|
1 | 1 | { |
2 | 2 | "metadata": { |
3 | 3 | "title": "API Testing", |
4 | | - "release_date": "2023-03-31T00:00:00+00:00", |
| 4 | + "release_date": "2025-04-29T00:00:00+00:00", |
5 | 5 | "description": "Bugcrowd api methodology testing", |
6 | 6 | "vrt_version": "10.0.1" |
7 | 7 | }, |
|
20 | 20 | "caption": "" |
21 | 21 | }, |
22 | 22 | { |
23 | | - "key": "check_wsdl_files", |
24 | | - "title": "Check for .wsdl files", |
25 | | - "description": "Check for web service description language (.wsdl) files for SOAP APIs.", |
| 23 | + "key": "check_API_schema_files", |
| 24 | + "title": "Check for .wsdl, .wadl, and swagger files", |
| 25 | + "description": "Check for web service description language (.wsdl/.wadl) and swagger files for SOAP/REST APIs.", |
26 | 26 | "tools": "Burp Proxy, FFUF, WFuzz, Gobuster", |
27 | 27 | "caption": "" |
28 | 28 | }, |
29 | 29 | { |
30 | 30 | "key": "check_graphql_introspection", |
31 | 31 | "title": "Check for GraphQL Introspection", |
32 | 32 | "description": "Check for enabled Introspection using GraphQL query.", |
33 | | - "tools": "Burp Proxy + GraphQL Raider (BAPP)", |
| 33 | + "tools": "Burp Proxy + GraphQL Raider (BAPP), InQL (BurpSuite extension)", |
| 34 | + "caption": "" |
| 35 | + }, |
| 36 | + { |
| 37 | + "key": "check_graphql_field_Suggestions", |
| 38 | + "title": "Check for GraphQL Field Suggestions", |
| 39 | + "description": "Check for GraphQL Field Suggestions if Introspection Disabled.", |
| 40 | + "tools": "Clairvoyance", |
34 | 41 | "caption": "" |
35 | 42 | }, |
36 | 43 | { |
37 | 44 | "key": "search_leaked_api_keys", |
38 | 45 | "title": "Search for leaked API Keys", |
39 | 46 | "description": "Black box only - Search for leaked online API keys on Github, Gitlab etc.", |
40 | | - "tools": "TruffleHog", |
| 47 | + "tools": "TruffleHog, Gitleaks", |
41 | 48 | "caption": "" |
42 | 49 | }, |
43 | 50 | { |
|
52 | 59 | "key": "webserver_metafiles", |
53 | 60 | "title": "Review Webserver Metafiles for Information Leakage", |
54 | 61 | "caption": "OTG-INFO-003, WAHHM - Recon and Analysis", |
55 | | - "description": "Analyze robots.txt and identify <META> Tags from website.", |
| 62 | + "description": "Analyze robots.txt, .env, .git, metrics and identify <META> Tags from website.", |
56 | 63 | "tools": "Browser, curl, wget" |
57 | 64 | }, |
58 | 65 | { |
|
238 | 245 | "caption": "OTG-AUTHN-010, WAHHM - Test Handling of Access", |
239 | 246 | "description": "Understand the primary mechanism and Identify other channels (Mobile App, Call center, SSO)", |
240 | 247 | "tools": "Browser" |
| 248 | + }, |
| 249 | + { |
| 250 | + "key": "jwt_misconfigurations", |
| 251 | + "title": "Testing for misconfigured JWT (Json Web Token)", |
| 252 | + "caption": "OWASP API Security Top 10 - 2023", |
| 253 | + "description": "Identify JWT flaws like allowing the None algorithm, algorithm confusion, weak secret keys, missing signature validation, etc.", |
| 254 | + "tools": "jwt_tool" |
241 | 255 | } |
242 | 256 | ] |
243 | 257 | }, |
|
279 | 293 | "tools": "Burp Proxy, curl, swagger-ui, mitmproxy, Hackverter", |
280 | 294 | "vrt_category": "broken_access_control" |
281 | 295 | }, |
282 | | - { |
283 | | - "key": "directory_traversal_and_file_include", |
284 | | - "title": "Testing Directory traversal/file include", |
285 | | - "caption": "OTG-AUTHZ-001, WAHHM - Test Handling of Input", |
286 | | - "description": "dot-dot-slash attack (../), Directory traversal, Local File inclusion/Remote File Inclusion.", |
287 | | - "tools": "Burp Proxy, ZAP, Wfuzz", |
288 | | - "vrt_category": "server_side_injection" |
289 | | - }, |
290 | 296 | { |
291 | 297 | "key": "privilege_escalation", |
292 | 298 | "title": "Testing for Privilege Escalation", |
|
438 | 444 | "key": "nosql_injection", |
439 | 445 | "title": "Testing for NoSQL injection", |
440 | 446 | "caption": "", |
441 | | - "description": "dentify NoSQL databases, Pass special characters (' \" \\ ; { } ), Attack with reserved variable name, operator.", |
| 447 | + "description": "Identify NoSQL databases, Pass special characters (' \" \\ ; { } ), and attack with reserved variable names and operators.", |
442 | 448 | "tools": "NoSQLMap" |
