owasp / offat

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.

OWASP OFFAT

OWASP OFFAT (OFFensive Api Tester) is created to automatically test API for common vulnerabilities after generating tests from openapi specification file. It provides feature to automatically fuzz inputs and use user provided inputs during tests specified via YAML config file.

Demo

Note: The columns for 'data_leak' and 'result' in the table represent independent aspects. It's possible for there to be a data leak in the endpoint, yet the result for that endpoint may still be marked as 'Success'. This is because the 'result' column doesn't necessarily reflect the overall test result; it may indicate success even in the presence of a data leak.

Security Checks

• Restricted HTTP Methods
• SQLi
• BOLA
• Data Exposure
• BOPLA / Mass Assignment
• Broken Access Control
• Basic Command Injection
• Basic XSS/HTML Injection test

Features

• Few Security Checks from OWASP API Top 10
• Automated Testing
• User Config Based Testing
• API for Automating tests and Integrating Tool with other platforms/tools
• CLI tool
• Dockerized Project for Easy Usage
• Open Source Tool with MIT License

Try Tool

• Install Tool using pip

python -m pip install offat

• Run Tool

offat -f swagger_file.json

• For more usage options read README.md

offat's Issues

[feature] capability to set Host and port , and even basePath

Hello

given than an OAS spec can be used in various implementation ( dev , uat, prod)
the server section is not always accurate

it would be great to be able to override the setting with a command like this

offat -f .\openapi.yml http://myHost:myPort/myPath

notice it is not as same as setting a proxy

this use case it taken into consideration for tooling such as prism or vaccum

Host/Server Parsing Bug leading to scan crash

          Hi @dmdhrumilmistry . As per your suggestion I have tried using offat with Python 3.11. But Unfortunately I am getting the same error:

Originally posted by @puriaayush01 in #45 (comment)

Install Error

Hello. I made the recommended command for installing Tools, but this error returns and does not complete the installation. Has anyone here ever been through this situation?

Semaphore-Lock-Bug

This is raised when rate limit options are being used.

2023-10-28 14:02:10,820 - offat.tester.tester_utils - INFO - Checking for SQLi vulnerability: (tester_utils.py:76)
Traceback (most recent call last):
  File "/Users/apple/repos/OWASP/OFFAT/.venv/bin/offat", line 6, in <module>
    sys.exit(start())
             ^^^^^^^
  File "/Users/apple/repos/OWASP/OFFAT/src/offat/__main__.py", line 69, in start
    generate_and_run_tests(
  File "/Users/apple/repos/OWASP/OFFAT/src/offat/tester/tester_utils.py", line 78, in generate_and_run_tests
    results += run_test(test_runner=test_runner, tests=sqli_fuzz_tests, regex_pattern=regex_pattern)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/apple/repos/OWASP/OFFAT/src/offat/tester/tester_utils.py", line 36, in run_test
    test_results = run(test_runner.run_tests(tests))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/apple/.pyenv/versions/3.11.3/lib/python3.11/asyncio/runners.py", line 190, in run
    return runner.run(main)
           ^^^^^^^^^^^^^^^^
  File "/Users/apple/.pyenv/versions/3.11.3/lib/python3.11/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/apple/.pyenv/versions/3.11.3/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/Users/apple/repos/OWASP/OFFAT/src/offat/tester/test_runner.py", line 119, in run_tests
    return await gather(*tasks)
           ^^^^^^^^^^^^^^^^^^^^
  File "/Users/apple/repos/OWASP/OFFAT/src/offat/tester/test_runner.py", line 89, in send_request
    response = await self._client.request(url=url, method=http_method, *args, **kwargs)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/apple/repos/OWASP/OFFAT/src/offat/http.py", line 128, in request
    async with self._semaphore:
  File "/Users/apple/.pyenv/versions/3.11.3/lib/python3.11/asyncio/locks.py", line 15, in __aenter__
    await self.acquire()
  File "/Users/apple/.pyenv/versions/3.11.3/lib/python3.11/asyncio/locks.py", line 379, in acquire
    fut = self._get_loop().create_future()
          ^^^^^^^^^^^^^^^^
  File "/Users/apple/.pyenv/versions/3.11.3/lib/python3.11/asyncio/mixins.py", line 20, in _get_loop
    raise RuntimeError(f'{self!r} is bound to a different event loop')
RuntimeError: <asyncio.locks.Semaphore object at 0x1052ba790 [locked]> is bound to a different event loop
Unclosed client session

Feature : Output filter

as the tools generate a lot of test more than 3.6k in for my small use case
it might be interesting to log in the output file only the failure via a dedicated flag, this help focusing on what really matter

Installation fails on Ubuntu / venv

Recreate:

mkdir /tmp/test
cd /tmp/test
python3 -mvenv venv
source venv/bin/activate
pip3 install offat

Results in:

ERROR: Could not find a version that satisfies the requirement offat (from versions: none)
ERROR: No matching distribution found for offat

API Testing Error

I'm encountering an error whenever I attempt to test an API (which is an open-source API). However, when I utilize the following link (https://petstore.swagger.io/v2/swagger.json), the OFFAT Tool functions properly. Could you kindly assist me with resolving this issue?

Feature : Documentation

Documentation would requires more details for instance i got

1st lines indicate leak found ; yes but what can of leak ? , still the test passed successfully

2nd lines says Failed , but not a clear answer about why

having a 200 not clear why it is mentionned as suspicious ?

according to what i understood the datalleak is a parsing of sensitive data such as telephone as part of the returned payload ?
i got in mine for instance date, jwtToken, PhoneNumberIN, PhoneNumberUS
is that correct understanding ?

it is important to document here what the tooling is doing