Hi nmrao
Let me clarify a bit
As I said I'm trying out the security tests on trial version of SoapUI Pro
I'm using the XSS security tests on a PATCH method that is used in our API in order to update a specific resource. Configuring the test I am able to issue PATCH requests for a specific resource id like so
{
id: <uniqueId>,
data: <string replaced by the preconfigured XSS strings>
}
As I see SoapUI iterates through a list of preconfigured XSS strings and applies them to each of the request body fields. One field at a time.
The "problem" is when it is time to check if the XSS string has actually gone through.
As it is the application provides two options of doing that when you are setting up the Cross Site Scripting assertion:
None of these are applicable in my case as:
The only way to know if something like "data: <SCRIPT>alert("1")</SCRIPT>" has reached our database is by executing a GET on the resource with the same id and execute a check on the REST GET response, this way I can verify that the input has been sanitized or not.
So in each iteration of the Cross Site Scripting Scan I need to
a. get the request sent and extract the "id" from the request body of the PATCH request and field that was targeted
b. execute a GET REST request with the same id
c. scan the response for the XSS strings on the field defined in (a)
Since my last post I tried going via the custom script assertion
It seemed promissing but
Hope this helps to clarify things on my case
Hi nmrao
The payload that SoapUI generates during the test is fine.
The assertion executed after each request generated by SoapUI is the "problem" as the options provided are not applicable in my case
Ok,
simple example
The PATCH operation is used on a resource that is "Phones"
The json body has a unique Id (int), the phone number (string) and a comment (string)
I set the XSS security test to execute PATCH requests in order to update the phone with id = 5 and target both strings in the body of the following request
{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "this is a comment"
}
As SoapUI iterates through its list of XSS strings and replacing the target fields it issues the following in sequence:
{
"PhoneUniqueId": 5,
"PhoneNumber": "<PLAINTEXT>" ,
"PhoneComment": "this is a comment"
}
{
"PhoneUniqueId": 5,
"PhoneNumber": "<SCRIPT>alert(1)</SCRIPT>" ,
"PhoneComment": "this is a comment"
}
...
{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "<PLAINTEXT>"
}
{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "<SCRIPT>alert(1)</SCRIPT>"
}
For the reasons I have mentioned already the existing XSS assertion setup is not helpful. So unless I'm missing something with the XSS assertion config, have to opt for a Custom Script Assertion.
The idea is this:
Checking through internet I came up with something very rough like this:
def testCase = messageExchange.modelItem.testCase
def ResponseMessage = testCase.testSteps["GET_Phones"].testRequest.response.contentAsString
File file1 = new File("C:/XSS_Vectors")
List textLine = file1.readLines()
try{
textLine.each{
if (ResponseMessage.contains(it)){
log.info 'XSS_Vector: ' + it +' was found in message'
res = false
throw new Exception('XSS_Vector: ' + it +' was found in message')
}
}
assert res
} catch(Exception e) {
log.error("Exception: ${e}")
assert res
}
The XSS_Vectors file has the strings used by SoapUI and GET_Phones is a testcase that performs the GET operation on the "PhoneUniqueId": 5 (hardcoded value)
Two problems with that:
1. I do not know which field was used in the PATCH request so as to target the proper field only in my check. Let's say that the 2nd PATCH request from above goes through and the XSS string is stored as is. When I run the custom script for the 3rd and 4th one I will always get an indication even if "PhoneComment" was treated correctly, simply because the GET response will always have "PhoneNumber": "<SCRIPT>alert(1)</SCRIPT>"
2. I want to be able to use a similar approach for POST on the same resource that is used for inserting new entries. The body is the same as PATCH. The difference is that with POST I have to provide a unique PhoneUniqueId, something like this random generation
{
"PhoneUniqueId": "${=(new java.util.Random()).nextInt(10000000)}",
"PhoneNumber": "69${=(new java.util.Random()).nextInt(10000000).toString()}" ,
"PhoneComment": "<SCRIPT>alert(1)</SCRIPT>"
}
As a result I cannot have a GET request to be used with a hardcoded "PhoneUniqueId" either
hope this helps
Nikos
