Ask a Question

XSS scripting assertion on REST PATCH request via GET method

NikosG
Occasional Contributor

XSS scripting assertion on REST PATCH request via GET method

Hello to all

The subject may not make much sence so here it goes

 

I have a REST service and i'd like to check the Cross Site Scripting test options provided with SoapUI Pro (i have downloaded a trial version, even though it is the same with the community version if I'm not mistaken). The target of the test is one of the PATCH methods.

 

The problem is in seting up a proper assertion. I see that the default is performing the assertion on the actual response which is not very helpful in my case and there is no website whose url I could provide.

 

Ideally I'd like when I send something like this in the json request body 

{
"id": "resourceID",
"data": <IMG src=\"javascript&colon;alert('XSS');\">"
}

to be able to configure an assertion where I issue a GET request for the resource with the same id and detect any cross site scripting in the "data" element in the GET response

 

Has anyone else bumped into a similar problem?

Any comment would be highly appreciated

 

 

 

11 REPLIES 11
TanyaYatskovska
SmartBear Alumni (Retired)

Community, is there anything we can suggest?

@nmrao@HimanshuTayal@Radford@groovyguy 

---------
Tanya Yatskovskaya
SmartBear Community and Education Manager



TanyaYatskovska
SmartBear Alumni (Retired)

Hi @NikosG,

 

It looks like your question mar require some investigation (if there are no replies from the Community). Could you please refer this issue to our Support Team? You can reach out to them here: https://support.smartbear.com/message/?prod=ReadyAPI

 

---------
Tanya Yatskovskaya
SmartBear Community and Education Manager



nmrao
Community Hero

Not sure what the issue is.

If you need to send a payload, use POST method. GET does not allow to send payload.


Regards,
Rao.
NikosG
Occasional Contributor

 Hi @nmrao 

 

Let me clarify a bit 

 

As I said I'm trying out the security tests on trial version of SoapUI Pro

I'm using the XSS security tests on a PATCH method that is used in our API in order to update a specific resource. Configuring the test I am able to issue PATCH requests for a specific resource id like so

{
id: <uniqueId>,
data: <string replaced by the preconfigured XSS strings>
}

As I see SoapUI iterates through a list of preconfigured XSS strings and applies them to each of the request body fields. One field at a time.

 

The "problem" is when it is time to check if the XSS string has actually gone through.

As it is the application provides two options of doing that when you are setting up the Cross Site Scripting assertion:

  1. Check the immediate response
  2. Enter a custom script that returns a list of URLs to check for Cross Site Scripts

None of these are applicable in my case as:

  1. The immediate response can be a simple 204 (success) and I have no way of knowing if the XSS string has reached the backend as it was sent by SoapUI or some form of sanitation has taken place.
  2. I have no website that visualizes the data affected by the PATCH so as to scan a webpage for XSS (if this is what it is doing)

The only way to know if something like "data: <SCRIPT>alert("1")</SCRIPT>" has reached our database is by executing a GET on the resource with the same id and execute a check on the REST GET response, this way I can verify that the input has been sanitized or not.

 

So in each iteration of the Cross Site Scripting Scan I need to
a. get the request sent and extract the "id" from the request body of the PATCH request and field that was targeted
b. execute a GET REST request with the same id
c. scan the response for the XSS strings on the field defined in (a)

 

Since my last post I tried going via the custom script assertion

  • Extract to a file all the SoapUI XSS strings
  • Create a test step that performs a GET on a hardcoded "id" that is also used by PATCH
  • Issue the GET request and get the response using something like testCase.testSteps["GET_testCase"].testRequest.response.contentAsString
  • Iterate through the entries of the file to see if the response contains any of them

It seemed promissing but

  • I still miss the way to isolate the exact field that was used in the PATCH request for the XSS test. So i have to scan the whole GET response. This way I may get a positive for a field that I have already checked in a previous iteration.
  • While working with a specific id may work in PATCH (used for updates) in a POST case (used for creating new) where the id has to be unique between each iteration this will fail 

 

Hope this helps to clarify things on my case

 

 

nmrao
Community Hero

If I understand it right, you want to test the resource with particular payload instead of SoapUI generating on its own where it does not allow users to manipulate payload. Correct?


