Web Service (API) Security
Application Security Verification Standard 3.0.1
https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project
V2: Authentication Verification Requirements
2.29 Verify that secrets, API keys, and passwords are not included in the source code, or online source code repositories.
V8: Error handling and Logging Verification Requirements
8.7 Verify that the application does not log sensitive data as defined under local privacy laws or regulations, organizational sensitive data as defined by a risk assessment, or sensitive authentication data that could assist an attacker,including user’s session identifiers, passwords, hashes, or API tokens.
V11: HTTP Security Configuration Verification Requirements
11.6 Verify that all API responses contain X-Content-Type-Options: nosniff and Content-Disposition:attachment; filename="api.json" (or other appropriate filename for the content type)
V17: Mobile Verification Requirements
17.4 Verify that secret keys, API tokens, or passwords are dynamically generated in mobile applications.
V18: Web services Verification Requirements
18.1 Verify that the same encoding style is used between the client and the server.
18.2 Verify that access to administration and management functions within the Web Service Application is limited to web service administrators.
18.3 Verify that XML or JSON schema is in place and verified before accepting input.
18.4 Verify that all input is limited to an appropriate size limit.
18.5 Verify that SOAP based web services are compliant with Web Services-Interoperability (WS-I) Basic Profile at minimum. This essentially means TLS encryption.
18.6 Verify the use of session-based authentication and authorization. Avoid the use of static "API keys" and similar.
18.7 Verify that the REST service is protected from Cross-Site Request Forgery via the use of at least one or more of the following: ORIGIN checks, double submit cookie pattern, CSRF nonces, and referrer checks.
18.8 Verify the REST service explicitly check the incoming Content-Type to be the expected one, such as application/xml or application/json.
18.9 Verify that the message payload is signed to ensure reliable transport between client and service, using JSON Web Signing or WS-Security for SOAP requests.
18.10 Verify that alternative and less secure access paths do not exist.
JSON Web Token (JWT)
Obtain JSON Web Token (JWT) class file:https://github.com/rmcdaniel/angular-codeigniter-seed/blob/master/api/application/helpers/jwt_helper.php
 |
| By default, HS256 Algorithm is used in jwt_helper.php |
<?php
require 'jwt_helper.php';
$requestMethod = $_SERVER["REQUEST_METHOD"];
$action = $_GET["action"];
if($requestMethod == "POST"){
header("HTTP/1.1 200");
$payload = "JWT Implementation";
$response['token'] = JWT::encode($payload, '91831');
$json_response = json_encode($response);
echo $json_response;
}
?>Advanced REST Client (ARC)
https://install.advancedrestclient.com |
| ARC is used to send request to API |
JWT Decoder
 |
| Invalid Signature due to incorrect secret key |
Simple HS256 JWT Token Brute Force Cracker
https://lmammino.github.io/jwt-cracker/
SOAP (Simple Object Access Protocol)
SOAP Server
PHP.inialways_populate_raw_post_data = -1PHP Source Code
<?php
require_once('nusoap-0.9.5/lib/nusoap.php');
$server = new soap_server();
$server->configureWSDL('User Management Gateway', 'urn:usrmgmt'); // Initialize WSDL support
$server->register( 'createUser', // method name
array('username' => 'xsd:string'), // input parameters
array('return' => 'xsd:xml'), // output parameters
'urn:usrmgmt', // namespace
'urn:usrmgmt#createUser', // soapaction
'rpc', // style
'encoded', // use
'To create a user account.' // documentation
);
function createUser($username) {
return '<account status="Account '.$username.' is created."></account>';
}
@$server->service(file_get_contents("php://input"));
?>
WSDL (Web Services Description Language)
SOAP Communication
 |
| Request |
 |
| Response |
