API_Fuzzer 0.1.1

data/lib/API_Fuzzer/idor_check.rb

@@ -0,0 +1,62 @@
+require 'API_Fuzzer/vulnerability'
+require 'API_Fuzzer/error'
+require 'API_Fuzzer/request'
+
+module API_Fuzzer
+  class IdorCheck
+    class << self
+      def scan(options = {})
+        @url = options[:url]
+        @params = options[:params]
+        @methods = options[:method]
+        @headers = options[:headers] || {}
+        @cookies = options[:cookies]
+        @vulnerabilities = []
+
+        fuzz_without_session
+        @vulnerabilities.uniq { |vuln| vuln.description }
+      end
+
+      def fuzz_without_session
+        @methods.each do |method|
+          response = API_Fuzzer::Request.send_api_request(
+            url: @url,
+            params: @params,
+            method: method,
+            headers: @headers,
+            cookies: @cookies
+          )
+
+          response_without_session = API_Fuzzer::Request.send_api_request(
+            url: @url,
+            params: @params,
+            method: method
+          )
+
+          fuzz_sensitive_files(response, method)
+          fuzz_match(response, response_without_session, method)
+        end
+      end
+
+      def fuzz_match(resp, resp_without_session, method)
+        @vulnerabilities << API_Fuzzer::Vulnerability.new(
+          type: 'HIGH',
+          value: "API doesn't have access control protection",
+          description: "Possible IDOR in #{method} #{@url}"
+        ) if resp.body.to_s == resp_without_session.body.to_s
+      end
+
+      def fuzz_sensitive_files(response, method)
+        file_url = /^((https?:\/\/)?(www\.)?([\da-z\.-]+)\.([a-z\.]{2,6})\/[\w \.-]+?\.(pdf|doc|docs|rtf)([a-zA-Z0-9=?]*?))$/
+        flagged_url = response.body.to_s.scan(file_url) || []
+        flagged_url.each do |url|
+          @vulnerabilities << API_Fuzzer::Vulnerability.new(
+            type: 'MEDIUM',
+            value: "File #{url} can be accessed without proper permissions",
+            description: "Access control violation in #{method} #{url}"
+          )
+        end
+      end
+    end
+  end
+end

data/lib/API_Fuzzer/privilege_escalation_check.rb

@@ -0,0 +1,78 @@
+require 'API_Fuzzer/vulnerability'
+require 'API_Fuzzer/error'
+require 'API_Fuzzer/request'
+
+module API_Fuzzer
+  class PrivilegeEscalationCheck
+    class << self
+      def scan(options = {})
+        @url = options[:url]
+        @params = options[:params] || {}
+        @headers = options[:headers] || {}
+        @methods = options[:method] || []
+        @cookies = options[:cookies] || {}
+
+        @vulnerabilities = []
+        fuzz_privileges
+        @vulnerabilities.uniq  { |vuln| vuln.description }
+      rescue Exception => e
+        Rails.logger.info e.message
+      end
+
+      def fuzz_privileges
+        id = /\A\d+\z/
+        uri = URI(@url)
+        path = uri.path
+        query = uri.query
+        url = @url
+        base_uri = query.nil? ? path : [path, query].join("?")
+        fragments = base_uri.split(/[\/,?,&]/) - ['']
+        fragments.each do |fragment|
+          if fragment.match(/\A(\w)+=(\w)*\z/)
+            key, value = fragment.split("=")
+            if value.match(id)
+              value = value.to_i
+              value += 1
+              url = url.gsub(fragment, [key, value].join("=")).chomp
+              fuzz_identity(url, @params)
+            end
+          elsif fragment.match(id)
+            value = fragment.to_i
+            value += 1
+            url = url.gsub(fragment, value.to_s).chomp if url
+            fuzz_identity(url, @params, url)
+          end
+        end
+        return if @params.empty?
+
+        parameters = @params
+        parameters.keys.each do |parameter|
+          value = parameters[parameter]
+          if value.match(id)
+            value = value.to_i
+            value += 1
+            info = [parameter, value].join(" ")
+            fuzz_identity(@url, parameters.merge(parameter, value), info)
+          end
+        end
+      end
+
+      def fuzz_identity(url, params, value)
+        @methods.each do |method|
+          response = API_Fuzzer::Request.send_api_request(
+            url: url,
+            method: method,
+            params: @params,
+            cookies: @cookies,
+            headers: @headers
+          )
+          @vulnerabilities << API_Fuzzer::Vulnerability.new(
+            type: 'HIGH',
+            value: "ID in #{value} parameter is vulnerable to Privilege Escalation vulnerability.",
+            description: "Privilege Escalation vulnerability in #{method} #{url}"
+          ) if response.code == 200
+        end
+      end
+    end
+  end
+end

