⛏️ Write a test to check whether we can create/update an object with invalid SSN

[ankush-jain-akto]

💭 Introduction:
We want to test to check whether an attacker can create/update entity with an invalid SSN.

🎯 Requirements:

1. Filters - API with UPI ID as an input in GET query parameter or JSON body parameter

2. Execute - It should replace the value with

• special characters
• A very long string (> 255 characters)
• Use whitespaces
• Invalid SSN
• A negative integer
• A very long integer causing integer overflow
• Zero
• NULL

3. Validation - If the application responds with a exception trace, it is a vulnerability.

✅ Task summary:

• Ask to be assigned to the issue.
• Wait to be assigned. We will try to assign in less than 2 hours.
• Signup for Akto
• Fork the tests-library repository, create a new branch and commit the yaml file which will be called in your test.
• Submit both the PR here.

📚 Reading
You can find a detailed documentation of test editor rules here
Find 100+ examples of YAML tests here

🙋🏼‍♂️ Questions:
If you have questions, need any help, or just want to hang out, make sure to join us on our Discord server.

[sivangbagri]

Hii Please assign me this issue

[mahimarohila]

hello can you assign me this issue

[sivangbagri]

I have made the PR
akto-api-security/tests-library#24

[avneesh-akto]

@sivangbagri your test template is invalid. Please run your template on an API and see if it works before making a PR.

[sivangbagri]

@avneesh-akto Hii I have made the necessary changes kindly check akto-api-security/tests-library@669f2f0

[saitejavarma-7]

Hi please assign me with this issue.

[avneesh-akto]

@sivangbagri your template still seems invalid. Request header is nested inside query params in api_selection_filter. Also you should detect and modify in request payload too. Please run the template on sample API before submitting any PR else you will get banned.

[avneesh-akto]

@saitejavarma-7 I have assigned it to you too. Happy hacking

[sivangbagri]

@avneesh-akto akto-api-security/tests-library@4c883b9

[avneesh-akto]

Hey.. still invalid. Your logic requires SSN or UPI id to be present in query, headers AND body param. Instead it should be a OR. Please refer CSRF test by removing csrf token test for more info

[avneesh-akto]

What is the logic for response_code: gte: 400 ? Shouldn't you check if it returns 2xx

[sivangbagri]

akto-api-security/tests-library#24 @ankush-jain-akto @avneesh-akto

[ankush-jain-akto]

Hi @sivangbagri can you please rebase to develop. This looks good.

[RaagaAkto]

Hi @sivangbagri, please fill out this form here so we can send you Akto swags. Will let you know ETA of swags soon, thanks for your contribution! 🚀

[RaagaAkto]

Hi @sivangbagri, we've received your details, swags should reach you in a month!