Skip to content

Added web-api-pentest prototype #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andreashappe merged 13 commits into from
May 16, 2024
Merged

Added web-api-pentest prototype #47

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
a98973f
Added basic implementation of SimpleWebAPITesting and PromptEngineer
DianaStrauss May 3, 2024
a03ea2c
Updated basic implementation of SimpleWebAPITesting and PromptEngineer
DianaStrauss May 6, 2024
6a4d233
Added SimpleWebAPIDocumentation and updated SimpleWebAPITesting
DianaStrauss May 7, 2024
d123ab6
Simple openapi documentation procudes an openapi yaml specification
DianaStrauss May 15, 2024
12cfe19
Adjusted chain of thought prompt engineering for chain of thought to …
DianaStrauss May 15, 2024
868c9b9
changed max_turns back to 10
DianaStrauss May 15, 2024
fd6adcd
Merge remote-tracking branch 'upstream/main'
DianaStrauss May 15, 2024
9351a8d
Refined simple testing
DianaStrauss May 15, 2024
601d28f
Added documentation web-api-pentest.md
DianaStrauss May 15, 2024
9c59828
Added documentation of web-api-pentest
DianaStrauss May 15, 2024
5d1f7eb
Enhanced prompt for simple_web_api-testing.py
DianaStrauss May 15, 2024
84c2e7e
Merge branch 'ipa-lab:main' into main
DianaStrauss May 16, 2024
72de4a0
Added changes suggested by Code review
May 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,12 +49,12 @@ Our initial forays were focused upon evaluating the efficiency of LLMs for [linu
privilege escalation attacks](https://arxiv.org/abs/2310.11409) and we are currently breaching out into evaluation
the use of LLMs for web penetration-testing and web api testing.

| Name | Description | Screenshot |
| -- | -- | -- |
| minimal | A minimal 50 LoC Linux Priv-Esc example. This is the usecase from [Build your own Agent/Usecase](#build-your-own-agentusecase) | ![A very minimal run](docs/usecase_minimal.png) |
| [linux-privesc](docs/linux_privesc.md) | Given a SSH-connection for a low-privilege user, task the LLM to become the root user. This would be a typical Linux privilege escalation attack. We published two academic papers about this: [paper #1](https://arxiv.org/abs/2308.00121) and [paper #2](https://arxiv.org/abs/2310.11409) | ![Example wintermute run](docs/example_run_gpt4.png) |
| [web-pentest (WIP)](docs/web_page.md) | Directly hack a webpage. Currently in heavy development and pre-alpha stage. | ![Test Run for a simple Blog Page](docs/usecase_web_page_run.png) |
| web-api-pentest (WIP) | An Web-API focues usecase | |
| Name | Description | Screenshot |
|--------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
| minimal | A minimal 50 LoC Linux Priv-Esc example. This is the usecase from [Build your own Agent/Usecase](#build-your-own-agentusecase) | ![A very minimal run](docs/usecase_minimal.png) |
| [linux-privesc](docs/linux_privesc.md) | Given a SSH-connection for a low-privilege user, task the LLM to become the root user. This would be a typical Linux privilege escalation attack. We published two academic papers about this: [paper #1](https://arxiv.org/abs/2308.00121) and [paper #2](https://arxiv.org/abs/2310.11409) | ![Example wintermute run](docs/example_run_gpt4.png) |
| [web-pentest (WIP)](docs/web_page.md) | Directly hack a webpage. Currently in heavy development and pre-alpha stage. | ![Test Run for a simple Blog Page](docs/usecase_web_page_run.png) |
| [web-api-pentest (WIP)](docs/web_api_pentest.md) | Directly test a REST API. Currently in heavy development and pre-alpha stage. (Documentation and testing of REST API.) | Documentation:![web_api_documentation.png](docs%2Fold_runs%2Fweb_api_documentation.png) Testing:![web_api_testing.png](docs%2Fold_runs%2Fweb_api_testing.png) |

## Build your own Agent/Usecase

Expand Down
Binary file added docs/old_runs/web_api_documentation.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/old_runs/web_api_testing.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
22 changes: 22 additions & 0 deletions docs/web-api-pentest.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# UseCase: Web Page Hacking

The goal of this use-case is to explore REST API security. It is currently very much in the exploratory stage, but there are already very basic capabilities.

## Current features

- Employ different prompt strategies: Chain-of-thought, Tree-of-thought, in-context learning
- Do HTTP requests
- Allow configuration and submission of flags
- Take some notes (this is experimental, the idea is to make the LLM be more explicit about the things it finds)
- Create a OpenAPI specification of a provided URI

## Example run
This is a simple example run of the `simple_web_api_documenation` using GPT-3.5-turbo to test the REST API https://jsonplaceholder.typicode.com.
![web_api_documentation.png](..%2F..%2F..%2F..%2FPictures%2Fweb_api_documentation.png)

OpenAPI specifications that have been created with this can be found under [openapi_spec](../openapi_spec).

This is a simple example run of the `simple_web_api_testing` using GPT-3.5-turbo to test the REST API https://jsonplaceholder.typicode.com.
![web_api_testing.png](..%2F..%2F..%2F..%2FPictures%2Fweb_api_testing.png)


97 changes: 97 additions & 0 deletions openapi_spec/openapi_spec_2024-05-15 15:11:38.yaml
View file
Open in desktop
Copy link
Member

@andreashappe andreashappe May 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would move openapi_spec into the docs directory to make it clear, that this is just an example

Original file line number Diff line number Diff line change
@@ -0,0 +1,97 @@
info:
description: Automatically generated description of the API.
title: Generated API Documentation
version: '1.0'
openapi: 3.0.0
paths:
/albums:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /albums
/albums/1:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /albums/1
/comments:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /comments
/comments/1:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /comments/1
put:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: PUT operation on /comments/1
/posts:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /posts
/todos:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /todos
/todos/1:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /todos/1
/users:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /users
servers:
- url: https://jsonplaceholder.typicode.com
166 changes: 166 additions & 0 deletions openapi_spec/openapi_spec_2024-05-15 15:15:03.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,166 @@
info:
description: Automatically generated description of the API.
title: Generated API Documentation
version: '1.0'
openapi: 3.0.0
paths:
/albums:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /albums
/albums/1:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /albums/1
/comments:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /comments
/comments/1:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /comments/1
/photos:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /photos
/photos/1:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /photos/1
/posts:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /posts
/posts/1:
delete:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: DELETE operation on /posts/1
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /posts/1
put:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: PUT operation on /posts/1
/posts/1/comments:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /posts/1/comments
/todos:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /todos
/todos/1:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /todos/1
/users:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /users
/users/1:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /users/1
/users/1/albums:
get:
responses:
'200':
content:
application/json:
schema:
type: object
description: Successful response
summary: GET operation on /users/1/albums
servers:
- url: https://jsonplaceholder.typicode.com
Loading