openstack-archive/syntribosStrumento di test di sicurezza per API Python di OpenStack Security Group
.. image:: http://governance.openstack.org/badges/syntribos.svg :target: http://governance.openstack.org/reference/tags/index.html
.. image:: http://img.shields.io/badge/docs-latest-brightgreen.svg?style=flat :target: http://docs.openstack.org/developer/syntribos/
.. image:: http://img.shields.io/pypi/v/syntribos.svg :target: http://pypi.python.org/pypi/syntribos/
.. image:: http://img.shields.io/pypi/pyversions/syntribos.svg :target: http://pypi.python.org/pypi/syntribos/
.. image:: http://img.shields.io/pypi/wheel/syntribos.svg :target: http://pypi.python.org/pypi/syntribos/
.. image:: http://img.shields.io/irc/%23openstack-security.png :target: http://webchat.freenode.net/?channels=openstack-security
Syntribos è uno strumento open source automatizzato per il test di sicurezza delle API, mantenuto dai membri del Progetto di Sicurezza di OpenStack <https://wiki.openstack.org/wiki/Security>_.
Dati un semplice file di configurazione e una richiesta HTTP di esempio, syntribos può sostituire qualsiasi URL dell'API, parametro URL, intestazione HTTP e campo del corpo della richiesta con un dato insieme di stringhe. Syntribos itera automaticamente attraverso ogni posizione nella richiesta. L'obiettivo di syntribos è rilevare automaticamente difetti di sicurezza comuni come SQL injection, LDAP injection, buffer overflow, ecc. Inoltre, syntribos può essere utilizzato per aiutare a identificare nuovi difetti di sicurezza tramite fuzzing automatico.
Syntribos ha la capacità di testare qualsiasi API, ma è progettato pensando alle applicazioni OpenStack <https://www.openstack.org/>__.
Elenco dei test~~~~~~~~~~~~~
With syntribos, you can initiate automated testing of any API with minimal configuration effort. Syntribos is ideal for testing the OpenStack API as it will help you in automatically downloading a set of templates of some of the bigger OpenStack projects like nova, neutron, keystone, etc.
A short list of tests that can be run using syntribos is given below:
Buffer overflow_ attacks, in the context of a web application,
force an application to handle more data than it can hold in a buffer.
In syntribos, a buffer overflow test is attempted by injecting a large
string into the body of an HTTP request.
Command injection_ attacks are done by injecting arbitrary commands in an
attempt to execute these commands on a remote system. In syntribos, this is
achieved by injecting a set of strings that have been proven as successful
executors of injection attacks.
CORS wildcard_ tests are used to verify if a web server allows cross-domain
resource sharing from any external URL (wild carding of
Access-Control-Allow-Origin header), rather than a white list of URLs.
Integer overflow_ tests in syntribos attempt to inject numeric values that
the remote application may fail to represent within its storage. For example,
injecting a 64 bit number into a 32 bit integer type.
Syntribos attempts LDAP injection_ attacks by injecting LDAP statements
into HTTP requests; if an application fails to properly sanitize the
request content, it may be possible to execute arbitrary commands.
SQL injection_ attacks are one of the most common web application attacks.
If the user input is not properly sanitized, it is fairly easy to
execute SQL queries that may result in an attacker reading sensitive
information or gaining control of the SQL server. In syntribos,
an application is tested for SQL injection vulnerabilities by injecting
SQL strings into the HTTP request.
Some string patterns are not sanitized effectively by the input validator and may cause the application to crash. String validation attacks in syntribos try to exploit this by inputting characters that may cause string validation vulnerabilities. For example, special unicode characters, emojis, etc.
XML external entity_ attacks target the web application's XML parser.
If an XML parser allows processing of external entities referenced in an
XML document then an attacker might be able to cause a denial of service,
or leakage of information, etc. Syntribos tries to inject a few malicious
strings into an XML body while sending requests to an application in an
attempt to obtain an appropriate response.
XSS_ attacks inject malicious JavaScript into a web
application. Syntribos tries to find potential XSS issues by injecting
string containing "script" and other HTML tags into request fields.
ReDoS_ attacks attempt to produce a denial of service by
providing a regular expression that takes a very long time to evaluate.
This can cause the regex engine to backtrack indefinitely, which can
slow down some parsers or even cause a processing halt. The attack
exploits the fact that most regular expression implementations have
an exponential time worst case complexity.
There is a possibility that the JSON parser will reach depth limit and crash, resulting in a successful overflow of the JSON parsers depth limit, leading to a DoS vulnerability. Syntribos tries to check for this, and raises an issue if the parser crashes.
This test gives users the ability to fuzz using user defined fuzz data and
provides an option to look for failure strings provided by the user. The fuzz
data needs to be provided using the config option [user_defined].
Example::
[user_defined] payload=<payload_file> failure_strings=<[list_of_failure_strings] # optional
Other than these built-in tests, you can extend syntribos by writing
your own custom tests. To do this, download the source code and look at
the tests in the syntribos/tests directory. The CORS test may be an easy
one to emulate. In the same way, you can also add different extensions
to the tests. To see how extensions can be written please see the
syntribos/extensions directory.
.. _buffer overflow: https://en.wikipedia.org/wiki/Buffer_overflow .. _Command injection: https://www.owasp.org/index.php/Command_Injection .. _CORS wildcard: https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007) .. _Integer overflow: https://en.wikipedia.org/wiki/Integer_overflow .. _LDAP injection: https://www.owasp.org/index.php/LDAP_injection .. _SQL injection: https://www.owasp.org/index.php/SQL_Injection .. _XML external entity: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing .. _XSS: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) .. _ReDoS: https://en.wikipedia.org/wiki/ReDoS
Details
Documentation_Apache license_Launchpad project_Blueprints_Bugs_Source code_Supported Operating Systems
Syntribos è stato sviluppato principalmente in ambienti Linux e Mac e funziona sulla maggior parte dei sistemi operativi basati su Unix e Linux. Al momento, non supportiamo Windows, ma questo potrebbe cambiare in futuro.