{"action":"created","issue":{"url":"https://api.github.com/repos/andresriancho/w3af/issues/17315","repository_url":"https://api.github.com/repos/andresriancho/w3af","labels_url":"https://api.github.com/repos/andresriancho/w3af/issues/17315/labels{/name}","comments_url":"https://api.github.com/repos/andresriancho/w3af/issues/17315/comments","events_url":"https://api.github.com/repos/andresriancho/w3af/issues/17315/events","html_url":"https://github.com/andresriancho/w3af/issues/17315","id":369024079,"node_id":"MDU6SXNzdWUzNjkwMjQwNzk=","number":17315,"title":"Enhance the OpenAPI plugin to accept user-provided values for parameters","user":{"login":"artem-smotrakov","id":19523081,"node_id":"MDQ6VXNlcjE5NTIzMDgx","avatar_url":"https://avatars2.githubusercontent.com/u/19523081?v=4","gravatar_id":"","url":"https://api.github.com/users/artem-smotrakov","html_url":"https://github.com/artem-smotrakov","followers_url":"https://api.github.com/users/artem-smotrakov/followers","following_url":"https://api.github.com/users/artem-smotrakov/following{/other_user}","gists_url":"https://api.github.com/users/artem-smotrakov/gists{/gist_id}","starred_url":"https://api.github.com/users/artem-smotrakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/artem-smotrakov/subscriptions","organizations_url":"https://api.github.com/users/artem-smotrakov/orgs","repos_url":"https://api.github.com/users/artem-smotrakov/repos","events_url":"https://api.github.com/users/artem-smotrakov/events{/privacy}","received_events_url":"https://api.github.com/users/artem-smotrakov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-10-11T09:10:55Z","updated_at":"2018-10-16T14:30:56Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"While generating fuzzable requests for API endpoints, the OpenAPI plugin tries to find good values for the parameters which are accepted by the API endpoints. The plugin considers default values provided in the OpenAPI spec, or tries to guess the best value based on parameter name, type, format, etc. I think this is a very good approach for an initial scan but it may not be enough if we want to test an application a bit deeper. The problem is that there is not an easy way to let the plugin know about values it should use for testing. Let's consider the following API endpoint:\r\n\r\n```\r\npaths:\r\n  /users/{userId}:\r\n    post:\r\n      summary: Update user\r\n      parameters:\r\n        - in: path\r\n          name: userId\r\n          schema:\r\n            type: integer\r\n          required: true\r\n          description: Numeric ID of the user to get\r\n        - in: header\r\n          name: X-User-Name\r\n          schema:\r\n            type: string\r\n          required: true\r\n          description: User name\r\n```\r\n\r\nIn this case, the OpenAPI plugin creates a fuzzable request which assigns some pre-defined number (for example, 42) to `userId` and some pre-defined string to `X-User-Name`. The plugin tries its best when guessing valid values, but it has no idea about the actual context. When w3af tries to fuzz `X-User-Name`, it will send requests to `/users/42`. Most probably the requests will be rejected if no used exists with this ID. As a result, w3af won't actually test how the application processes the `X-User-Name` header.\r\n\r\nI would like to propose adding a way how a user can provide a list of valid values for specific parameters for API endpoints. Currently I don't see the plugin provides such a way. The feature would help to use w3af in a better and more efficient way for:\r\n\r\n- grey-box testing when a tester already has some knowledge about the application\r\n- regular testing applications in CI/CD\r\n\r\nThere are only a couple of workarounds which are not flexible:\r\n\r\n- use custom API spec which defines single default values\r\n- use `headers_file -> header_file` option to set pre-defined headers\r\n\r\nI think it would be much better if a user could provide a list of meaningful values for a particular parameter. Basically, a user needs to specify a mapping `{path, parameter_name} -> [ list of values ]`\r\n\r\nI can implement such a feature if it gets a positive feedback. Before opening a pull request, I'd like to agree on a way how a user can provide such values. I would add `parameter_values` option for the OpenAPI plugin. The option should contain a path to a file which contains `{path, parameter_name} -> [ list of values ]` mapping. The file may be in JSON, YAML or CSV format. I'd start with JSON or YAML.\r\n\r\nPlease let me know what you think."},"comment":{"url":"https://api.github.com/repos/andresriancho/w3af/issues/comments/430260359","html_url":"https://github.com/andresriancho/w3af/issues/17315#issuecomment-430260359","issue_url":"https://api.github.com/repos/andresriancho/w3af/issues/17315","id":430260359,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDI2MDM1OQ==","user":{"login":"andresriancho","id":865200,"node_id":"MDQ6VXNlcjg2NTIwMA==","avatar_url":"https://avatars0.githubusercontent.com/u/865200?v=4","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false},"created_at":"2018-10-16T14:30:56Z","updated_at":"2018-10-16T14:30:56Z","author_association":"OWNER","body":"> Another simple plugin which checks that a RESTful application returns 405 error for HTTP methods which are not defined in the API spec. Maybe w3af already has it.\r\n\r\nAgreed, this should be implemented.\r\n\r\nw3af doesn't have this already."}}
{"actor":{"display_login":"andresriancho"}}