Scan api using swagger description

[burtsevyg]

Do you have an idea for a solution?

Scan api using swagger description.

How can we reproduce the issue?

1. Read api description from swagger
2. Scan backend api

[stamparm]

Can you please give a quick info/introduction what would this provide compared to the current situation and/or compared to other xyz frameworks?

[stamparm]

ping?

[alexk307]

I want this too. Willing to write this if the project wants it.

Swagger is an API documentation and testing tool that a lot of folks are using the industry right now. From a SQL injection perspective, it would be nice be able to read in the Swagger document (in .toml), and generate the URIs and their respective parameters to test.

[stamparm]

@alexk307 I am opened for this. If you can at least provide a decent template and a "howto" use it I could further adapt it

[stamparm]

@alexk307 ping?

[burtsevyg]

For example https://www.netsparker.com/blog/docs-and-faqs/vulnerability-scan-rest-api-web-service-automatic/

[stamparm]

Any example? Like, something to work with?

[alexk307]

@stamparm sorry for the delay, I was working on this before but got sidetracked. I'm going to try to write something up

[alexk307]

In the meantime, you can look at a sample Swagger schema that they provide here

[stamparm]

This whole issue can go into two tracks, as I am not sure whether @burtsevyg wanted sqlmap API (REST-JSON) to be "swagged" or for sqlmap to accept swag definition for some third party service.

Anyway, for starter I decided to work on "swagging" the sqlmap API (REST-JSON) interface. Later on I could work on the second option.

Will commit the initial version of swagger.yaml this moment

[benj56]

I think both asked for the ability to read their Swagger definition in order to scan their APIs, not a Swagger file for the sqlmap API.

It would be great if that was possible, I'm trying to use sqlmap that way and I suppose there are many companies that have their API definition in Swagger and are looking to test their API with sqlmap.

[rrjanbiah]

@benj56 Exactly, to rephrase, I think, we need something like below:

python sqlmap.py --swagger-uri https://petstore.swagger.io/v2/swagger.json

This switch should then parse given swagger spec and try to inject each and every API endpoints.

[stamparm]

@benj56 @rrjanbiah

A) how to provide parameter values in such case(s)? I bet that there would be new issues where users would complain about non-automatic sqlmap behavior in filling values
B) YAML or JSON? Swagger itself is not clear with a format nor standard. Deprecations and format changes are everywhere
C) I could implement (e.g.) support for JSON up to some point, but, there are some really complex cases to cover. Not sure if worth the trouble