Description

Fuzzing APIs: is the process of sending various types of input to an endpoint to provoke an unintended response
The payloads used for fuzzing include
[symbols, numbers, system commands, SQL queries, NoSQL queries, hexadecimal, boolean statements,…..]
You should attempt fuzzing against all potential inputs and especially within the following:

• Headers
• Query string parameters

• Parameters in POST/PUT requests
  After sending your fuzzing requests, search for:

• Verbose error messages
• Failures in request handling
• Indications that your payload bypassed security controls (e.g., SQL syntax errors, delays, or verbose error dumps)

SQL Injection Meta characters

characters that SQL treats as functions rather than data:
for example, -- is a metacharacter that tells the SQL interpreter to ignore the following input because it is a comment

    '
    ''
    ;%00
    --
    -- -
    ""
    ;
    ' OR '1
    ' OR 1 -- -
    " OR "" = "
    " OR 1 = 1 -- -
    ' OR '' = '
    OR 1=1

If an API endpoint does not filter SQL syntax from API requests, any SQL queries passed to the database from the API will execute.

SQL injection, allows a remote attacker to interact with the application’s backend SQL database. With this access, an attacker could obtain or delete sensitive data such as credit card numbers, usernames, passwords, and other gems

If the API authentication process uses a query like this:

SELECT * FROM userdb WHERE username = 'hAPI_hacker' AND password = 'Password1!';

The query retrieves the values hAPI_hacker and Password1! from the user input. If, instead of a password, we supply the API with the value ' OR 1=1-- -, the SQL query might look like this:

SELECT * FROM userdb WHERE username = 'hAPI_hacker' OR 1=1-- -;

This would be interpreted as selecting the user with a true statement and skipping the password requirement, as it has been commented out. The query no longer checks for a password at all, and the user is granted access

NoSQL Injection

APIs often use NoSQL databases, which scale well with modern architecture. NoSQL injection techniques are not as well-known as SQL injections, making them a more likely discovery.

Each NoSQL database has its own structure and querying methods, so payloads will vary. Here are some common NoSQL metacharacters for fuzzing:

    $gt
    {"$gt":""}
    {"$gt":-1}
    $ne
    {"$ne":""}
    {"$ne":-1}
    $nin
    {"$nin":1}
    {"$nin":[1]}
    {"$where": "sleep(1000)"}

For example, the $ne operator stands for not equal It is used to select documents where the value of a field does not match the specified value

OS Command Injection

In OS command injection, rather than database queries, you’re injecting operating system commands. You’ll need to find an injection point where commands can be executed. Key places to target include:

• URL query strings
• Request parameters
• Headers
  Common Command Separators

  { | , || , & , && , ' , " , ; }
  

  Common OS Commands for Injection:

  Windows -> { ipconfig , dir , ver , whoami }
  Linux   -> { ifconfig , ls , pwd, whoami }
  

  Injecting these commands after a command separator could allow attackers to retrieve system information or run unauthorized commands
  —