Application security testing based on live traffic
Live and legitimate user traffic is used with in depth knowledge of the business logic for an API specification to perform security testing on a set of APIs. The present system intercepts and analyzes application program interface (API) traffic, identifies user session data, and identifies traffic suitable to duplicate. The identified traffic is duplicated and modified by addition of malicious code. The modified code is then sent to its intended API destination, where it is processed as normal. The resulting response and other traffic as well as the API system and optionally other systems, such as datastore systems, are analyzed to determine if the malicious code resulted in a valid attack. Results from the modified code attack attempts are reported to a user.
1. A method for testing application security, comprising:
accessing intercepted application program interface (API) traffic transmitted between a client device and a server;
identifying a subset of the intercepted traffic to duplicate, the subset selected based on parsing the intercepted traffic;
duplicating the subset of intercepted traffic;
modifying the duplication of the subset of intercepted traffic, the modification including transforming the duplicated traffic to include malicious code;
transmitting the modified duplicate traffic to the server; and
detecting whether the modified duplicate traffic resulted in a successful attack event on the server.
2. The method of claim 1 , wherein the subset is identified based on a user identifier, user role, or session identifier.
3. The method of claim 1 , wherein each API in the subset is duplicated a number of times based at least in part on the number of parameters in the particular API.
4. The method of claim 1 , wherein each API in the subset is duplicated a number of times based at least in part on the number of possible values for the particular API.
5. The method of claim 1 , wherein modifying includes changing a parameter value in an API request.
6. The method of claim 5 , wherein the parameter is changed to have a value associated with a different user identifier.
7. The method of claim 5 , wherein each request in the duplicated traffic is transmitted with a single changed parameter.
8. The method of claim 1 , wherein the duplicated traffic is transmitted to the server within a time associated with a user session that includes the subset of the intercepted traffic that is duplicated.
9. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for testing application security, the method comprising:
accessing intercepted application program interface (API) traffic transmitted between a client device and a server;
identifying a subset of the intercepted traffic to duplicate, the subset selected based on parsing the intercepted traffic;
duplicating the subset of intercepted traffic;
modifying the duplication of the subset of intercepted traffic, the modification including transforming the duplicated traffic to include malicious code;
transmitting the modified duplicate traffic to the server; and
detecting whether the modified duplicate traffic resulted in a successful attack event on the server.
10. The non-transitory computer readable storage medium of claim 9 , wherein the subset is identified based on a user identifier, user role, or session identifier.
11. The non-transitory computer readable storage medium of claim 9 , wherein each API in the subset is duplicated a number of times based at least in part on the number of parameters in the particular API.
12. The non-transitory computer readable storage medium of claim 9 , wherein each API in the subset is duplicated a number of times based at least in part on the number of possible values for the particular API.
13. The non-transitory computer readable storage medium of claim 9 , wherein modifying includes changing a parameter value in an API request.
14. The non-transitory computer readable storage medium of claim 13 , wherein the parameter is changed to have a value associated with a different user identifier.
15. The non-transitory computer readable storage medium of claim 13 , wherein each request in the duplicated traffic is transmitted with a single changed parameter.
16. The non-transitory computer readable storage medium of claim 9 , wherein the duplicated traffic is transmitted to the server within a time associated with a user session that includes the subset of the intercepted traffic that is duplicated.
17. A system for automatically forecasting values for system metric time series, comprising:
a server including a memory and a processor; and
one or more modules stored in the memory and executed by the processor to access intercepted application program interface(API) traffic transmitted between a client device and a server, identify a subset of the intercepted traffic to duplicate, the subset selected based on parsing the intercepted traffic, duplicate the subset of intercepted traffic, modify the duplication of the subset of intercepted traffic, the modification including transforming the duplicated traffic to include malicious code, transmit the modified duplicate traffic to the server, and detect whether the modified duplicate traffic resulted in a successful attack event on the server.
18. The system of claim 17 , wherein the subset is identified based on a user identifier, user role, or session identifier.
19. The system of claim 17 , wherein each API in the subset is duplicated a number of times based at least in part on the number of parameters in the particular API.
20. The system of claim 17 , wherein each API in the subset is duplicated a number of times based at least in part on the number of possible values for the particular API.