0

I am testing a website that makes heavily use of REST API endpoints. After authentication, the app adds the authentication token as part of every request in the form of:

OPTIONS
https://www.target.com/api/Action/some-action?data=foobar&access_token=THISISTHETOKEN
User-Agent: ...
Accept: */*
..
Host: target.com
Length: 0

How can I force that every request (inside the spider, scanner, etc.) uses this predefined parameter such that I can browser authenticated?

Update:

I tried creating a Http Sender Script but I fail at modifying the http url parameters:

function sendingRequest(msg, initiator, helper) {
    var token = org.parosproxy.paros.network.HtmlParameter
    token.setType(org.parosproxy.paros.network.HtmlParameter.Type.url)
    token.setName('access_token')
    token.setValue('foo')
    print('token: ' + String(token))
    msg.getUrlParams().add(token)
    print(msg.getUrlParams())
}

2 Answers 2

3

You can setup a Replacer rule or create an Http Sender script.

For a Replacer rule select the type as "Request Header String" then set the regex as something like (http://example.org.*) and the replacement something like $1?myParamToAdd=someValue (Note this replacer example is untested.)

For an HttpSender script something like the following should work:

var URL_TYPE    = org.parosproxy.paros.network.HtmlParameter.Type.url;
var HtmlParameter = Java.type('org.parosproxy.paros.network.HtmlParameter');

var paramName = 'myParamToAdd';
var paramValue = 'someValuetoAdd';

function sendingRequest(msg, initiator, helper) {
  if (!msg.getRequestHeader().getURI().toString().contains(paramName + '=' + paramValue)) {
    //You might want to add a check here for the proper domain or path as well..
    var urlParams = msg.getUrlParams();
    var newParam = new HtmlParameter(URL_TYPE, paramName, paramValue);
    urlParams.add(newParam); // you could print this if you need to see what's up
    msg.setGetParams(urlParams);
  }
  return msg;
}

function responseReceived(msg, initiator, helper) {
  //Nothing to do here
}
1
  • I was having a look at the replacer but it only allows modifying the headers. I am now working at creating a Http Sender script but I fail at adding a Http Parameter. My current script: function sendingRequest(msg, initiator, helper) { var token = org.parosproxy.paros.network.HtmlParameter token.setType(org.parosproxy.paros.network.HtmlParameter.Type.url) token.setName('access_token') token.setValue('foo') print('token: ' + String(token)) msg.getUrlParams().add(token) } Mar 5, 2020 at 13:25
0

In the end the following HTTP Sender script worked for me:

var URL_TYPE   = org.parosproxy.paros.network.HtmlParameter.Type.url;
var authTokenName = 'access_token'
var authTokenValue = 'xrVNjdzmUomrpFcoyliUQYvfpgGPF5q8e2kCQNfhcs6pzO4yh22RACvSGNCeuMMg'

function sendingRequest(msg, initiator, helper) {
    var urlParams = msg.getUrlParams();
        // print ("Url Params before update: " + urlParams);
     var updatedUrlParams = modifyParams(urlParams);
     // print ("Url Params after update: " + updatedUrlParams);
     msg.setGetParams(updatedUrlParams);
}

function modifyParams(params) {
    var hasAccessToken = 0
    var iterator = params.iterator();
    while(iterator.hasNext()) {
        var param = iterator.next();
        // Check if the url parameters has the antiCsrfTokenName in it.
       //print('param:' + param.getName())
        if (param.getName().equals(authTokenName)) {
            var secureTokenValue = param.getValue();
          print('[i] auth:' + secureTokenValue)
            hasAccessToken = 1            
        }
    }
    if(hasAccessToken==0){
        print('[i] no token. Update query.')

        var HtmlParameter = Java.type('org.parosproxy.paros.network.HtmlParameter')
        var newParam = new HtmlParameter(URL_TYPE, authTokenName, authTokenValue);

        params.add(newParam) 
        print('[i] mod auth:' + params) 

    }

    return params;
}


function responseReceived(msg, initiator, helper) {
    // Debugging can be done using println like this
    //print('responseReceived called for url=' + msg.getRequestHeader().getURI().toString())
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.