Checking Security Properties of Cloud Service REST APIs

Atlidakis, Vaggelis; Godefroid, Patrice; Polishchuk, Marina

doi:10.1109/icst46399.2020.00046

Cited by 43 publications

(27 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• 200 OK responses must have a non-empty body [4] • GET fails after unsuccessful POST (resource-leak rule) [4] In addition to input structure, API schemas document the expected content and structure of API responses and the relationship between endpoints. OpenAPI schemas extend HTTP semantics to include further schema-specific testable properties, including:…”

Section: Standards Imply Semantic Propertiesmentioning

confidence: 99%

“…• Response has undeclared status code • Non-conforming requests are rejected (negative testing) [30] • No information leaks from unauthorised requests [4,20] Information disclosure vulnerabilities such as insecure direct object references can be detected by making two sequences of requests.…”

Section: Standards Imply Semantic Propertiesmentioning

confidence: 99%

“…RESTler [3,4] is a security testing tool in the tradition of greybox fuzzing, which infers dependencies between request types, generates sequences of requests satisfying those dependencies, and learns to predict sequence validity based on the responses to these test sequences. Their evaluation finds that all these features are required for effective testing of web APIs.…”

Section: Prior Art In Schema-based Web Api Fuzzingmentioning

confidence: 99%

“…such as RAML, WSDL, or API Blueprint4 Schemathesis seems to be the only fuzzer to check if required headers are missing 5. A property relating multiple input-output pairs is known as a metamorphic relation [25].…”

mentioning

confidence: 99%

See 3 more Smart Citations

Deriving Semantics-Aware Fuzzers from Web API Schemas

Hatfield-Dodds¹,

Dygalo²

2021

Preprint

View full text Add to dashboard Cite

Fuzzing-whether generating or mutating inputs-has found many bugs and security vulnerabilities in a wide range of domains. Stateful and highly structured web APIs present significant challenges to traditional fuzzing techniques, as execution feedback is usually limited to a response code instead of code coverage and vulnerabilities of interest include silent information-disclosure in addition to explicit errors.Our tool, Schemathesis, derives structure-and semantics-aware fuzzers from web API schemas in the OpenAPI or GraphQL formats, using property-based testing tools [23]. Derived fuzzers can be incorporated into unit-test suites or run directly, with or without end-user customisation of data generation and semantic checks.We construct the most comprehensive evaluation of web API fuzzers to date, running eight fuzzers against sixteen real-world open source web services. OpenAPI schemas found in the wild have a long tail of rare features and complex structures. Of the tools we evaluated, Schemathesis was the only one to handle more than two-thirds of our target services without a fatal internal error. Schemathesis finds 1.4× to 4.5× more unique defects than the respectively second-best fuzzer for each target, and is the only fuzzer to find defects in four targets.1 https://hypothesis.works/articles/what-is-property-based-testing/ 2 Most PBT libraries call their description of possible values "generators". Because generators are a builtin type in Python, Hypothesis instead names them "strategies".

show abstract

Section: Standards Imply Semantic Propertiesmentioning

confidence: 99%

Section: Standards Imply Semantic Propertiesmentioning

confidence: 99%

Section: Prior Art In Schema-based Web Api Fuzzingmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Deriving Semantics-Aware Fuzzers from Web API Schemas

Hatfield-Dodds¹,

Dygalo²

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Automated testing of RESTful web APIs is an active research topic [5]- [10]. Most techniques in the domain follow a black-box approach, where the specification of the API under test (e.g., an OAS document) is used to drive the generation of test cases [6]- [8], [10]. Essentially, these approaches exercise the API using (pseudo) random test data.…”

Section: Introductionmentioning

confidence: 99%

Deep Learning-Based Prediction of Test Input Validity for RESTful APIs

Mirabella

Martin-Lopez

Segura

et al. 2021

2021 IEEE/ACM Third International Workshop on Deep Learning for Testing and Testing for Deep Learning (DeepTest)

View full text Add to dashboard Cite

Automated test case generation for RESTful web APIs is a thriving research topic due to their key role in software integration. Most approaches in this domain follow a blackbox approach, where test cases are randomly derived from the API specification. These techniques show promising results, but they neglect constraints among input parameters (so-called interparameter dependencies), as these cannot be formally described in current API specification languages. As a result, when testing real-world services, most random test cases tend to be invalid since they violate some of the inter-parameter dependencies of the service, making human intervention indispensable. In this paper, we propose a deep learning-based approach for automatically predicting the validity of an API request (i.e., test input) before calling the actual API. The model is trained with the API requests and responses collected during the generation and execution of previous test cases. Preliminary results with five real-world RESTful APIs and 16K automatically generated test cases show that test inputs validity can be predicted with an accuracy ranging from 86% to 100% in APIs like Yelp, GitHub, and YouTube. These are encouraging results that show the potential of artificial intelligence to improve current test case generation techniques.Index Terms-RESTful web API, web services testing, artificial neural network

show abstract

Automated black‐box testing of nominal and error scenarios in RESTful APIs

Corradini

Zampieri

Pasqua

et al. 2022

Software Testing Verif & Rel

View full text Add to dashboard Cite

RESTful APIs (or REST APIs for short) represent a mainstream approach to design and develop web APIs using the REpresentational State Transfer architectural style. Black-box testing, which assumes only the access to the system under test with a specific interface, is the only viable option when white-box testing is impracticable. This is the case for REST APIs: their source code is usually not (or just partially) available, or a white-box analysis across many dynamically allocated distributed components (typical of a microservices architecture) is computationally challenging. This paper presents RESTTESTGEN, a novel black-box approach to automatically generate test cases for REST APIs, based on their interface definition (an OpenAPI specification). Input values and requests are generated for each operation of the API under test with the twofold objective of testing nominal execution scenarios and error scenarios. Two distinct oracles are deployed to detect when test cases reveal implementation defects. While this approach is mainly targeting the research community, it is also of interest to developers because, as a black-box approach, it is universally applicable across different programming languages, or in the case external (compiled only) libraries are used in a REST API. The validation of our approach has been performed on more than 100 of realworld REST APIs, highlighting the effectiveness of the approach in revealing actual faults in already deployed services. K E Y W O R D S automatic test case generation, black-box testing, REST APIs, test oracle | INTRODUCTIONREST APIs are the de-facto standard to implement and grant remote access to web APIs. They are so largely accepted and adopted that the Berlin Group Initiative 1 elaborated a standard based on REST APIs for unifying the European Banking APIs. This initiative was meant to address the PSD2 European Union directive 2 that requested banks to open their customer data to authorized third-party service providers. Moreover, reference implementations of PSD2 compliant banking APIs are mostly available in the form of REST APIs. 3 REST APIs are often components of micro-services architectures [1], according to which, each component should be small and assigned just one (or very few) responsibilities, resulting in a high number of simple components. Distinct components are usually deployed in different containers that can be dynamically allocated and deallocated, possibly across different hosts (for load balancing). 1 https://www.berlin-group.org/ 2 https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en 3 https://www.openbankproject.com/

show abstract

Checking Security Properties of Cloud Service REST APIs

Cited by 43 publications

References 7 publications

Deriving Semantics-Aware Fuzzers from Web API Schemas

Deriving Semantics-Aware Fuzzers from Web API Schemas

Deep Learning-Based Prediction of Test Input Validity for RESTful APIs

Automated black‐box testing of nominal and error scenarios in RESTful APIs

Contact Info

Product

Resources

About