma-7
Labels
hacktoberfest yaml requires yaml knowledge

Comments

@ankush-jain-akto
Copy link
Contributor

ankush-jain-akto commented Oct 9, 2023 •
edited

💭 Introduction:
We want to test to check whether an attacker can create/update entity with an invalid SSN.

🎯 Requirements:

  1. Filters - API with UPI ID as an input in GET query parameter or JSON body parameter

  2. Execute - It should replace the value with

  • special characters
  • A very long string (> 255 characters)
  • Use whitespaces
  • Invalid SSN
  • A negative integer
  • A very long integer causing integer overflow
  • Zero
  • NULL
  1. Validation - If the application responds with a exception trace, it is a vulnerability.

✅ Task summary:

  • Ask to be assigned to the issue.
  • Wait to be assigned. We will try to assign in less than 2 hours.
  • Signup for Akto
  • Fork the tests-library repository, create a new branch and commit the yaml file which will be called in your test.
  • Submit both the PR here.

📚 Reading
You can find a detailed documentation of test editor rules here
Find 100+ examples of YAML tests here

🙋🏼‍♂️ Questions:
If you have questions, need any help, or just want to hang out, make sure to join us on our Discord server.
@Ankita28g Ankita28g added hacktoberfest yaml requires yaml knowledge labels Oct 10, 2023
@sivangbagri
Copy link

Hii Please assign me this issue

@mahimarohila
Copy link

hello can you assign me this issue

@sivangbagri
Copy link

I have made the PR
akto-api-security/tests-library#24

@avneesh-akto
Copy link
Contributor

@sivangbagri your test template is invalid. Please run your template on an API and see if it works before making a PR.

@sivangbagri
Copy link

@avneesh-akto Hii I have made the necessary changes kindly check akto-api-security/tests-library@669f2f0

@saitejavarma-7
Copy link

Hi please assign me with this issue.

@avneesh-akto
Copy link
Contributor

@sivangbagri your template still seems invalid. Request header is nested inside query params in api_selection_filter. Also you should detect and modify in request payload too. Please run the template on sample API before submitting any PR else you will get banned.

@avneesh-akto
Copy link
Contributor

@saitejavarma-7 I have assigned it to you too. Happy hacking

@sivangbagri
Copy link

@avneesh-akto akto-api-security/tests-library@4c883b9

@avneesh-akto
Copy link
Contributor

Hey.. still invalid. Your logic requires SSN or UPI id to be present in query, headers AND body param. Instead it should be a OR. Please refer CSRF test by removing csrf token test for more info

@avneesh-akto
Copy link
Contributor

What is the logic for response_code: gte: 400 ? Shouldn't you check if it returns 2xx

@sivangbagri
Copy link

sivangbagri commented Oct 31, 2023 •
edited

akto-api-security/tests-library#24 @ankush-jain-akto @avneesh-akto

@ankush-jain-akto
Copy link
Contributor Author

ankush-jain-akto commented Nov 1, 2023 •
edited

Hi @sivangbagri can you please rebase to develop. This looks good.

ayushaga14 pushed a commit that referenced this issue Jan 3, 2024
@ankush-jain-akto
Merge pull request #631 from akto-api-security/feature/add_analyser_logs
a8e0523 
added logs to analyser
@RaagaAkto
Copy link

Hi @sivangbagri, please fill out this form here so we can send you Akto swags. Will let you know ETA of swags soon, thanks for your contribution! 🚀

@RaagaAkto
Copy link

Hi @sivangbagri, we've received your details, swags should reach you in a month!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sivangbagri sivangbagri

@saitejavarma-7 saitejavarma-7

Labels
hacktoberfest yaml requires yaml knowledge
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@sivangbagri @saitejavarma-7 @ankush-jain-akto @Ankita28g @avneesh-akto @mahimarohila @RaagaAkto