e832ef3b46
- New discovery engine (engine/discovery.sh): crawls target for real URLs, forms, parameters, and API endpoints before attacking - New nuclei vector (21): runs nuclei templates for real CVE detection (critical/high/medium severity) - Rebuilt SQLi vector: tests discovered forms and URL params with error-based and time-based blind payloads, sqlmap injection - Rebuilt XSS vector: multi-context payloads against discovered forms/params, confirms payload reflection - Rebuilt LFI vector: tests all discovered and common file parameters with traversal payloads, confirms by reading /etc/passwd - Updated main analyzer with 5-step pipeline: connectivity → discovery → recon → Ollama brain → exploitation
67 lines
2.3 KiB
Bash
Executable File
67 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 14: API Abuse & Security Testing
|
|
# Desc: Rate limiting, auth bypass, mass assignment, parameter pollution
|
|
# Detect: API endpoints /api/, /v1/, /rest
|
|
# Severity: HIGH
|
|
# Tools: curl
|
|
|
|
vector_apiab() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing API security..."
|
|
|
|
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
|
|
local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
|
|
|
|
# Discover API endpoints
|
|
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
|
|
local api_urls=$(echo "$page" | perl -nle 'while (/"https?:\/\/[^"]*api[^"]*"|"\/api\/[^"]*"|"\/v[0-9]\/[^"]*"/g) { print \$& }' 2>/dev/null | sort -u | head -10)
|
|
|
|
for endpoint in $api_urls; do
|
|
endpoint=$(echo "$endpoint" | tr -d '"')
|
|
[[ "$endpoint" == /* ]] && endpoint="${base}${endpoint}"
|
|
|
|
# Test various auth bypass methods
|
|
local methods=("GET" "POST" "PUT" "DELETE" "PATCH" "OPTIONS")
|
|
|
|
for method in "${methods[@]}"; do
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 \
|
|
-X "$method" \
|
|
-H "Authorization: Bearer" \
|
|
-H "Authorization: null" \
|
|
-H "X-Forwarded-For: 127.0.0.1" \
|
|
"$endpoint" 2>/dev/null)
|
|
|
|
# Check for unexpected access
|
|
local status=$(curl -s -o /dev/null -w "%{http_code}" -X "$method" --connect-timeout 5 --max-time 10 "$endpoint" 2>/dev/null)
|
|
|
|
if [ "$status" = "200" ] && [ "$method" != "GET" ]; then
|
|
print_warn "Unusual: $method $endpoint returns $status"
|
|
fi
|
|
done
|
|
|
|
# Test rate limiting
|
|
local rate_check=0
|
|
for i in 1 2 3 4 5 6 7 8 9 10; do
|
|
local rstatus=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 3 --max-time 5 "$endpoint" 2>/dev/null)
|
|
if [ "$rstatus" = "429" ] || [ "$rstatus" = "503" ]; then
|
|
rate_check=$((rate_check + 1))
|
|
fi
|
|
done
|
|
|
|
if [ "$rate_check" -eq 0 ]; then
|
|
print_warn "No rate limiting detected on $endpoint"
|
|
echo "SEVERITY: MEDIUM
|
|
VECTOR: Missing Rate Limiting
|
|
DETAIL: No rate limiting on $endpoint
|
|
EVIDENCE: 10 rapid requests without 429/503 response
|
|
EXPLOIT: Enables brute force, credential stuffing, DoS" > "$REPORTS_DIR/.finding_$(date +%s)_ratelimit.txt"
|
|
findings=$((findings + 1))
|
|
fi
|
|
done
|
|
|
|
return $findings
|
|
}
|