Python: Endpoint Tester - Testing endpoints for data validation and fuzz

Publicado em: 21 Agosto 2016
no canal de: BW

778

The code for this Python utility is at:
https://github.com/continuousqa/Endpo...

As always, only test web applications you have permission to test

Concept:
A Python script for testing security and functionality of Web Application Endpoints.

While front end may or may not have validation for POSTs to the backend, attacks can come directly to the back end endpoints of an application.

The script makes use of the "requests" module in Python (in order to capture user Session cookies after logging in) and then with the proper session it iterates over a dictionary of endpoints, and their corresponding JSON Payload.

The JSON Payload is replaced adhoc where there might be fragile code elements.

The script makes use of data manipulation (XSS, mix encoding, etc) as well as Fuzzing. The fuzzer takes a character ("A" for example) and user input for how much of a buffer to create. It then creates a list of values of the character, to the user specification. Then it passes each string to each endpoint, working its way up to the largest character string created.

Other Tools:
This doesn't replace the need for utilities like BurpSuite or OWASP's ZAP.

This simply is a quick utility to vet your specific endpoints against specified attack vectors. It is in no way meant to replace other tools which are updated by the InfoSec community.

Links:
For XSS attack vectors, I used the OWASP XSS Cheat Sheet:
https://www.owasp.org/index.php/XSS_F...

ZAP:
https://www.owasp.org/index.php/OWASP...

BurpSuite:
https://portswigger.net/burp/

Nesta página do site você pode assistir ao vídeo on-line Python: Endpoint Tester - Testing endpoints for data validation and fuzz duração hora minuto segundo em boa qualidade , que foi baixado pelo usuário BW 21 Agosto 2016, compartilhe o link com seus amigos e conhecidos, no youtube este vídeo já foi visto 778 vezes e gostou 6 espectadores. Boa visualização!

1,019,015

21 mil