Difference between revisions of "Testing for WS HTTP GET parameters/REST attacks (OWASP-WS-005)"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
 
'''HTTP GET parameters.'''  
 
'''HTTP GET parameters.'''  
  
 +
===Brief Summary===
  
 
Many XML applications are invoked by passing them parameters using HTTP GET queries.
 
Many XML applications are invoked by passing them parameters using HTTP GET queries.
 +
These are sometimes known as “REST-style" Web Services. These Web Services can be attacked by  passing malicious content on the HTTP GET string (e.g. Extra long parameters (2048 chars), SQL statements/injection or OS Injection parameters).
 +
REST = Representational State Transfer).
  
Example:
 
The HTTP request with query string /viewDetail=detail-10293, the HTTP GET parameter is detail- 10293).
 
  
These are sometimes known as “REST-style" Web Services. These Web Services can be attacked by  passing malicious content on the HTTP GET string (e.g. Extra long parameters (2048 chars), SQL statements/injection or OS Injection parameters).
+
=== Description of the Issue ===
(REST = Representational State Transfer).
+
Given that Web services REST are in effect HTTP-In -> WS-OUT at attack patterns are very similar to regular HTTP attack vectors, discussed throughout the guide.
 +
 
 +
'''Example:'''
 +
The HTTP request with query string /viewDetail=detail-10293, the HTTP GET parameter is ''detail- 10293''.
 +
 
 +
===Black Box Testing===
 +
 
 +
===Grey Box Testing===
 +
 
 +
===References===

Revision as of 05:58, 2 November 2006

HTTP GET parameters.

Contents

Brief Summary

Many XML applications are invoked by passing them parameters using HTTP GET queries. These are sometimes known as “REST-style" Web Services. These Web Services can be attacked by passing malicious content on the HTTP GET string (e.g. Extra long parameters (2048 chars), SQL statements/injection or OS Injection parameters). REST = Representational State Transfer).


Description of the Issue

Given that Web services REST are in effect HTTP-In -> WS-OUT at attack patterns are very similar to regular HTTP attack vectors, discussed throughout the guide.

Example: The HTTP request with query string /viewDetail=detail-10293, the HTTP GET parameter is detail- 10293.

Black Box Testing

Grey Box Testing

References