Regards,
Rao.
NikosG
Occasional Contributor

Hi @nmrao 

 

The payload that SoapUI generates during the test is fine.

The assertion executed after each request generated by SoapUI is the "problem" as the options provided are not applicable in my case

nmrao
Community Hero

Not sure if I understand.

What response do you get and what assertion would like to perform? Appreciate if you could add the details along with sample data explaining the problem.


Regards,
Rao.
NikosG
Occasional Contributor

Ok,

simple example

 

The PATCH operation is used on a resource that is "Phones"
The json body has a unique Id (int), the phone number (string) and a comment (string)

I set the XSS security test to execute PATCH requests in order to update the phone with id = 5 and target both strings in the body of the following request

{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "this is a comment"
}

As SoapUI iterates through its list of XSS strings and replacing the target fields it issues the following in sequence:

{
"PhoneUniqueId": 5,
"PhoneNumber": "<PLAINTEXT>" ,
"PhoneComment": "this is a comment"
}

{
"PhoneUniqueId": 5,
"PhoneNumber": "<SCRIPT>alert(1)</SCRIPT>" ,
"PhoneComment": "this is a comment"
}

...

{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "<PLAINTEXT>"
}

{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "<SCRIPT>alert(1)</SCRIPT>"
}

 

For the reasons I have mentioned already the existing XSS assertion setup is not helpful. So unless I'm missing something with the XSS assertion config, have to opt for a Custom Script Assertion.

 

The idea is this:

  1. Get the PhoneUniqueId from the PATCH request and the field that was used, let's say it was PhoneComment
  2. Issue a GET for the same PhoneUniqueId 
  3. Check the GET response body and see if the PhoneComment value has an XSS string

Checking through internet I came up with something very rough like this:

 

def testCase = messageExchange.modelItem.testCase
def ResponseMessage = testCase.testSteps["GET_Phones"].testRequest.response.contentAsString

File file1 = new File("C:/XSS_Vectors")
List textLine = file1.readLines()
try{
textLine.each{
if (ResponseMessage.contains(it)){
log.info 'XSS_Vector: ' + it +' was found in message'
res = false
throw new Exception('XSS_Vector: ' + it +' was found in message')
}
}
assert res
} catch(Exception e) {
log.error("Exception: ${e}")
assert res
}

 

The XSS_Vectors file has the strings used by SoapUI and GET_Phones is a testcase that performs the GET operation on the "PhoneUniqueId": 5 (hardcoded value)

 

Two problems with that: 
1. I do not know which field was used in the PATCH request so as to target the proper field only in my check. Let's say that the 2nd PATCH request from above goes through and the XSS string is stored as is. When I run the custom script for the 3rd and 4th one I will always get an indication even if "PhoneComment" was treated correctly, simply because the GET response will always have "PhoneNumber": "<SCRIPT>alert(1)</SCRIPT>"

2. I want to be able to use a similar approach for POST on the same resource that is used for inserting new entries. The body is the same as PATCH. The difference is that with POST I have to provide a unique PhoneUniqueId, something like this random generation

{
"PhoneUniqueId": "${=(new java.util.Random()).nextInt(10000000)}",
"PhoneNumber": "69${=(new java.util.Random()).nextInt(10000000).toString()}" ,
"PhoneComment": "<SCRIPT>alert(1)</SCRIPT>"
}

As a result I cannot have a GET request to be used with a hardcoded "PhoneUniqueId" either

 

hope this helps

Nikos

nmrao
Community Hero

Thank you for the details.

Just one question, how does the response look like for PATCH request?

I can see from the documentation that user can write your own custom script for the assertion.
https://support.smartbear.com/readyapi/docs/testing/assertions/reference/security/xss.html

Since you like to run a GET request after receiving the PATCH response, you can write code to make the GET call in the custom script. For that, use groovy wslite (check github for the library and sample code).


Regards,
Rao.
cancel
Showing results for 
Search instead for 
Did you mean: