.. image:: http://governance.openstack.org/badges/syntribos.svg :target: http://governance.openstack.org/reference/tags/index.html
.. image:: http://img.shields.io/badge/docs-latest-brightgreen.svg?style=flat :target: http://docs.openstack.org/developer/syntribos/
.. image:: http://img.shields.io/pypi/v/syntribos.svg :target: http://pypi.python.org/pypi/syntribos/
.. image:: http://img.shields.io/pypi/pyversions/syntribos.svg :target: http://pypi.python.org/pypi/syntribos/
.. image:: http://img.shields.io/pypi/wheel/syntribos.svg :target: http://pypi.python.org/pypi/syntribos/
.. image:: http://img.shields.io/irc/%23openstack-security.png :target: http://webchat.freenode.net/?channels=openstack-security
Syntribos 是一个开源自动化 API 安全测试工具，由 OpenStack 安全项目 <https://wiki.openstack.org/wiki/Security>_ 的成员维护。
给定一个简单的配置文件和示例 HTTP 请求，syntribos 可以用一组给定的字符串替换任何 API URL、URL 参数、HTTP 头和请求体字段。Syntribos 自动遍历请求中的每个位置。Syntribos 旨在自动检测常见安全缺陷，如 SQL注入、LDAP注入、缓冲区溢出等。此外，syntribos 还可用于通过自动模糊测试帮助识别新的安全缺陷。
Syntribos 能够测试任何 API，但特别针对 OpenStack <https://www.openstack.org/>__ 应用进行了设计。
测试列表~~~~~~~~~~~~~
With syntribos, you can initiate automated testing of any API with minimal configuration effort. Syntribos is ideal for testing the OpenStack API as it will help you in automatically downloading a set of templates of some of the bigger OpenStack projects like nova, neutron, keystone, etc.
A short list of tests that can be run using syntribos is given below:
Buffer overflow_ attacks, in the context of a web application,
force an application to handle more data than it can hold in a buffer.
In syntribos, a buffer overflow test is attempted by injecting a large
string into the body of an HTTP request.
Command injection_ attacks are done by injecting arbitrary commands in an
attempt to execute these commands on a remote system. In syntribos, this is
achieved by injecting a set of strings that have been proven as successful
executors of injection attacks.
CORS wildcard_ tests are used to verify if a web server allows cross-domain
resource sharing from any external URL (wild carding of
Access-Control-Allow-Origin header), rather than a white list of URLs.
Integer overflow_ tests in syntribos attempt to inject numeric values that
the remote application may fail to represent within its storage. For example,
injecting a 64 bit number into a 32 bit integer type.
Syntribos attempts LDAP injection_ attacks by injecting LDAP statements
into HTTP requests; if an application fails to properly sanitize the
request content, it may be possible to execute arbitrary commands.
SQL injection_ attacks are one of the most common web application attacks.
If the user input is not properly sanitized, it is fairly easy to
execute SQL queries that may result in an attacker reading sensitive
information or gaining control of the SQL server. In syntribos,
an application is tested for SQL injection vulnerabilities by injecting
SQL strings into the HTTP request.
Some string patterns are not sanitized effectively by the input validator and may cause the application to crash. String validation attacks in syntribos try to exploit this by inputting characters that may cause string validation vulnerabilities. For example, special unicode characters, emojis, etc.
XML external entity_ attacks target the web application's XML parser.
If an XML parser allows processing of external entities referenced in an
XML document then an attacker might be able to cause a denial of service,
or leakage of information, etc. Syntribos tries to inject a few malicious
strings into an XML body while sending requests to an application in an
attempt to obtain an appropriate response.
XSS_ attacks inject malicious JavaScript into a web
application. Syntribos tries to find potential XSS issues by injecting
string containing "script" and other HTML tags into request fields.
ReDoS_ attacks attempt to produce a denial of service by
providing a regular expression that takes a very long time to evaluate.
This can cause the regex engine to backtrack indefinitely, which can
slow down some parsers or even cause a processing halt. The attack
exploits the fact that most regular expression implementations have
an exponential time worst case complexity.
There is a possibility that the JSON parser will reach depth limit and crash, resulting in a successful overflow of the JSON parsers depth limit, leading to a DoS vulnerability. Syntribos tries to check for this, and raises an issue if the parser crashes.
This test gives users the ability to fuzz using user defined fuzz data and
provides an option to look for failure strings provided by the user. The fuzz
data needs to be provided using the config option [user_defined].
Example::
[user_defined] payload=<payload_file> failure_strings=<[list_of_failure_strings] # optional
Other than these built-in tests, you can extend syntribos by writing
your own custom tests. To do this, download the source code and look at
the tests in the syntribos/tests directory. The CORS test may be an easy
one to emulate. In the same way, you can also add different extensions
to the tests. To see how extensions can be written please see the
syntribos/extensions directory.
.. _buffer overflow: https://en.wikipedia.org/wiki/Buffer_overflow .. _Command injection: https://www.owasp.org/index.php/Command_Injection .. _CORS wildcard: https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007) .. _Integer overflow: https://en.wikipedia.org/wiki/Integer_overflow .. _LDAP injection: https://www.owasp.org/index.php/LDAP_injection .. _SQL injection: https://www.owasp.org/index.php/SQL_Injection .. _XML external entity: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing .. _XSS: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) .. _ReDoS: https://en.wikipedia.org/wiki/ReDoS
Details
Documentation_Apache license_Launchpad project_Blueprints_Bugs_Source code_Supported Operating Systems
Syntribos 主要是在 Linux 和 Mac 环境中开发的，可运行于大多数基于 Unix 和 Linux 的操作系统。目前我们暂不支持 Windows，但未来可能会改变这一情况。
.. _Documentation: https://docs.openstack.org/developer/syntribos/
.. _Apache license: https://github.com/openstack/syntribos/blob/master/LICENSE
.. _Launchpad project: https://launchpad.net/syntribos
.. _Blueprints: https://blueprints.launchpad.net/syntribos
.. _Bugs: https://bugs.launchpad.net/syntribos
.. _Source code: https://github.com/openstack/syntribos
============
安装
============
Syntribos 可以直接通过 `pypi 与 pip <https://pypi.python.org/pypi/pip>`__ 安装。
::
pip install syntribos
如需获取最新版本，请通过 `pip <https://pypi.python.org/pypi/pip>`__ 从 `源码 <https://www.github.com/openstack/syntribos.git>`__ 安装 syntribos。
克隆仓库::
$ git clone https://github.com/openstack/syntribos.git
进入克隆后的仓库目录并使用 pip 安装::
$ cd syntribos
$ pip install .
======================================
初始化 syntribos 环境
======================================