In this lesson,
we're going to talk about API abuse
and JSON Web Token, or JWT, manipulation.
These are key concepts when looking at security
of modern web applications,
particularly those that rely on APIs
for communication between clients and servers.
After that, we'll showcase Postman, an API testing tool.
So, API abuse happens when an attacker
exploits the functionality of an API
in ways that the developers did not intend or anticipate.
For instance, let's say a company like Meta,
formerly known as Facebook,
provides an API that allows users
to query their friends' public data.
If this API is not properly secured,
a malicious actor could abuse it
to scrape massive amounts of user data
by sending continuous requests,
which could lead to a breach of privacy
and compliance violations,
such as the one that occurred
with the Cambridge Analytica scandal.
Attackers often use automated tools
like Burp Suite or Postman to manipulate API calls,
bypassing controls like rate limiting or input validation,
leading to data breaches or even service disruptions.
One of the ways to secure APIs is by using JWTs
for authentication and authorization.
JWTs are commonly used because they are stateless,
meaning that the server
does not need to store session information.
A JWT often contains three parts:
the header, the payload, and the signature.
The payload holds claims about the user,
like their identity or their role,
which are encoded but not encrypted.
This means that if an attacker can gain access to the JWT,
they can read this data.
JWT manipulation refers to attacks
where the JWT is tampered with or forged by an attacker.
For instance, a hacker could alter the payload of a JWT
to elevate their privileges.
Let's say a JWT contains a claim called "role"
with the value "user."
The attacker could decode the JWT,
modify the "role" to "admin,"
and re-encode the token.
If the server does not properly validate the JWT signature,
the attacker could gain administrative access
to the application.
In a high-profile example,
CVE-2015-2951 highlighted vulnerabilities in JWT libraries
where weak cryptographic algorithms were used,
allowing attackers to modify tokens
without proper validation.
To prevent this kind of attack,
we should ensure that JWTs
are signed with a secure hashing algorithm,
such as HS256 or RS256,
and that the server always validates the token's signature
before trusting the claims within the payload.
Additionally, setting a short expiration time on tokens
and rotating keys regularly
can limit the potential damage if a token is compromised.
Now, let's briefly go over
how an attacker could use Postman for malicious purposes.
Postman is a popular collaboration platform
for API development.
So, it allows developers, testers,
and security professionals to design, test, and debug APIs.
Now, Postman provides a user-friendly interface
for making HTTP requests, visualizing responses,
automating tests, and collaborating on API documentation.
It supports various request methods,
such as GET, POST, PUT, DELETE,
and different other ones as well.
It also provides support
for different types of API architectures,
including REST APIs, SOAP, and GraphQL.
Now, when you open up Postman,
you'll see several key sections here.
So, first, up here to the top left, we see the Workspaces.
It allows us to create and switch between workspaces,
which helps us manage different sets of APIs
and requests for different projects,
so it's really good for workflow management
within organizations.
And then we have the Collections tab here.
Collections are nothing more than a group of saved requests.
So, they can be for specific API functionalities
or testing purposes.
So, you can add tests and scripts to these requests
to automate various checks.
Okay, so if we look here,
we have some of the API security- OWASP API Top 10.
And so, what that does is it allows us
to have pre-requests based off of OWASP Top 10,
and it has some pre-configuration set up for us.
Alright, so then we have the request builder,
this section here, right?
And this is where we're going to actually
submit our request.
So right now, we have it set for a GET request.
And we have a base URL.
And so we have the local host
now running the vulnerable web server on my local machine.
If we go over here to Environments, we'll see Globals
and we'll see this baseURL variable set here.
So, I don't have to keep typing in the IP address
or things like that,
especially if you're dealing
with a lot of different URLs or endpoints,
this would be a good feature.
Okay, so going back here
and we have the rest of the request, right?
So, clearly, we're inputting a SQL injection attack.
So, it also breaks down
these different query parameters here.
So we have q, and that's just simply identifying it,
so we can save this variable if we needed to.
And then one other good feature that I like here
is the different scripts, right?
Here I have a custom script that I'm testing specifically
for the SQL injection if it's successful or not.
After we submit this request,
it will let me know if the SQL injection was successful
and just give me a simple yes or no.
So, let's go ahead and submit this request
and see what happens.
Alright, so what we're trying to do here
is bypass any type of authentication
by using a SQL injection.
So, we're on the products page of this particular website
and we're trying to see
if we can return more than one product.
Typically you would have one parameter,
say something like shoes, or shirts,
or whatever it is, right?
We have all the different products here.
So, we have the apple juice, we have apple pomace,
banana juice, et cetera.
So pretty much, if we go to the test results,
we see that the SQL injection was successful
because I was able to run this script
that I customized and defined.
So, the question might be, why would we use this
instead of just simply putting it into the browser?
So, just reiterating the features that I described earlier,
we have a controlled environment here.
So, Postman allows us to set the headers.
You know, we can make any customized headers that we like.
We can manage cookies.
We can fine tune every aspect of the HTTP request,
providing a more controlled testing environment
than a standard browser,
which comes with pre-built headers and pre-built conditions.
And again, it also allows us
to automate a lot of these tests,
making things efficient
when we're trying to perform our penetration test.
And another good thing is,
whenever we, you know, want our results,
we have different options for a detailed analysis
of what's going on here.
If we want to get raw data,
if we wanted to get, you know,
it put in a pretty format very nicely,
JSON information, you name it.
We can get a lot of these different things
all from this platform, all right?
So in conclusion, Postman provides a robust
and user-friendly platform for testing APIs
and assessing the security,
which allows us to automate, collaborate,
and efficiently manage our API testing
and security assessment efforts.
So, I hope you enjoyed this demonstration,
and I will see you in the next one.