Skip to content

Commit b00e83a

Browse files
arcuri82arcuri82
committed
updated fault descriptions
1 parent 15493da commit b00e83a

2 files changed

Lines changed: 100 additions & 2 deletions

File tree

‎src/main/java/com/webfuzzing/commons/faults/DefinedFaultCategory.java‎

Lines changed: 58 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ public enum DefinedFaultCategory implements FaultCategory {
1414
// might keep other 2xx,...,8xx for other groups (eg, security, GraphQL, RPC)
1515
// 9xx is reserved for custom codes
1616

17-
HTTP_STATUS_500(100, "HTTP Status 500", "causes500_internalServerError",
17+
HTTP_STATUS_500(100, "HTTP Status 500",
18+
"causes500_internalServerError",
1819
"The HTTP status code 500 represents a 'Server Error'." +
1920
" Typically, when there is crash in the business logic of the tested backend, like for example due to" +
2021
" a null-pointer exception, the server would not crash, but rather return a response with status code 500." +
@@ -25,14 +26,69 @@ public enum DefinedFaultCategory implements FaultCategory {
2526
" As such, although there is high chances that a 500 status code might point to the presence of a" +
2627
" software fault in the tested application, they still need to be manually checked due to possible 'false-positive'."),
2728

28-
SCHEMA_INVALID_RESPONSE(101, "Received A Response From API That Is Not Valid According To Its Schema", "returnsSchemaInvalidResponse",
29+
SCHEMA_INVALID_RESPONSE(101, "Received A Response From API That Is Not Valid According To Its Schema",
30+
"returnsSchemaInvalidResponse",
2931
"A schema, like for example OpenAPI for REST, defines the structures not only of the inputs but" +
3032
" also the outputs of the API." +
3133
" If what returned by an API is not conforming to its schema, then it is a clear fault." +
3234
" However, whether the fault is in the API (i.e., it does not conform to the schema) or in the schema" +
3335
" itself (i.e., it is underspecified, or having mistakes) is something that cannot be known for" +
3436
" sure without debugging the issue."),
3537

38+
SCHEMA_VALIDATION_BYPASS(102, "Received Success Response When Sending Wrong Data",
39+
"successOnInvalidInputs",
40+
"API inputs might have constraints (e.g., integers in a specific range, and strings matching a" +
41+
" given regular expression)." +
42+
" Also, they need be to of specific types (e.g., integers, booleans, strings, dates, arrays and objects)." +
43+
" If some input data does not satisfy the type on constraints defined in the schema, then the API should" +
44+
" mark the request as 'user error'." +
45+
" However, if for any reason the request is processed successfully, then it is a fault." +
46+
" Either the schema is incorrect, or the API is not properly discarding invalid data."),
47+
48+
DELETE_NOT_WORKING(103, "Resource Still Accessible After Being Deleted",
49+
"deleteNotWorking",
50+
"If a resource is deleted, and the API responds that such request was successful, then such" +
51+
" resource should no longer being available." +
52+
" New requests to access it should fail." +
53+
" Otherwise, if it is still possible to access the resource, then it was not really deleted." +
54+
" Then, as such, it means that the delete operation is faulty."),
55+
56+
FAILED_CREATION_SIDE_EFFECTS(104, "Failed Creation of Resource Has Side Effects on Backend",
57+
"sideEffectsOnFailedCreation",
58+
"The API might expose endpoints to create new resources." +
59+
" The creation of a new resource might fail due to non-satisfied input constraints, or based" +
60+
" on constraints in the state of the backend." +
61+
" If the API reports that the creation operation failed, then such action should have no side-effects" +
62+
" The resource (e.g., with partial data) should not be accessible."),
63+
64+
65+
// 2xx: security
66+
67+
SQL_INJECTION(200, "SQL Injection (SQLi)",
68+
"vulnerableToSQLInjection",
69+
"Input data was not properly sanitized." +
70+
" Its use in SQL commands led to execute arbitrary commands on the database." +
71+
" See OWASP Top 10 for more information."),
72+
73+
XSS(201, "Cross-Site Scripting (XSS)",
74+
"vulnerableToXSS",
75+
"XSS is an attack in which it is possible to inject malicious scripts into web pages viewed users." +
76+
" This works as well in APIs, if the malicious payload is stored as it is," +
77+
" and then read afterwards by a frontend web application." +
78+
" See OWASP Top 10 for more information."),
79+
80+
SSRF(202,"Server-Side Request Forgery (SSRF)",
81+
"vulnerableToSSRF",
82+
"Some inputs might be URLs, which are then used by the API to retrieve data from external services." +
83+
" However, if the hostnames of these URLs are not verified, the API could be tricked into making requests" +
84+
" towards servers it should not to, like for example the 'localhost'." +
85+
" See OWASP Top 10 for more information."),
86+
87+
MASS_ASSIGNMENT(203,"Mass Assignment",
88+
"vulnerableToMassAssignment",
89+
"This vulnerability exploits possible active record pattern misconfigurations to modify fields of " +
90+
" a record that should not be accessible via the API." +
91+
" See OWASP Top 10 for more information."),
3692