data/lib/API_Fuzzer/rate_limit_check.rb

@@ -0,0 +1,69 @@
+require 'API_Fuzzer/vulnerability'
+require 'API_Fuzzer/request'
+
+module API_Fuzzer
+  class RateLimitCheck
+    def self.scan(options = {})
+      @url = options[:url]
+      @params = options[:params] || {}
+      @headers = options[:headers] || {}
+      @cookies = options[:cookies] || {}
+      @vulnerabilities = []
+      @limit = options[:limit] || 50
+      @methods = options[:method] || [:get]
+
+      @methods.each { |method| fuzz_api_requests(method) }
+      @vulnerabilities.uniq { |vuln| vuln.description }
+    end
+
+    def self.fuzz_api_requests(method)
+      initial_response = fetch_initial_response(method)
+
+      responses = []
+      @limit.times do
+        responses << API_Fuzzer::Request.send_api_request(
+          url: @url,
+          method: method,
+          cookies: @cookies,
+          headers: @headers,
+          params: @params
+        )
+      end
+
+      vulnerable = true
+      responses.each do |response|
+        if response.code  == initial_response.code
+          content_length = response_content_length(response)
+          initial_content_length = response_content_length(initial_response)
+          if  content_length != initial_content_length
+            vulnerable = false
+            break
+          end
+        else
+          vulnerable = false
+          break
+        end
+      end
+      @vulnerabilities << API_Fuzzer::Vulnerability.new(
+        description: "API is not rate limited for #{method} #{@url}",
+        value: "API doesn't have any ratelimiting protection enabled which can be implemented by either throttling request or using captcha",
+        type: 'LOW'
+      ) if vulnerable
+    end
+
+    private
+    def self.fetch_initial_response(method)
+      API_Fuzzer::Request.send_api_request(
+        url: @url,
+        method: method,
+        cookies: @cookies,
+        headers: @headers,
+        params: @params
+      )
+    end
+
+    def self.response_content_length(response)
+      response.headers['Content-Length'] || response.body.to_s.size
+    end
+  end
+end

data/lib/API_Fuzzer/redirect_check.rb

@@ -0,0 +1,106 @@
+require 'API_Fuzzer/vulnerability'
+require 'API_Fuzzer/error'
+require 'API_Fuzzer/request'
+require 'uri'
+
+module API_Fuzzer
+  class RedirectCheck
+    REDIRECT_URL = 'http://127.0.0.1:3000/ping'
+    ALLOWED_METHODS = [:get, :post]
+    class << self
+      def scan(options = {})
+        @url = options[:url]
+        @params = options[:params] || {}
+        @cookies = options[:cookies] || {}
+        @json = options[:json] || false
+        @headers = options[:headers] || {}
+
+        @vulnerabilities = []
+        fuzz_payload
+        return @vulnerabilities.uniq { |vuln| vuln.description }
+      rescue Exception => e
+        @vulnerabilities << API_Fuzzer::Error.new(
+          description: e.message,
+          status: 'ERROR',
+          value: e.backtrace
+        )
+      end
+
+      def fuzz_payload
+        uri = URI(@url)
+        path = uri.path
+        query = uri.query
+        # base_uri = query.nil? ? path : [path, query].join("?")
+        fragments = path.split(/[\/,?,&]/) - ['']
+        fragments << query.split('&') if query
+        fragments.flatten!
+        fragments.each do |fragment|
+          if fragment.match(/\A(\w+)=(.?*)\z/) && valid_url?($2)
+            url = @url.gsub($2, REDIRECT_URL).chomp
+            fuzz_fragment(url)
+          elsif valid_url?(fragment)
+            url = @url.gsub(fragment, REDIRECT_URL)
+            fuzz_fragment(url)
+          end
+        end
+        return if @params.empty?
+
+        @params.keys.each do |parameter|
+          fuzz_each_parameter(parameter) if valid_url? @params[parameter]
+        end
+      end
+
+      def fuzz_fragment(url)
+        ALLOWED_METHODS.each do |method|
+          begin
+            response = API_Fuzzer::Request.send_api_request(
+              url: url,
+              method: method,
+              cookies: @cookies,
+              params: @params,
+              headers: @headers
+            )
+
+            @vulnerabilities << API_Fuzzer::Vulnerability.new(
+              description: "Possible Open Redirect vulnerability in #{method} #{url}",
+              parameter: "URL: #{url}",
+              value: "[PAYLOAD] #{url.gsub(REDIRECT_URL, 'PAYLOAD_URL')}",
+              type: 'MEDIUM'
+            ) if response.headers['Location'] =~ /#{REDIRECT_URL}/
+          rescue Exception => e
+            puts e.message
+          end
+        end
+      end
+
+      def fuzz_each_parameter(parameter)
+        params = @params
+        params[parameter] = REDIRECT_URL
+        ALLOWED_METHODS.each do |method|
+          begin
+            response = API_Fuzzer::Request.send_api_request(
+              url: @url,
+              method: method,
+              cookies: @cookies,
+              params: params,
+              headers: @headers
+            )
+
+            @vulnerabilities << API_Fuzzer::Vulnerability.new(
+              description: "Possible Open Redirect vulnerability in #{method} #{url}",
+              parameter: "Parameter: #{parameter}",
+              value: "[PAYLOAD] #{params.to_s.gsub(REDIRECT_URL, 'PAYLOAD_URL')}",
+              type: 'MEDIUM'
+            ) if response.headers['LOCATION'] =~ /#{REDIRECT_URL}/
+          rescue Exception => e
+            puts e.message
+          end
+        end
+      end
+
+      def valid_url? url
+        url =~ URI.regexp
+      end
+    end
+  end
+end

