59 |
67 |
68 | );
69 | }
70 | }
71 |
72 | export default changePasswordForm;
--------------------------------------------------------------------------------
/client/src/components/common/adminProtectedRoute.jsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import { Route, Redirect } from 'react-router-dom';
3 | import auth from '../../services/authService';
4 |
5 | const AdminProtectedRoute = ({path, component:Component, render, ...rest }) => {
6 | return (
7 | 9 |
6 |
7 |
8 | {error &&
10 | );
11 | };
12 |
13 | export default Input;
14 |
--------------------------------------------------------------------------------
/client/src/components/common/pagination.jsx:
--------------------------------------------------------------------------------
1 | import React from "react";
2 | import PropTypes from "prop-types";
3 | import _ from "lodash";
4 |
5 | const Pagination = ({ itemsCount, pageSize, currentPage, onPageChange }) => {
6 | const pagesCount = Math.ceil(itemsCount / pageSize);
7 | if (pagesCount === 1) return null;
8 | const pages = _.range(1, pagesCount + 1);
9 |
10 | return (
11 |
25 | );
26 | };
27 |
28 | Pagination.propTypes = {
29 | itemsCount: PropTypes.number.isRequired,
30 | pageSize: PropTypes.number.isRequired,
31 | currentPage: PropTypes.number.isRequired,
32 | onPageChange: PropTypes.func.isRequired
33 | };
34 |
35 | export default Pagination;
36 |
--------------------------------------------------------------------------------
/client/src/components/common/protectedRoute.jsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import { Route, Redirect } from 'react-router-dom';
3 | import auth from '../../services/authService';
4 |
5 | const ProtectedRoute = ({path, component:Component, render, ...rest }) => {
6 | return (
7 | {error}
}
9 |
6 |
7 |
15 | {error &&
17 | );
18 | };
19 |
20 | export default Select;
21 |
--------------------------------------------------------------------------------
/client/src/components/common/table.jsx:
--------------------------------------------------------------------------------
1 | import React from "react";
2 | import TableHeader from "./tableHeader";
3 | import TableBody from "./tableBody";
4 |
5 | const Table = ({ columns, sortColumn, onSort, data }) => {
6 | return (
7 | {error}
}
16 |
56 |
67 |
68 | );
69 | }
70 | }
71 |
72 | export default EditAuthor;
--------------------------------------------------------------------------------
/client/src/components/editBook.jsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import Joi from 'joi-browser';
3 | import NotificationSystem from 'react-notification-system';
4 | import Form from './common/form';
5 | import { getCategories } from '../services/categoryService';
6 | import { updateBook } from '../services/bookService';
7 | import {getAuthors} from '../services/authorService';
8 |
9 | class EditBook extends Form {
10 | notificationSystem = React.createRef();
11 | state = {
12 | data: { title: "", author: "", category: "", publishedDate: "" },
13 | errors: {},
14 | authors: [],
15 | categories: []
16 | };
17 |
18 | async componentDidMount() {
19 | const {data: categories} = await getCategories();
20 | const {data: authors} = await getAuthors();
21 | this.setState({categories, authors});
22 | }
23 |
24 | schema = {
25 | title: Joi.string()
26 | .required()
27 | .min(4)
28 | .label("Title"),
29 | category: Joi.string()
30 | .required(),
31 | author: Joi.string()
32 | .required()
33 | .min(4)
34 | .label("Author"),
35 | publishedDate: Joi.string()
36 | .required()
37 | .label("Date")
38 | };
39 |
40 | doSubmit = async () => {
41 | const bookId = this.props.match.params.bookId;
42 | const {data: book} = this.state;
43 | const notification = this.notificationSystem.current;
44 | try{
45 | await updateBook(bookId, book);
46 | notification.addNotification({
47 | message: 'Updated Successfully!',
