{"id":5413,"date":"2020-02-27T00:36:00","date_gmt":"2020-02-26T16:36:00","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=5413"},"modified":"2020-02-27T00:36:28","modified_gmt":"2020-02-26T16:36:28","slug":"astra-api-automated-security-testing-for-rest","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2020\/02\/astra-api-automated-security-testing-for-rest\/","title":{"rendered":"Astra &#8211; API Automated Security Testing For REST"},"content":{"rendered":"<p>Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Astra-API-Automated-Security-Testing-For-REST-640x345.png\" alt=\"Astra - API Automated Security Testing For REST\" width=\"640\" height=\"345\" class=\"aligncenter size-medium wp-image-5415\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Astra-API-Automated-Security-Testing-For-REST-640x345.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Astra-API-Automated-Security-Testing-For-REST-1024x552.png 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Astra-API-Automated-Security-Testing-For-REST-1536x827.png 1536w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Astra-API-Automated-Security-Testing-For-REST-2048x1103.png 2048w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can automatically detect and test login &#038; logout (Authentication API), so it&#8217;s easy for anyone to integrate this into CI\/CD pipeline.<\/p>\n<p>Astra can take API collection as an input so this can also be used for testing apis in standalone mode, it looks for the following issues:<\/p>\n<ul>\n<li>SQL injection<\/li>\n<li>Cross site scripting<\/li>\n<li>Information Leakage<\/li>\n<li>Broken Authentication and session management<\/li>\n<li>CSRF (including Blind CSRF)<\/li>\n<li>Rate limit<\/li>\n<li>CORS misconfiguration (including CORS bypass techniques)<\/li>\n<li>JWT attack<\/li>\n<li>CRLF detection<\/li>\n<li>Blind XXE injection<\/li>\n<\/ul>\n<h2>Using Astra for API Automated Security Testing<\/h2>\n<pre>$ python astra.py --help\r\n\r\n                      _\r\n        \/\\       | |\r\n       \/  \\   ___| |_ _ __ __ _\r\n      \/ \/\\ \\ \/ __| __| '__\/ _` |\r\n     \/ ____ \\__ \\ |_| | | (_| |\r\n    \/_\/    \\_\\___\/\\__|_|  \\__,_|\r\n\r\n\r\n\r\nusage: astra.py [-h] [-c {Postman,Swagger}] [-n COLLECTION_NAME] [-u URL]\r\n                [-headers HEADERS] [-method {GET,POST}] [-b BODY]\r\n                [-l LOGINURL] [-H LOGINHEADERS] [-d LOGINDATA]\r\n\r\nREST API Security testing Framework\r\n\r\noptional arguments:\r\n  -h, --help            show this help message and exit\r\n  -c {Postman,Swagger}, --collection_type {Postman,Swagger}\r\n                        Type of API collection\r\n  -n COLLECTION_NAME, --collection_name COLLECTION_NAME\r\n                        Type of API collection\r\n  -u URL, --url URL     URL of target API\r\n  -headers HEADERS, --headers HEADERS\r\n                        Custom headers.Example: {\"token\" : \"123\"}\r\n  -method {GET,POST}, --method {GET,POST}\r\n                        HTTP request method\r\n  -b BODY, --body BODY  Request body of API\r\n  -l LOGINURL, --loginurl LOGINURL\r\n                        URL of login API\r\n  -H LOGINHEADERS, --loginheaders LOGINHEADERS\r\n                        Headers should be in a dictionary format. Example:\r\n                        {\"accesstoken\" : \"axzvbqdadf\"}\r\n  -d LOGINDATA, --logindata LOGINDATA\r\n                        login data of API<\/pre>\n<p>You can download Astra here:<\/p>\n<p><a href=\"https:\/\/github.com\/flipkart-incubator\/Astra\/archive\/master.zip\">Astra-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/flipkart-incubator\/Astra\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":5415,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"Astra - API Automated Security Testing For REST","_seopress_titles_desc":"Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[11],"tags":[],"featured_image_src":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Astra-API-Automated-Security-Testing-For-REST-600x400.png","featured_image_src_square":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2020\/02\/Astra-API-Automated-Security-Testing-For-REST-600x600.png","author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5413"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=5413"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5413\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media\/5415"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=5413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=5413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=5413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}