443 | 449 | }, |
444 | 450 | { |
|
511 | 517 | "description": "Understand the application platform, OS, folder structure, relative path and execute OS commands on a Web server.\n%3Bcat%20/etc/passwd\ntest.pdf+|+Dir C:\\ ", |
512 | 518 | "tools": "Burp Proxy, ZAP, Commix", |
513 | 519 | "vrt_category": "server_side_injection" |
| 520 | + }, |
| 521 | + { |
| 522 | + "key": "SSRF", |
| 523 | + "title": "Testing for Server-Side Request Forgery", |
| 524 | + "caption": "OWASP API Security Top 10 - 2023", |
| 525 | + "description": "Test whether the API allows sending arbitrary or internal requests to unauthorized systems.\nUse crafted URLs to target internal IP ranges, cloud metadata endpoint (e.g., http://169.254.169.254/)", |
| 526 | + "tools": "Burp Collaborator, SSRFmap", |
| 527 | + "vrt_category": "server_security_misconfiguration" |
| 528 | + }, |
| 529 | + { |
| 530 | + "key": "graphql_misconfigurations", |
| 531 | + "title": "Testing for GraphQL Misconfigurations", |
| 532 | + "caption": "WSTG - v4.2", |
| 533 | + "description": "Test GraphQL endpoint for batched abuse and alias overloading, and recursion depth limits, etc.", |
| 534 | + "tools": "GraphQL Raider, BurpSuite", |
| 535 | + "vrt_category": "server_security_misconfiguration" |
| 536 | + }, |
| 537 | + { |
| 538 | + "key": "directory_traversal_and_file_include", |
| 539 | + "title": "Testing Directory traversal/file include", |
| 540 | + "caption": "OTG-AUTHZ-001, WAHHM - Test Handling of Input", |
| 541 | + "description": "dot-dot-slash attack (../), Directory traversal, Local File inclusion/Remote File Inclusion.", |
| 542 | + "tools": "Burp Proxy, ZAP, Wfuzz", |
| 543 | + "vrt_category": "server_side_injection" |
514 | 544 | } |
515 | 545 | ] |
516 | 546 | }, |
|
572 | 602 | "key": "data_validation", |
573 | 603 | "title": "Test Business Logic Data Validation", |
574 | 604 | "caption": "OTG-BUSLOGIC-001, WAHHM - Test for Logic Flaws", |
575 | | - "description": "Looking for data entry points or hand off points between systems or software.\nOnce found try to insert logically invalid data into the application/system.", |
| 605 | + "description": "Identify data entry points or hand off points between systems or software.\nOnce identified, insert logically invalid data into the application/system.", |
576 | 606 | "tools": "Burp Proxy, ZAP", |
577 | 607 | "vrt_category": "broken_access_control" |
578 | 608 | }, |
579 | 609 | { |
580 | 610 | "key": "forge_requests", |
581 | 611 | "title": "Test Ability to Forge Requests", |
582 | 612 | "caption": "OTG-BUSLOGIC-002, WAHHM - Test for Logic Flaws", |
583 | | - "description": "Looking for guessable, predictable or hidden functionality of fields.\nOnce found, try to insert logically valid data into the application/system allowing the user to go through the application/system against the normal business logic workflow.", |
| 613 | + "description": "Identify guessable, predictable or hidden functionality of fields.\nOnce found, try to insert logically valid data into the application/system allowing the user to go through the application/system against the normal business logic workflow.", |
584 | 614 | "tools": "Burp Proxy, ZAP", |
585 | 615 | "vrt_category": "server_side_injection" |
586 | 616 | }, |
587 | 617 | { |
588 | 618 | "key": "integrity_check", |
589 | 619 | "title": "Test Integrity Checks", |
590 | 620 | "caption": "OTG-BUSLOGIC-003, WAHHM - Test for Logic Flaws", |
591 | | - "description": "Looking for parts of the application/system (components i.e. For example, input fields, databases or logs) that move, store or handle data/information.\nFor each identified component determine what type of data/information is logically acceptable and what types the application/system should guard against. Also, consider who according to the business logic is allowed to insert, update and delete data/information and in each component.\nAttempt to insert, update or edit delete the data/information values with invalid data/information into each component (i.e. input, database, or log) by users that .should not be allowed per the business logic workflow.", |