48 | level: 'success'
49 | });
50 | }catch(ex){
51 | if(ex.response && ex.response.status === 400){
52 | notification.addNotification({
53 | message: ex.response.data,
54 | level: 'error'
55 | });
56 | }
57 | }
58 | };
59 |
60 | render() {
61 | return (
62 |
63 |
74 |
75 | );
76 | }
77 | }
78 |
79 | export default EditBook;
--------------------------------------------------------------------------------
/client/src/components/editProfile.jsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import Joi from 'joi-browser';
3 | import NotificationSystem from 'react-notification-system';
4 | import Form from './common/form';
5 | import { updateUser } from '../services/userService';
6 |
7 |
8 | class EditProfile extends Form {
9 | notificationSystem = React.createRef();
10 | state = {
11 | data: { name: "", email: "", url: "", currentPass: "", newPass: "" },
12 | errors: {}
13 | };
14 |
15 |
16 | schema = {
17 | name: Joi.string()
18 | .required()
19 | .label("Name"),
20 | email: Joi.string()
21 | .required()
22 | .email()
23 | .label("Email"),
24 | url: Joi.string().uri(),
25 | currentPass: Joi.string()
26 | .required()
27 | .min(5)
28 | .label("Current Password"),
29 | newPass: Joi.string()
30 | .required()
31 | .min(5)
32 | .label("New Password")
33 | };
34 |
35 | doSubmit = async () => {
36 | const notification = this.notificationSystem.current;
37 | try{
38 | const {data: user} = this.state;
39 | console.log(user);
40 | await updateUser(user);
41 | notification.addNotification({
42 | message: 'Updated Successfully',
43 | level: 'success'
44 | });
45 | }catch(ex){
46 | if(ex.response && ex.response.status === 400){
47 | notification.addNotification({
48 | message: ex.response.data,
49 | level: 'error'
50 | });
51 | }
52 | }
53 | };
54 |
55 | render() {
56 | return (
57 |
58 |
71 | );
72 | }
73 | }
74 |
75 | export default EditProfile;
--------------------------------------------------------------------------------
/client/src/components/loginForm.jsx:
--------------------------------------------------------------------------------
1 | import React from "react";
2 | import {Redirect} from "react-router-dom";
3 | import Joi from "joi-browser";
4 | import NotificationSystem from 'react-notification-system';
5 | import Form from "./common/form";
6 | import auth from "../services/authService";
7 | import {Link } from "react-router-dom";
8 |
9 | class LoginForm extends Form {
10 | notificationSystem = React.createRef();
11 | state = {
12 | data: { username: "", password: "" },
13 | errors: {}
14 | };
15 |
16 | schema = {
17 | username: Joi.string()
18 | .required()
19 | .label("Username"),
20 | password: Joi.string()
21 | .required()
22 | .label("Password")
23 | };
24 |
25 | doSubmit = async () => {
26 | const notification = this.notificationSystem.current;
27 | try{
28 |
29 | const {data} = this.state;
30 | const {state} = this.props.location;
31 | await auth.login(data.username, data.password);
32 |
33 | notification.addNotification({
34 | message: 'Logged-in Successfully',
35 | level: 'success'
36 | });
37 |
38 | window.setTimeout(()=>{
39 | window.location = state ? state.from.pathname : '/';
40 | },2000)
41 |
42 | }catch(ex){
43 | if(ex.response && ex.response.status === 400){
44 | notification.addNotification({
45 | message: 'Invalid Username or Password',
46 | level: 'error'
47 | });
48 | }
49 | }
50 | };
51 |
52 | render() {
53 | if(auth.getUser()) return
59 |
69 |
70 |
56 |
70 |
71 | );
72 | }
73 | }
74 |
75 | export default LoginForm;
76 |
--------------------------------------------------------------------------------
/client/src/components/logoutForm.jsx:
--------------------------------------------------------------------------------
1 | import React, { Component } from 'react';
2 | import auth from '../services/authService';
3 |
4 | class LogoutForm extends Component {
5 |
