System and method for protected proxy design for dynamic API scanning service
Described herein are systems and methods that provide a mechanism to proxy and protect HyperText Transport Protocol/Transport Layer Security (HTTP/TLS) redirection attempts. This technique mirrors an intended target request with a new request, never forwarding the original request from the scanner. This action provides protection to the end target as only key elements of the HTTP request are used while crafting a new HTTP request.
1. A system for a protected proxy for a dynamic API scanning service, comprising:
a computer comprising one or more microprocessors;
a cloud-based infrastructure provided at the computer, the cloud-based infrastructure comprising an autonomous transaction processing (ATP) database service and a redirect service, the redirect service comprising a router service, one or more redirect tables, and a domain name system (DNS) service;
a user portal; and
a database store;
wherein the ATP database service receives a scan project request, the scan project request being targeted to an endpoint of a client resource;
wherein the ATP database service starts one or more containerized application programming interface (API) scanners targeted to a unique identifier created by the redirect service; and
wherein the redirect service generates mirrors of one or more requests from the one or more containerized API scanners, the mirrors being sent to the target endpoint.
2. The system of claim 1 , wherein the scan project request comprises one or more authentication tokens.
3. The system of claim 2 ,
wherein the redirect service utilizes the one or more redirect tables in creating the unique identifier.
4. The system of claim 3 ,
wherein the router service of the redirect service utilizes a default gateway for sending the mirrors to the target endpoint.
5. The system of claim 4 ;
wherein responses to the mirrors sent to the target endpoint are received at the default gateway of the redirect service; and
wherein upon the responses being received at the default gateway of the redirect service, the responses are forwarded to the scan project request, wherein said scan project request is kept open during by the ATP database service.
6. The system of claim 1 ,
wherein generating the mirrors of the one or more requests from the one or more containerized API scanners comprises
copying key headers of the one or more requests from the one or more containerized API scanners to the mirrors; and
copying body data of the one or more requests from the one or more containerized API scanners to the mirrors.
7. A method for a protected proxy for a dynamic API scanning service, comprising:
providing, at a computer comprising a microprocessor and a memory, a cloud-based infrastructure comprising an autonomous transaction processing (ATP) database service and a redirect service, the redirect service comprising a router service, one or more redirect tables, and a domain name system (DNS) service;
providing a user portal;
providing a database store;
receiving, at the ATP database service, a scan project request, the scan project request being targeted to an endpoint of a client resource;
starting, by the ATP database service, one or more containerized application programming interface (API) scanners targeted to a unique identifier created by the redirect service; and
generating, by the redirect service, mirrors of one or more requests from the one or more containerized API scanners, the mirrors being sent to the target endpoint.
8. The method of claim 7 ,
wherein the scan project request comprises one or more authentication tokens.
9. The method of claim 8
wherein the redirect service utilizes the one or more redirect tables in creating the unique identifier.
10. The method of claim 9 ,
wherein the router service of the redirect service utilizes a default gateway for sending the mirrors to the target endpoint.
11. The method of claim 10 ;
wherein responses to the mirrors sent to the target endpoint are received at the default gateway of the redirect service; and
wherein upon the responses being received at the default gateway of the redirect service, the responses are forwarded to the scan project request, wherein said scan project request is kept open during by the ATP database service.
12. The method of claim 7 ,
wherein generating the mirrors of the one or more requests from the one or more containerized API scanners comprises
copying key headers of the one or more requests from the one or more containerized API scanners to the mirrors; and
copying body data of the one or more requests from the one or more containerized API scanners to the mirrors.
13. A non-transitory computer readable storage medium having instructions thereon for a protected proxy for a dynamic API scanning service, which when read and executed by a computer cause the computer to perform steps comprising:
providing, at a computer comprising a microprocessor and a memory, a cloud-based infrastructure comprising an autonomous transaction processing (ATP) database service and a redirect service, the redirect service comprising a router service, one or more redirect tables, and a domain name system (DNS) service;
providing a user portal;
providing a database store;
receiving, at the ATP database service, a scan project request, the scan project request being targeted to an endpoint of a client resource;
starting, by the ATP database service, one or more containerized application programming interface (API) scanners targeted to a unique identifier created by the redirect service; and
generating, by the redirect service, mirrors of one or more requests from the one or more containerized API scanners, the mirrors being sent to the target endpoint.
14. The non-transitory computer readable storage medium having of claim 13 ,
wherein the scan project request comprises one or more authentication tokens.
15. The non-transitory computer readable storage medium having of claim 14 ,
wherein the redirect service utilizes the one or more redirect tables in creating the unique identifier.
16. The non-transitory computer readable storage medium having of claim 15 ,
wherein the router service of the redirect service utilizes a default gateway for sending the mirrors to the target endpoint.
17. The non-transitory computer readable storage medium having of claim 16 ,
wherein responses to the mirrors sent to the target endpoint are received at the default gateway of the redirect service; and
wherein upon the responses being received at the default gateway of the redirect service, the responses are forwarded to the scan project request, wherein said scan project request is kept open during by the ATP database service.