XSS scripting assertion on REST PATCH request via GET method
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
XSS scripting assertion on REST PATCH request via GET method
Hello to all
The subject may not make much sence so here it goes
I have a REST service and i'd like to check the Cross Site Scripting test options provided with SoapUI Pro (i have downloaded a trial version, even though it is the same with the community version if I'm not mistaken). The target of the test is one of the PATCH methods.
The problem is in seting up a proper assertion. I see that the default is performing the assertion on the actual response which is not very helpful in my case and there is no website whose url I could provide.
Ideally I'd like when I send something like this in the json request body
{
"id": "resourceID",
"data": <IMG src=\"javascript:alert('XSS');\">"
}
to be able to configure an assertion where I issue a GET request for the resource with the same id and detect any cross site scripting in the "data" element in the GET response
Has anyone else bumped into a similar problem?
Any comment would be highly appreciated
- Labels:
-
Assertions
-
REST
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Community, is there anything we can suggest?
@nmrao, @HimanshuTayal, @Radford, @groovyguy
Tanya Yatskovskaya
SmartBear Community and Education Manager
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @NikosG,
It looks like your question mar require some investigation (if there are no replies from the Community). Could you please refer this issue to our Support Team? You can reach out to them here: https://support.smartbear.com/message/?prod=ReadyAPI
Tanya Yatskovskaya
SmartBear Community and Education Manager
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you need to send a payload, use POST method. GET does not allow to send payload.
Regards,
Rao.
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @nmrao
Let me clarify a bit
As I said I'm trying out the security tests on trial version of SoapUI Pro
I'm using the XSS security tests on a PATCH method that is used in our API in order to update a specific resource. Configuring the test I am able to issue PATCH requests for a specific resource id like so
{
id: <uniqueId>,
data: <string replaced by the preconfigured XSS strings>
}
As I see SoapUI iterates through a list of preconfigured XSS strings and applies them to each of the request body fields. One field at a time.
The "problem" is when it is time to check if the XSS string has actually gone through.
As it is the application provides two options of doing that when you are setting up the Cross Site Scripting assertion:
- Check the immediate response
- Enter a custom script that returns a list of URLs to check for Cross Site Scripts
None of these are applicable in my case as:
- The immediate response can be a simple 204 (success) and I have no way of knowing if the XSS string has reached the backend as it was sent by SoapUI or some form of sanitation has taken place.
- I have no website that visualizes the data affected by the PATCH so as to scan a webpage for XSS (if this is what it is doing)
The only way to know if something like "data: <SCRIPT>alert("1")</SCRIPT>" has reached our database is by executing a GET on the resource with the same id and execute a check on the REST GET response, this way I can verify that the input has been sanitized or not.
So in each iteration of the Cross Site Scripting Scan I need to
a. get the request sent and extract the "id" from the request body of the PATCH request and field that was targeted
b. execute a GET REST request with the same id
c. scan the response for the XSS strings on the field defined in (a)
Since my last post I tried going via the custom script assertion
- Extract to a file all the SoapUI XSS strings
- Create a test step that performs a GET on a hardcoded "id" that is also used by PATCH
- Issue the GET request and get the response using something like testCase.testSteps["GET_testCase"].testRequest.response.contentAsString
- Iterate through the entries of the file to see if the response contains any of them
It seemed promissing but
- I still miss the way to isolate the exact field that was used in the PATCH request for the XSS test. So i have to scan the whole GET response. This way I may get a positive for a field that I have already checked in a previous iteration.
- While working with a specific id may work in PATCH (used for updates) in a POST case (used for creating new) where the id has to be unique between each iteration this will fail
Hope this helps to clarify things on my case
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Regards,
Rao.
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @nmrao
The payload that SoapUI generates during the test is fine.
The assertion executed after each request generated by SoapUI is the "problem" as the options provided are not applicable in my case
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What response do you get and what assertion would like to perform? Appreciate if you could add the details along with sample data explaining the problem.
Regards,
Rao.
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok,
simple example
The PATCH operation is used on a resource that is "Phones"
The json body has a unique Id (int), the phone number (string) and a comment (string)
I set the XSS security test to execute PATCH requests in order to update the phone with id = 5 and target both strings in the body of the following request
{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "this is a comment"
}
As SoapUI iterates through its list of XSS strings and replacing the target fields it issues the following in sequence:
{
"PhoneUniqueId": 5,
"PhoneNumber": "<PLAINTEXT>" ,
"PhoneComment": "this is a comment"
}
{
"PhoneUniqueId": 5,
"PhoneNumber": "<SCRIPT>alert(1)</SCRIPT>" ,
"PhoneComment": "this is a comment"
}
...
{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "<PLAINTEXT>"
}
{
"PhoneUniqueId": 5,
"PhoneNumber": "123123123" ,
"PhoneComment": "<SCRIPT>alert(1)</SCRIPT>"
}
For the reasons I have mentioned already the existing XSS assertion setup is not helpful. So unless I'm missing something with the XSS assertion config, have to opt for a Custom Script Assertion.
The idea is this:
- Get the PhoneUniqueId from the PATCH request and the field that was used, let's say it was PhoneComment
- Issue a GET for the same PhoneUniqueId
- Check the GET response body and see if the PhoneComment value has an XSS string
Checking through internet I came up with something very rough like this:
def testCase = messageExchange.modelItem.testCase
def ResponseMessage = testCase.testSteps["GET_Phones"].testRequest.response.contentAsString
File file1 = new File("C:/XSS_Vectors")
List textLine = file1.readLines()
try{
textLine.each{
if (ResponseMessage.contains(it)){
log.info 'XSS_Vector: ' + it +' was found in message'
res = false
throw new Exception('XSS_Vector: ' + it +' was found in message')
}
}
assert res
} catch(Exception e) {
log.error("Exception: ${e}")
assert res
}
The XSS_Vectors file has the strings used by SoapUI and GET_Phones is a testcase that performs the GET operation on the "PhoneUniqueId": 5 (hardcoded value)
Two problems with that:
1. I do not know which field was used in the PATCH request so as to target the proper field only in my check. Let's say that the 2nd PATCH request from above goes through and the XSS string is stored as is. When I run the custom script for the 3rd and 4th one I will always get an indication even if "PhoneComment" was treated correctly, simply because the GET response will always have "PhoneNumber": "<SCRIPT>alert(1)</SCRIPT>"
2. I want to be able to use a similar approach for POST on the same resource that is used for inserting new entries. The body is the same as PATCH. The difference is that with POST I have to provide a unique PhoneUniqueId, something like this random generation
{
"PhoneUniqueId": "${=(new java.util.Random()).nextInt(10000000)}",
"PhoneNumber": "69${=(new java.util.Random()).nextInt(10000000).toString()}" ,
"PhoneComment": "<SCRIPT>alert(1)</SCRIPT>"
}
As a result I cannot have a GET request to be used with a hardcoded "PhoneUniqueId" either
hope this helps
Nikos
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just one question, how does the response look like for PATCH request?
I can see from the documentation that user can write your own custom script for the assertion.
https://support.smartbear.com/readyapi/docs/testing/assertions/reference/security/xss.html
Since you like to run a GET request after receiving the PATCH response, you can write code to make the GET call in the custom script. For that, use groovy wslite (check github for the library and sample code).
Regards,
Rao.