6 | componentDidMount() {
7 | auth.logout();
8 | window.location = '/';
9 | }
10 |
11 | render() {
12 | return null;
13 | }
14 | }
15 |
16 | export default LogoutForm;
--------------------------------------------------------------------------------
/client/src/components/navBar.jsx:
--------------------------------------------------------------------------------
1 | import React from "react";
2 | import _ from 'lodash';
3 | import { Link, NavLink } from "react-router-dom";
4 | import brand from '../public/owasp-brand.png';
5 | import auth from '../services/authService';
6 |
7 | const NavBar = ({user}) => {
8 | const role = auth.getUser() && auth.getUser().role;
9 |
10 | return (
11 |
67 | );
68 | };
69 |
70 | export default NavBar;
71 |
--------------------------------------------------------------------------------
/client/src/components/newAuthor.jsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import Joi from 'joi-browser';
3 | import NotificationSystem from 'react-notification-system';
4 | import Form from './common/form';
5 | import { addAuthor } from '../services/authorService';
6 |
7 | class NewAuthor extends Form {
8 | notificationSystem = React.createRef();
9 |
10 | state = {
11 | data: { name: "", email: "", job: "", about: "" },
12 | errors: {}
13 | };
14 |
15 | schema = {
16 | name: Joi.string()
17 | .required()
18 | .min(4),
19 | email: Joi.string()
20 | .required(),
21 | job: Joi.string()
22 | .required()
23 | .min(4)
24 | .label("Job"),
25 | about: Joi.string()
26 | .required()
27 | .label("About")
28 | .min(5)
29 | };
30 |
31 | doSubmit = async () => {
32 | const notification = this.notificationSystem.current;
33 | try{
34 |
35 | const {data: author} = this.state;
36 | await addAuthor(author);
37 | notification.addNotification({
38 | message: 'Added Successfully!',
39 | level: 'success'
40 | });
41 |
42 | }catch(ex){
43 | if(ex.response && ex.response.status === 400){
44 | notification.addNotification({
45 | message: ex.response.data,
46 | level: 'error'
47 | });
48 | }
49 | }
50 | };
51 |
52 | render() {
53 | return (
54 |
55 |
66 |
67 | );
68 | }
69 | }
70 |
71 | export default NewAuthor;
--------------------------------------------------------------------------------
/client/src/components/notFound.jsx:
--------------------------------------------------------------------------------
1 | import React from "react";
2 | import logo from '../public/404.png';
3 |
4 | const NotFound = () => {
5 | return (
6 |
7 | 
8 |
9 | );
10 | };
11 |
12 | export default NotFound;
13 |
--------------------------------------------------------------------------------
/client/src/components/profile.jsx:
--------------------------------------------------------------------------------
1 | import React, {Component} from 'react';
2 | import _ from 'lodash';
3 | import { getUser } from '../services/userService';
4 | import { Link, NavLink } from 'react-router-dom';
5 |
6 | class Profile extends Component {
7 | state = {
8 | userName: '',
9 | userInfo: []
10 |
11 | }
12 |
13 |
14 | async componentDidMount() {
15 | const userName = this.props.match.params.userName;
16 | const {data} = await getUser(userName);
17 | if (!data) return this.props.history.replace("/not-found");
18 | this.setState({userInfo: data, userName });
19 | }
20 |
21 |
22 | render() {
23 | const {userInfo} = this.state;
24 | return (
25 |
27 |
64 |
28 |
63 |
29 |
62 |
30 |
61 | User Profile
31 |-
32 |
- 33 | Username: {userInfo.username} 34 | 35 |
- 36 | Email: {userInfo.email} 37 | 38 |
- 39 | 40 | 41 |
- 42 | Credits: {userInfo.credit} 43 | 44 | {userInfo.website && ( 45 |
- 46 | Website: {userInfo.website} 47 | 48 | )} 49 | 50 |
- 51 | Referral Link: {`/signup?ref=${userInfo._id}`} 52 | 53 |
-
54 |
Edit 55 |
56 | {userInfo.credit == 10 && (
57 |
You have {userInfo.credit} credits! Send an email to vulrestapi@company.com for free book!
58 | )} 59 |
45 |
53 |
54 | );
55 | }
56 | }
57 |
58 | export default ResetPasswordForm;
--------------------------------------------------------------------------------
/client/src/components/searchBox.jsx:
--------------------------------------------------------------------------------
1 | import React from "react";
2 |
3 |
4 | const SearchBox = ({ value, onChange }) => {
5 | return (
6 |
7 | onChange(e.currentTarget.value)}
14 | />
15 |
16 | );
17 | };
18 |
19 | export default SearchBox;
20 |
--------------------------------------------------------------------------------
/client/src/components/signUpForm.jsx:
--------------------------------------------------------------------------------
1 | import React from "react";
2 | import Joi from "joi-browser";
3 | import { Redirect } from 'react-router-dom';
4 | import NotificationSystem from 'react-notification-system';
5 | import Form from "./common/form";
6 | import { register } from "../services/userService";
7 | import auth from "../services/authService";
8 | import "../App.css";
9 |
10 | class RegisterForm extends Form {
11 | notificationSystem = React.createRef();
12 | state = {
13 | data: { email: "", password: "", name: "", username: ""},
14 | errors: {}
15 | };
16 |
17 | schema = {
18 | email: Joi.string()
19 | .required()
20 | .email()
21 | .label("Email"),
22 | password: Joi.string()
23 | .required()
24 | .min(5)
25 | .label("Password"),
26 | name: Joi.string()
27 | .required()
28 | .label("Name"),
29 | username: Joi.string()
30 | .required()
31 | .min(5)
32 | .label("Username")
33 | };
34 |
35 | cdm
36 |
37 | doSubmit = async () => {
38 | const notification = this.notificationSystem.current;
39 | const query = this.props.location.search;
40 | const params = new URLSearchParams(query);
41 | try{
42 | await register(this.state.data, params.get('ref'));
43 | notification.addNotification({
44 | message: 'Registered Successfully!',
45 | level: 'success'
46 | });
47 |
48 | window.setTimeout(()=>{
49 | window.location = '/login';
50 | },2000)
51 |
52 | }catch(ex){
53 | if(ex.response && ex.response.status === 400){
54 | notification.addNotification({
55 | message: ex.response.data,
56 | level: 'error'
57 | });
58 | }
59 | }
60 | };
61 |
62 | render() {
63 | if(auth.getUser()) return
66 |
76 |
78 | );
79 | }
80 | }
81 |
82 | export default RegisterForm;
83 |
--------------------------------------------------------------------------------
/client/src/components/users.jsx:
--------------------------------------------------------------------------------
1 | import React, { Component } from 'react';
2 | import _ from 'lodash';
3 | import NotificationSystem from 'react-notification-system';
4 | import Pagination from "./common/pagination";
5 | import { paginate } from "../utils/paginate";
6 | import Table from "./common/table";
7 | import {getUsers, deleteUser} from '../services/userService';
8 | import auth from '../services/authService';
9 |
10 | class Users extends Component {
11 | notificationSystem = React.createRef();
12 |
13 | columns = [
14 | {
15 | path: "name",
16 | label: "Name"
17 | },
18 | {
19 | path: "email",
20 | label: "Email"
21 | },
22 | {
23 | path: "username",
24 | label: "Username"
25 | },
26 | {
27 | path: "role",
28 | label: "Role"
29 | },
30 | {
31 | key: "delete",
32 | content: user => (
33 |
39 | )
40 | }
41 | ]
42 |
43 | state = {
44 | users : [],
45 | currentPage: 1,
46 | pageSize: 7,
47 | sortColumn: { path: "name", order: "asc" }
48 | }
49 |
50 | handleDelete = async user => {
51 | const notification = this.notificationSystem.current;
52 | if(user.role == 'ADMIN'){
53 | notification.addNotification({
54 | message: 'Admin can not be deleted!',
55 | level: 'error'
56 | });
57 | return;
58 | }
