3

I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only (possible) duplicate I found is one here and here. Additionally, first question is pointed up to Apache and .htaccess (rewrite rule to hide file extension). The second question is more pointed to doing direct SQL injection to a specific rest-styled website and not gathering URLs behind it.

My question:

Is there any way an attacker may find out what is behind REST-style URLs? For example, SWIM have a user "eg", located in database, which he query from mode.php. After query is done, the page print "eg" on website.

http://example.com/mode.php?user=eg

SWIM CMS use REST-style technique and while user is browsing SWIMs website, user can't see the parameters nor file which is being proceed. An example is shown below.

http://example.com/mode/user/eg

Is there a way an attacker may find out what is hiding behind /mode/user/eg and by that chance try to exploit web-application using either injection or any type of attack. For example, if he founds out that the real URL is as in first example where parameter and it's value are visible, he may try doing SQL injection.

References:
*http://en.wikipedia.org/wiki/Representational_state_transfer
http://en.wikipedia.org/wiki/SQL_injection
SWIM = Someone who isn't me

Improve this question

2 Answers 2

Reset to default
3

The use of a REST style URL is unlikely to deter an attacker as it is a relatively well known development pattern these days with a number of popular frameworks using it.

When I'm testing REST based apps (usually pretty easy to spot due to the URL format) I'd always fuzz the URL paths (so, eg, user and mode) in this example as it's expected that they're going to be transformed in someway server-side.

Tools like burp have specific options which can be set on their scanning engines to target REST style apps.

From the BURP Help File

REST-style URL parameters - The values of all directory and filename tokens within the file path portion of the URL. Testing each of these insertion points can impose a significant overhead and should only be used if you believe the application is using these locations to transmit parameter data.

Improve this answer
1
  • One of the sector in company I work use Burp thus I'm not familiar with it, my colleagues are, I'll try to ask them about testing REST-styled URLs.
    – sensation
    Sep 12, 2013 at 14:03
2

Is there a way an attacker may find out what is hiding behind /mode/user/eg

if you know the webapp used, then yes. otherwise, probably no. you could try to guess if this is a php/rails/whatever - based app for php-bases apps this works 90% of the time, due to default-setups:

if you KNOW it is PHP and find both of the above NOT working, than your counterpart at least thinks about what they are doing.

RAILS/:your_favourite_app_server_here delivers, if not suppressed, often a custom X-Powered-By - header, indicating which http-server is used, e.g WEBRick, Passenger etc. but these are easy to suppress.

another way would be to check where (url) the static resources are coming from; this could be a hint on which technology is used.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .