Description

APIs in real-world scenarios are often protected by multiple security layers that make exploitation far more challenging like Web Application Firewalls (WAFs) and rate-limiting mechanisms designed to detect and block malicious activities For example, WAFs might flag behaviors such as:

1. Excessive requests for non-existent resources.
2. High request volumes over a short period.
3. Attempts at common attack techniques like SQL injection or cross-site scripting (XSS).
4. Unusual patterns, like unauthorized access tests.

   Evade API Security Controls

   ---

5. String Terminators

Null bytes and other combinations of symbols are often such as null bytes (%00), are a commonly exploited weakness that can disrupt the operation of input validation filters. These special characters can signal the backend system to stop processing inputs prematurely, potentially bypassing security measures like:

%00
0x00
//
;
%
!
?
[]
%5B%5D
%09 , `%0a` , `%0b` , `%0c` , `%0e`

strategically placing these terminators within a request, particularly in areas like the URL path or POST body, attackers may be able to bypass input validation filters. Consider this example:

POST /api/v1/user/profile/update
{
  "uname": "hapihacker",
  "pass": "%00'OR 1=1"
}

In this case, a null byte (%00) preceding an SQL injection ('OR 1=1) might bypass the backend’s input validation, allowing the malicious payload to be processed

1. Case Switching
   Many APIs are case-sensitive, meaning that a change in the capitalization of letters within a request may bypass certain controls like WAFs

   POST /api/myProfile
   POST /api/MyProfile
   POST /aPi/MypRoFiLe
   

2. Encoding Payloads
   URL encoding converts special characters into a form that can slip past some WAFs, which only decode requests once. Take the following SQL injection payload:

   Encoded Payload: %27%20%4f%52%20%31%3d%31%3b
   Decoded: ' OR 1=1;
   

   A well-configured WAF might recognize this as a SQL injection and block it. However, by using double encoding:

   Double Encoded Payload: %25%32%37%25%32%30%25%34%66%25%35%32%25%32%30%25%33%31%25%33%64%25%33%31%25%33%62
   Decoded: %27%20%4f%52%20%31%3d%31%3b
   

   The WAF might miss this attack, allowing the payload to pass through and be decoded later on the server side, triggering the SQL injection