59 | const users = this.state.users.filter(m => m._id !== user._id);
60 | this.setState({ users });
61 | try{
62 | await deleteUser(user._id);
63 | notification.addNotification({
64 | message: 'Deleted Successfully',
65 | level: 'success'
66 | });
67 | }catch(ex){
68 | if(ex.response && ex.response.status === 400){
69 | notification.addNotification({
70 | message: ex.response.data,
71 | level: 'error'
72 | });
73 | }
74 | };
75 | }
76 |
77 | handleSort = sortColumn => {
78 | this.setState({ sortColumn });
79 | };
80 |
81 | getSortedData = ()=>{
82 | const {sortColumn} = this.state;
83 | const sorted = _.orderBy(this.state.users, [sortColumn.path], [sortColumn.order]);
84 | return sorted;
85 | }
86 |
87 | async componentDidMount(){
88 | const {data} = await getUsers();
89 | this.setState({users: data});
90 | }
91 |
92 | handlePageChange = page => {
93 | this.setState({ currentPage: page });
94 | };
95 |
96 | getPagedData = () => {
97 | const {
98 | pageSize,
99 | currentPage,
100 | sortColumn,
101 | users: allUsers
102 | } = this.state;
103 |
104 | const sorted = _.orderBy(allUsers, [sortColumn.path], [sortColumn.order]);
105 |
106 | const users = paginate(sorted, currentPage, pageSize);
107 |
108 | return { data: users, totalCount: allUsers.length };
109 | };
110 |
111 |
112 | render() {
113 | const {data, totalCount} = this.getPagedData();
114 | const {pageSize, currentPage} = this.state;
115 | return (
116 |
117 |
124 |
132 | );
133 | }
134 | }
135 |
136 | export default Users;
--------------------------------------------------------------------------------
/client/src/config.json:
--------------------------------------------------------------------------------
1 | {
2 | "apiEndpoint": "http://localhost:3001/api",
3 | "thirdParty": "https://my-json-server.typicode.com/bnematzadeh/third-party-api/users"
4 | }
--------------------------------------------------------------------------------
/client/src/index.css:
--------------------------------------------------------------------------------
1 | body {
2 | margin: 0;
3 | padding: 0 0 0 0;
4 | font-family: sans-serif;
5 | background-image: url("public/back.jpg");
6 | background-repeat: no-repeat;
7 | background-attachment: fixed;
8 | background-size: cover;
9 | }
10 |
11 | .clickable {
12 | cursor: pointer;
13 | }
14 |
15 |
--------------------------------------------------------------------------------
/client/src/index.js:
--------------------------------------------------------------------------------
1 | import React from "react";
2 | import ReactDOM from "react-dom";
3 | import { BrowserRouter } from "react-router-dom";
4 | import "./index.css";
5 | import App from "./App";
6 | import registerServiceWorker from "./registerServiceWorker";
7 | import "bootstrap/dist/css/bootstrap.css";
8 | import "font-awesome/css/font-awesome.css";
9 |
10 | ReactDOM.render(
11 |
31 |
42 |
43 |
44 |
45 | `
46 | })
47 |
48 | winston.info(info.messageId);
49 | }
50 |
--------------------------------------------------------------------------------
/server/wait-for:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 |
3 | # The MIT License (MIT)
4 | #
5 | # Copyright (c) 2017 Eficode Oy
6 | #
7 | # Permission is hereby granted, free of charge, to any person obtaining a copy
8 | # of this software and associated documentation files (the "Software"), to deal
9 | # in the Software without restriction, including without limitation the rights
10 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 | # copies of the Software, and to permit persons to whom the Software is
12 | # furnished to do so, subject to the following conditions:
13 | #
14 | # The above copyright notice and this permission notice shall be included in all
15 | # copies or substantial portions of the Software.
