# API testing

## SUMMARY&#x20;

PortSwigger API testing labs focus on RESTful and JSON APIs (Application Programming Interfaces). Websites and APIs are closely related, therefore classic web vulnerabilities are usually also applicable in the scope of API testing. This is important to note because some of the OWASP API top ten may be covered in other [Web Security labs](https://portswigger.net/web-security/api-testing/top-10-api-vulnerabilities).&#x20;

## KEYWORDS

API, mass assignment, server-side parameter pollution.

## REFERENCES

<https://portswigger.net/web-security/api-testing>

<https://portswigger.net/web-security/api-testing/top-10-api-vulnerabilities>

<https://owasp.org/API-Security/editions/2019/en/0xa6-mass-assignment/>

<https://portswigger.net/web-security/api-testing/server-side-parameter-pollution>

## API-01: Exploiting an API endpoint using documentation

This lab was solved by capturing a request to the endpoint `/api/user` and enumerating the allowed communications options.

This is done with the `OPTIONS` method.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FGz8UWocgTMUZXRJXTYJy%2FUntitlled2.png?alt=media&#x26;token=beb9f5c9-e39e-4cf3-977b-2eb98603061a" alt=""><figcaption></figcaption></figure>

The application replies method `DELETE` is allowed in the endpoint, so just send a delete request for user `carlos`

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FsP4Ocywdnpki3mprshBB%2FUntitlled3.png?alt=media&#x26;token=109cee81-425c-4ae9-b1f6-4055424fda25" alt=""><figcaption></figcaption></figure>

You have solved the lab.

## API-02: Finding and exploiting an unused API endpoint

You have $0 credit and you have to buy an expensive jacket. Theoretically it could be done in two ways: you could either raise your credit or lower jacket's price.

Regarding first option, there is an endpoint for account managing `/my-account`, but we cannot modify anything there.

Regarding second option, if you browse the jacket and capture the request you'll see a request to endpoint `/api/product/1/price`. Maybe we can lower the price here.

Let's enumerate the endpoint methods to have an idea what we can do here.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2F17tPWph4owKzY2iAeuyM%2FUntitled3.png?alt=media&#x26;token=4fc72a6d-1c99-4d5a-a803-5c33cdec930c" alt=""><figcaption></figcaption></figure>

It seems we can modify (patch) it. Let's see how the endpoint works, first we send an empty request and inspect the error message.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FOR94DaeAe7GPKkFlW2YX%2FUntitled4.png?alt=media&#x26;token=5a1d4a74-3d31-4488-89db-b00b2324a0e7" alt=""><figcaption></figcaption></figure>

It seems only JSON content/type is allowed. So change the request type and try again.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FimeGaBZaNEaQVdbsW5Ai%2FUntitled5.png?alt=media&#x26;token=15325b66-c30c-491f-af5d-d21fb4cb25c5" alt=""><figcaption></figcaption></figure>

The application kindly shows us the name of the parameter we have to use. So let's update the request to change the jacket's price to $0.00.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FAZJApzutZFwRee1aMCW1%2FUntitled6.png?alt=media&#x26;token=34bc5e0d-db6e-41f2-a011-66a8cdf2d09a" alt=""><figcaption></figcaption></figure>

Now you can buy the jacket with your empty wallet, just place the order and solve the lab.

## API-03: Exploiting a mass assignment vulnerability

In a [mass assignment vulnerability](https://owasp.org/API-Security/editions/2019/en/0xa6-mass-assignment/) we are able to modify data items that we should not normally be allowed to access.

Navigate to the jacket article, add to cart and place an order. Inspect the traffic, there are 2 requests to this endpoint `/api/checkout`

The first one is a GET request containing several interesting parameters, including one that seems to be used for discounts.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2F2WlpSHvLPKcdcnJDTljt%2FUntitled2.png?alt=media&#x26;token=98381e5b-e52f-4f8d-992b-e5694d9f3821" alt=""><figcaption></figcaption></figure>

The second one is a POST request using only 2 of the parameters, `product_id` and `name`, that is replied with an "Insufficient funds" error message.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2Fm3ZGosxIZPQokaq15xmZ%2FUntitled3.png?alt=media&#x26;token=41728889-d9e1-411a-b669-2e7d341a4b76" alt=""><figcaption><p>h</p></figcaption></figure>

We have disclosed the parameter for discounts before and have a view of how purchase orders are processed.