data/lib/API_Fuzzer/request.rb

@@ -0,0 +1,69 @@
+require 'http'
+
+module API_Fuzzer
+  class Request
+    attr_accessor :response, :request
+
+    class << self
+      def send_api_request(options = {})
+        @url = options.delete(:url)
+        @params = options.delete(:params) || {}
+        @method = options.delete(:method) || :get
+        @json = options.delete(:json) ? true : false
+        @body = options.delete(:body) ? true : false
+        @request = set_cookies_headers(options)
+        send_request
+      end
+    end
+
+    def response
+      @response
+    end
+
+    def success?
+      @response.code == 200
+    end
+
+    private
+
+    def self.set_cookies_headers(options = {})
+      cookies = options.delete(:cookies) || {}
+      headers = options.delete(:headers) || {}
+      request_object = HTTP.headers(headers).cookies(cookies)
+      request_object
+    end
+
+    def self.send_request
+      @response = case @method.to_sym
+      when :post
+        @request.post(@url, set_params)
+      when :put
+        @request.put(@url, set_params)
+      when :patch
+        @request.patch(@url, set_params)
+      when :head
+        @request.head(@url, set_params)
+      when :delete
+        @request.delete(@url, set_params)
+      else
+        @request.get(@url, set_params)
+      end
+    end
+
+    def self.set_params
+      if @json && !method_get?
+        { 'json' => @params }
+      elsif method_get?
+        { 'params' => @params }
+      elsif @body
+        { 'body' => @params }
+      else
+        { 'form' => @params }
+      end
+    end
+
+    def self.method_get?
+      @method.to_s == 'get'
+    end
+  end
+end

data/lib/API_Fuzzer/resource_info.rb

@@ -0,0 +1,51 @@
+require 'yaml'
+require 'API_Fuzzer/vulnerability'
+
+module API_Fuzzer
+
+  class InvalidResponse < StandardError; end
+
+  class ResourceInfo
+    # Accepts response and performs rules match based on the ruleset
+
+    class << self
+      def scan(response)
+        @response = response
+        if @response
+          fetch_rules
+          scan_rules
+        else
+          raise InvalidResponse, "Invalid response argument has been passed"
+        end
+      end
+
+      def fetch_rules
+        info_rules = File.expand_path('../../../rules', __FILE__)
+        @rules = YAML::load_file(File.join(info_rules, "info.yml"))['rules']
+      end
+
+      def scan_rules
+        @vulnerability_info = []
+
+        if @rules
+          headers = @response.headers.keys
+          
+          @rules.each do |rule|
+            headers.each do |header|
+              
+              if /#{rule['match'].downcase}/.match(header.downcase)
+                @vulnerability_info << API_Fuzzer::Vulnerability.new(
+                  description: rule['description'],
+                  value: [header, @response.headers[header].to_s].join(": "),
+                  type: 'INFORMATIVE'
+                )
+              end
+            
+            end
+          end
+        end
+        return @vulnerability_info
+      end
+    end
+  end
+end

data/lib/API_Fuzzer/sql_blind_check.rb

@@ -0,0 +1,52 @@
+require 'API_Fuzzer/vulnerability'
+require 'API_Fuzzer/error'
+require 'API_Fuzzer/request'
+require 'API_Fuzzer/sql_check'
+
+module API_Fuzzer
+  class InvalidURLError < StandardError; end
+  class SqlBlindCheck < SqlCheck
+    PAYLOAD_PATH = '../../../payloads/blind_sql.txt'.freeze
+    SQL_ERRORS = []
+    SCAN_TIME = '20'
+    attr_accessor :payloads
+
+    def self.fuzz_each_parameter(parameter, payload)
+      @params[parameter] << payload
+      process_vulnerability(nil, payload)
+    end
+
+    def self.fuzz_each_fragment(url, payload)
+      process_vulnerability(url, payload)
+    end
+
+    def self.process_vulnerability(url, payload)
+      url = url ? url : @url
+      ALLOWED_METHODS.each do |method|
+        start_time = Time.now
+        response = API_Fuzzer::Request.send_api_request(
+          url: @url,
+          params: @params,
+          method: method,
+          cookies: @cookies,
+          headers: @headers
+        )
+        end_time = Time.now
+        diff = end_time - start_time
+        if diff > 20 && diff < 25
+          @vulnerabilities << API_Fuzzer::Vulnerability.new(
+            description: "Possible blind SQL injection in #{method} #{@url} parameter: #{parameter}",
+            value: "[PAYLOAD] #{payload}"
+          )
+        end
+      end
+    end
+
+    def self.fetch_payloads
+      file = File.expand_path(PAYLOAD_PATH, __FILE__)
+      File.readlines(file).each do |line|
+        @payloads << line.gsub('__TIME__', SCAN_TIME).gsub('__MARK__', '20000000')
+      end
+    end
+  end
+end