16 | #
17 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23 | # SOFTWARE.
24 |
25 | set -- "$@" -- "$TIMEOUT" "$QUIET" "$HOST" "$PORT" "$result"
26 | TIMEOUT=15
27 | QUIET=0
28 |
29 | echoerr() {
30 | if [ "$QUIET" -ne 1 ]; then printf "%s\n" "$*" 1>&2; fi
31 | }
32 |
33 | usage() {
34 | exitcode="$1"
35 | cat << USAGE >&2
36 | Usage:
37 | $cmdname host:port [-t timeout] [-- command args]
38 | -q | --quiet Do not output any status messages
39 | -t TIMEOUT | --timeout=timeout Timeout in seconds, zero for no timeout
40 | -- COMMAND ARGS Execute command with args after the test finishes
41 | USAGE
42 | exit "$exitcode"
43 | }
44 |
45 | wait_for() {
46 | if ! command -v nc >/dev/null; then
47 | echoerr 'nc command is missing!'
48 | exit 1
49 | fi
50 |
51 | while :; do
52 | nc -z "$HOST" "$PORT" > /dev/null 2>&1
53 |
54 | result=$?
55 | if [ $result -eq 0 ] ; then
56 | if [ $# -gt 6 ] ; then
57 | for result in $(seq $(($# - 6))); do
58 | result=$1
59 | shift
60 | set -- "$@" "$result"
61 | done
62 |
63 | TIMEOUT=$2 QUIET=$3 HOST=$4 PORT=$5 result=$6
64 | shift 6
65 | exec "$@"
66 | fi
67 | exit 0
68 | fi
69 |
70 | if [ "$TIMEOUT" -le 0 ]; then
71 | break
72 | fi
73 | TIMEOUT=$((TIMEOUT - 1))
74 |
75 | sleep 1
76 | done
77 | echo "Operation timed out" >&2
78 | exit 1
79 | }
80 |
81 | while :; do
82 | case "$1" in
83 | *:* )
84 | HOST=$(printf "%s\n" "$1"| cut -d : -f 1)
85 | PORT=$(printf "%s\n" "$1"| cut -d : -f 2)
86 | shift 1
87 | ;;
88 | -q | --quiet)
89 | QUIET=1
90 | shift 1
91 | ;;
92 | -q-*)
93 | QUIET=0
94 | echoerr "Unknown option: $1"
95 | usage 1
96 | ;;
97 | -q*)
98 | QUIET=1
99 | result=$1
100 | shift 1
101 | set -- -"${result#-q}" "$@"
102 | ;;
103 | -t | --timeout)
104 | TIMEOUT="$2"
105 | shift 2
106 | ;;
107 | -t*)
108 | TIMEOUT="${1#-t}"
109 | shift 1
110 | ;;
111 | --timeout=*)
112 | TIMEOUT="${1#*=}"
113 | shift 1
114 | ;;
115 | --)
116 | shift
117 | break
118 | ;;
119 | --help)
120 | usage 0
121 | ;;
122 | -*)
123 | QUIET=0
124 | echoerr "Unknown option: $1"
125 | usage 1
126 | ;;
127 | *)
128 | QUIET=0
129 | echoerr "Unknown argument: $1"
130 | usage 1
131 | ;;
132 | esac
133 | done
134 |
135 | if ! [ "$TIMEOUT" -ge 0 ] 2>/dev/null; then
136 | echoerr "Error: invalid timeout '$TIMEOUT'"
137 | usage 3
138 | fi
139 |
140 | if [ "$HOST" = "" -o "$PORT" = "" ]; then
141 | echoerr "Error: you need to provide a host and port to test."