Let's test for a mass assignment vulnerability that might allow us to add a discount (for example, granting you a 100% discount).

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2F2QmU0lUFAkGjQnwfrqxz%2FUntitled4.png?alt=media&#x26;token=395fbdc5-d4df-4d93-9c54-0e13f4bb9a50" alt=""><figcaption></figcaption></figure>

The vulnerability is confirmed, order is processed and the lab is solved.

## API-04: Exploiting server-side parameter pollution in a query string

We are challenged to log in as the administrator and delete user `carlos`

Start by trying a password reset for user `administrator`

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FCc3wIJ58A3PduYEAUt5D%2FUntitled.png?alt=media&#x26;token=3daf4bcf-36c5-4f65-9842-356ab36e93ba" alt=""><figcaption></figcaption></figure>

As explained in the [Academy](https://portswigger.net/web-security/api-testing/server-side-parameter-pollution), in a server-side parameter pollution we are able to manipulate the internal server request to the API with an appropriate input. This is normally done by adding a truncation character.

In this example, the website adds internal parameters to the user input before sending the request to the internal API. We can add our own parameter if the application fails to correctly encode the input. Let's try with a truncation character such as #.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FBOlIIcywTHlolsDGHgMy%2FUntitled2.png?alt=media&#x26;token=3eba1ae6-64b6-4f09-a2ed-494093070f95" alt=""><figcaption></figcaption></figure>

This suggests we have been successful in truncating the request. The application was expecting a `field` parameter that is not being received because of the # character.

Knowing this, we can inject our own `field` parameter. For this we use a & character and end the string with another truncation.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2F8EIdCxSlAYF8Sm97rKyw%2FUntitled3.png?alt=media&#x26;token=5dd41e23-83af-4893-9df1-74bae9218989" alt=""><figcaption></figcaption></figure>

This confirms the application is vulnerable to server-side pollution.

Doing a couple more of tests we find out the `field` parameter is used to query account attributes such as the username or email.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FHSzKbqDFTof4gbYMAwkV%2FUntitled5.png?alt=media&#x26;token=07b56f99-8f22-417d-96a6-04c81a770dd7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2Fo1Rq9um6AfMR670qrmOx%2FUntitled6.png?alt=media&#x26;token=4eab7582-aef4-4729-ba5f-97aa19ed2206" alt=""><figcaption></figcaption></figure>

Once the vulnerability is confirmed, now we have to find a parameter to exploit so we can log in as administrator and delete the account.

In the source code of the file `/static/js/forgotPassword.js` we find out the `/forgot_password` endpoint expects a parameter called `reset_token`

<div align="left"><figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2Fo8YytLFZrVw6g18J1MMV%2FUntitled4.png?alt=media&#x26;token=c5973c0a-94f9-4075-b761-d9e405bd04a8" alt="" width="511"><figcaption></figcaption></figure></div>

If we use this in the `field` parameter we get a password reset token for user administrator.

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FPR05XENvsBVLmqUTv7hw%2FUntitled9.png?alt=media&#x26;token=0092fb4e-60ed-4082-97cc-93f2131a91a8" alt=""><figcaption></figcaption></figure>

And with this token you can reset administrator's password by accessing endpoint `/forgot-password?reset_token`

<figure><img src="https://40029037-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgnmqvnYiL2MhB6XLITXw%2Fuploads%2FCgHwB5twEo5R4W7aa5SR%2FUntitled7.png?alt=media&#x26;token=8eddaf84-9667-4b0c-bfab-176d89614552" alt=""><figcaption></figcaption></figure>

You have solved the lab.