| 621 | + "description": "Identify parts of the application/system (components, for example, input fields, databases or logs) that move, store or handle data/information.\nFor each identified component determine what type of data/information is logically acceptable and what types the application/system should guard against. Also, consider who according to the business logic is allowed to insert, update and delete data/information and in each component.\nAttempt to insert, update or delete the data/information values with invalid data/information into each component (i.e. input, database, or log) by users that should not be allowed per the business logic workflow.", |
592 | 622 | "tools": "Burp Proxy, ZAP", |
593 | 623 | "vrt_category": "broken_access_control" |
594 | 624 | }, |
595 | 625 | { |
596 | 626 | "key": "process_timing", |
597 | 627 | "title": "Test for Process Timing", |
598 | 628 | "caption": "OTG-BUSLOGIC-004, WAHHM - Test for Logic Flaws", |
599 | | - "description": "Looking for application/system functionality that may be impacted by time. Such as execution time or actions that help users predict a future outcome or allow one to circumvent any part of the business logic or workflow. For example, not completing transactions in an expected time.\nDevelop and execute the mis-use cases ensuring that attackers cannot gain an advantage based on any timing.", |
| 629 | + "description": "Identify application/system functionality that may be impacted by time. Such as execution time or actions that help users predict a future outcome or allow one to circumvent any part of the business logic or workflow. For example, not completing transactions in an expected time.\nDevelop and execute the mis-use cases ensuring that attackers cannot gain an advantage based on any timing.", |
600 | 630 | "tools": "Burp Proxy, ZAP", |
601 | 631 | "vrt_category": "server_side_injection" |
602 | 632 | }, |
603 | 633 | { |
604 | 634 | "key": "usage_limits", |
605 | 635 | "title": "Test Number of Times a Function Can be Used Limits", |
606 | 636 | "caption": "OTG-BUSLOGIC-005, WAHHM - Test for Logic Flaws", |
607 | | - "description": "Looking for functions or features in the application or system that should not be executed more than a single time or specified number of times during the business logic workflow.\nFor each of the functions and features found that should only be executed a single time or specified number of times during the business logic workflow, develop abuse/misuse cases that may allow a user to execute more than the allowable number of times.", |
| 637 | + "description": "Identify functions or features in the application or system that should not be executed more than a single time or specified number of times during the business logic workflow.\nFor each of the functions and features found that should only be executed a single time or specified number of times during the business logic workflow, develop abuse/misuse cases that may allow a user to execute more than the allowable number of times.", |
608 | 638 | "tools": "Burp Proxy, ZAP", |
609 | 639 | "vrt_category": "broken_access_control" |
610 | 640 | }, |
611 | 641 | { |
612 | 642 | "key": "workflow_circumvention", |
613 | 643 | "title": "Testing for the Circumvention of Work Flows", |
614 | 644 | "caption": "OTG-BUSLOGIC-006, WAHHM - Test for Logic Flaws", |
615 | | - "description": "Looking for methods to skip or go to steps in the application process in a different order from the designed/intended business logic flow.\nFor each method develop a misuse case and try to circumvent or perform an action that is 'not acceptable' per the business logic workflow.", |
| 645 | + "description": "Identify methods to skip or go to steps in the application process in a different order from the designed/intended business logic flow.\nFor each method develop a misuse case and try to circumvent or perform an action that is 'not acceptable' per the business logic workflow.", |
616 | 646 | "tools": "Burp Proxy, ZAP", |
617 | 647 | "vrt_category": "broken_access_control" |
618 | 648 | }, |
|
655 | 685 | ] |
656 | 686 | } |
657 | 687 | } |
658 | | - |
659 | | - |
|
0 commit comments