142 | usage 2
143 | fi
144 |
145 | wait_for "$@"
146 |
--------------------------------------------------------------------------------
/vulnerabilities/vulnerabilities.md:
--------------------------------------------------------------------------------
1 | # OWASP API Security Top 10 - 2023
2 |
3 | # Broken Object Property Level Authorization
4 |
5 | - Mass Assignment
6 | - Vulnerable Endpoints
7 | - POST /api/users
8 | - Excessive Data Exposure
9 | - Vulnerable Endpoints
10 | - GET /api/authors
11 | - GET /api/books
12 |
13 | # Broken Object Level Authorization
14 |
15 | - Vulnerable Endpoints
16 | - GET /api/users/:name
17 | - PUT /api/users/:id
18 | - Get the id from the following endpoints
19 | - POST /api/auth (Add invalid password for a valid username and check the API response)
20 | - POST /api/otp (Add username and check the API response)
21 |
22 | # Broken Function Level Authorization
23 |
24 | - Vulnerable Endpoints
25 | - POST /api/books
26 | - PUT /api/books/:bookId
27 | - DELETE /api/books/:bookId
28 | - POST /api/authors
29 | - PUT /api/authors/:authorId
30 | - DELETE /api/authors/:authorId
31 |
32 | # Server-Side Request Forgery
33 |
34 | - Vulnerable Endpoint
35 | - PUT /api/users/:id
36 |
37 | # Improper Inventory Management
38 |
39 | - localhost:3001/api/users: Access Forbidden
40 | - dev.localhost:3001/api/users: 200 Ok
41 |
42 | # Unsafe Consumption of APIs
43 |
44 | The API Does not properly validate and sanitize data gathered from other APIs. The API sends the following request to store email in a third-party API.
45 |
46 | - POST https://my-json-server.typicode.com/bnematzadeh/third-party-api/users
47 |
48 | - Navigate to /about. Add your XSS payload in email and subscribe. The subscribed email will be returned from the third-party API to the application.
49 |
50 | - localhost:3000/about?email={payload}
51 |
52 | # Broken Authentication
53 |
54 | - JWT Key Confusion
55 |
56 | - GET /api/system/key: public key
57 |
58 | - Weak Password
59 | - Admin Login: http://localhost:3000/admin/login
60 | - Vulnerable Endpoint: POST /api/adminAuth
61 | - Credentials:
62 | - Username: admin
63 | - Password: admin1234
64 | - Weak Implementation of Reset Password (Account Takeover)
65 | - POST /api/users/verify
66 |
67 | # Security Misconfiguration
68 |
69 | - The logging is enabled in this application. Send a request to the following endpoint to access the log file
70 | - Vulnerable Endpoint
71 | - GET /api/logs
72 |
73 | # Unrestricted Resource Consumption
74 |
75 | - ReDOS
76 | - Vulnerable Endpoint
77 | - GET /api/users/:name
78 |
79 | # Unrestricted Access to Sensitive Business Flows
80 |
81 | Users can invite their friends and gain credit for each friend who has joined the app. This credit can be later used as cash to get a free book. An attacker exploits this flow by writing a script to automate the registration process, with each new user adding credit to the attacker's account.
82 |
83 | - Automation Process
84 | GET /profile/{YourUsername}: Get ref link from your profile
85 | POST /api/users + ref link
86 |
87 | # Bonus
88 |
89 | # Injection
90 |
91 | - NOSQL injection
92 | - Vulnerable Endpoint
93 | - GET /api/me?id={payload}
94 | - XSS
95 | - Vulnerable Endpoint
96 | - PUT /api/users/:id
97 |
98 | # Web Cache Deception
99 |
100 | - Vulnerable Endpoint: GET /api/me
101 |
--------------------------------------------------------------------------------
32 |
40 |
41 |
33 | Vulnerable REST API
34 |
35 | Hi,
36 |Use the following link to reset your password.
37 | Reset Password 38 |Regards,
Vulnerable REST API
40 |