3793
;
3894

‎src/main/resources/wfc/faults/fault_categories.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,46 @@
1010
"fullDescription" : "A schema, like for example OpenAPI for REST, defines the structures not only of the inputs but also the outputs of the API. If what returned by an API is not conforming to its schema, then it is a clear fault. However, whether the fault is in the API (i.e., it does not conform to the schema) or in the schema itself (i.e., it is underspecified, or having mistakes) is something that cannot be known for sure without debugging the issue.",
1111
"descriptiveName" : "Received A Response From API That Is Not Valid According To Its Schema",
1212
"label" : "F101:Received A Response From API That Is Not Valid According To Its Schema"
13+
}, {
14+
"code" : 102,
15+
"testCaseLabel" : "successOnInvalidInputs",
16+
"fullDescription" : "API inputs might have constraints (e.g., integers in a specific range, and strings matching a given regular expression). Also, they need be to of specific types (e.g., integers, booleans, strings, dates, arrays and objects). If some input data does not satisfy the type on constraints defined in the schema, then the API should mark the request as 'user error'. However, if for any reason the request is processed successfully, then it is a fault. Either the schema is incorrect, or the API is not properly discarding invalid data.",
17+
"descriptiveName" : "Received Success Response When Sending Wrong Data",
18+
"label" : "F102:Received Success Response When Sending Wrong Data"
19+
}, {
20+
"code" : 103,
21+
"testCaseLabel" : "deleteNotWorking",
22+
"fullDescription" : "If a resource is deleted, and the API responds that such request was successful, then such resource should no longer being available. New requests to access it should fail. Otherwise, if it is still possible to access the resource, then it was not really deleted. Then, as such, it means that the delete operation is faulty.",
23+
"descriptiveName" : "Resource Still Accessible After Being Deleted",
24+
"label" : "F103:Resource Still Accessible After Being Deleted"
25+
}, {
26+
"code" : 104,
27+
"testCaseLabel" : "sideEffectsOnFailedCreation",
28+
"fullDescription" : "The API might expose endpoints to create new resources. The creation of a new resource might fail due to non-satisfied input constraints, or based on constraints in the state of the backend. If the API reports that the creation operation failed, then such action should have no side-effects The resource (e.g., with partial data) should not be accessible.",
29+
"descriptiveName" : "Failed Creation of Resource Has Side Effects on Backend",
30+
"label" : "F104:Failed Creation of Resource Has Side Effects on Backend"
31+
}, {
32+
"code" : 200,
33+
"testCaseLabel" : "vulnerableToSQLInjection",
34+
"fullDescription" : "Input data was not properly sanitized. Its use in SQL commands led to execute arbitrary commands on the database. See OWASP Top 10 for more information.",
35+
"descriptiveName" : "SQL Injection (SQLi)",
36+
"label" : "F200:SQL Injection (SQLi)"
37+
}, {
38+
"code" : 201,
39+
"testCaseLabel" : "vulnerableToXSS",
40+
"fullDescription" : "XSS is an attack in which it is possible to inject malicious scripts into web pages viewed users. This works as well in APIs, if the malicious payload is stored as it is, and then read afterwards by a frontend web application. See OWASP Top 10 for more information.",
41+
"descriptiveName" : "Cross-Site Scripting (XSS)",
42+
"label" : "F201:Cross-Site Scripting (XSS)"
43+
}, {
44+
"code" : 202,
45+
"testCaseLabel" : "vulnerableToSSRF",
46+
"fullDescription" : "Some inputs might be URLs, which are then used by the API to retrieve data from external services. However, if the hostnames of these URLs are not verified, the API could be tricked into making requests towards servers it should not to, like for example the 'localhost'. See OWASP Top 10 for more information.",
47+
"descriptiveName" : "Server-Side Request Forgery (SSRF)",
48+
"label" : "F202:Server-Side Request Forgery (SSRF)"
49+
}, {
50+
"code" : 203,
51+
"testCaseLabel" : "vulnerableToMassAssignment",
52+
"fullDescription" : "This vulnerability exploits possible active record pattern misconfigurations to modify fields of a record that should not be accessible via the API. See OWASP Top 10 for more information.",
53+
"descriptiveName" : "Mass Assignment",
54+
"label" : "F203:Mass Assignment"
1355
} ]

0 commit comments

Comments
 (0)