imperva/automatic-api-attack-tool

Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.

automatic-api-attack-tool's Issues

Error on kali Linux App

I got an error while running this command

api-attack.sh -f swaggerPetStore.json -n myapisite.com -s http -rcn=403

Error: Could not find or load main class com.imperva.apiattacktool.ToolMain
Caused by: java.lang.ClassNotFoundException: com.imperva.apiattacktool.ToolMain

API Authentication is not possible?

API Authentication is not possible?
The most API evaluation requires previus authentication to consume many other functions...

Where is the imperva-api-attack-tool.jar file?

Per the instructions:
Copy the runnable.sh file from the src/main/resources folder, to the same directory with the jar file.
Now run: cat runnable.sh imperva-api-attack-tool.jar > api-attack.sh && chmod +x api-attack.sh

I can't find the imperva-api-attack-tool.jar file anywhere. Can you please assist? Thank you.

output against petstore

Hi,

I have petstore running locally on http://127.0.0.1/api/v3/openapi.json

On another machine I have the api-attack.sh script & I save the swaggerPetStore.json from https://petstore.swagger.io/ to the same directory so I run this:

./api-attack.sh -f swaggerPetStore.json -n [mySwaggerHost] -s http -rcn=403 -rcp=404

I get this at the end of the results:

API Attacks
Total tests run: 61, Passes: 39, Failures: 22, Skips: 0

Is this expected? i can't get Auth API key. Please help!

Gradle build failure

when building the project: I get the following:

• Where:
  Build file '/apps/imperva/automatic-api-attack-tool/build.gradle' line: 2

• What went wrong:
  A problem occurred evaluating root project 'automatic-api-attack-tool'.

Plugin with id 'findbugs' not found.

I have changed to 'spotbugs' but I get the same result.

Swagger Parser Issues

I am always getting this error on runwhich i assume it has something to do with outdated parser?
Can you fix this?

0:36:05.376 [main] ERROR c.i.a.tests.ScenariosDataProvider - Failed to get httpRequestList, for file: site_staging.yaml
java.lang.NullPointerException: null
at com.imperva.apispecparser.parsers.swagger.Swagger2Parser.getEndpointModelList(Swagger2Parser.java:52)
at com.imperva.apiattacktool.tests.AbstractTestDriver.parseSwagger(AbstractTestDriver.java:85)
at com.imperva.apiattacktool.tests.SingleValueScenarioTestDriver.getHttpRequestList(SingleValueScenarioTestDriver.java:36)
at com.imperva.apiattacktool.tests.ScenariosDataProvider.getEndpointTestRequestData(ScenariosDataProvider.java:57)
at com.imperva.apiattacktool.tests.ScenariosDataProvider.positiveScenarioDataProvider(ScenariosDataProvider.java:30)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.testng.internal.MethodInvocationHelper.invokeMethod(MethodInvocationHelper.java:133)
at org.testng.internal.MethodInvocationHelper.invokeMethod(MethodInvocationHelper.java:77)
at org.testng.internal.MethodInvocationHelper.invokeMethodNoCheckedException(MethodInvocationHelper.java:46)
at org.testng.internal.MethodInvocationHelper.invokeDataProvider(MethodInvocationHelper.java:146)
at org.testng.internal.Parameters.handleParameters(Parameters.java:820)
at org.testng.internal.Parameters.handleParameters(Parameters.java:762)
at org.testng.internal.ParameterHandler.handleParameters(ParameterHandler.java:60)
at org.testng.internal.ParameterHandler.createParameters(ParameterHandler.java:39)
at org.testng.internal.TestInvoker$MethodInvocationAgent.invoke(TestInvoker.java:771)
at org.testng.internal.TestInvoker.invokeTestMethods(TestInvoker.java:145)
at org.testng.internal.TestMethodWorker.invokeTestMethods(TestMethodWorker.java:146)
at org.testng.internal.TestMethodWorker.run(TestMethodWorker.java:128)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1541)
at org.testng.TestRunner.privateRun(TestRunner.java:770)
at org.testng.TestRunner.run(TestRunner.java:591)
at org.testng.SuiteRunner.runTest(SuiteRunner.java:402)
at org.testng.SuiteRunner.runSequentially(SuiteRunner.java:396)
at org.testng.SuiteRunner.privateRun(SuiteRunner.java:355)
at org.testng.SuiteRunner.run(SuiteRunner.java:304)
at org.testng.SuiteRunnerWorker.runSuite(SuiteRunnerWorker.java:53)
at org.testng.SuiteRunnerWorker.run(SuiteRunnerWorker.java:96)
at org.testng.TestNG.runSuitesSequentially(TestNG.java:1180)
at org.testng.TestNG.runSuitesLocally(TestNG.java:1102)
at org.testng.TestNG.runSuites(TestNG.java:1032)
at org.testng.TestNG.run(TestNG.java:1000)
at com.imperva.apiattacktool.cli.ApiAttackTool.call(ApiAttackTool.java:87)
at com.imperva.apiattacktool.cli.ApiAttackTool.call(ApiAttackTool.java:13)
at picocli.CommandLine.executeUserObject(CommandLine.java:1781)
at picocli.CommandLine.access$900(CommandLine.java:145)
at picocli.CommandLine$RunLast.handle(CommandLine.java:2139)
at picocli.CommandLine$RunLast.handle(CommandLine.java:2106)
at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:1973)
at picocli.CommandLine.execute(CommandLine.java:1902)
at com.imperva.apiattacktool.ToolMain.main(ToolMain.java:17)
[Utils] [ERROR] [Error] org.testng.TestNGException:
Data Provider public static java.lang.Object[][] com.imperva.apiattacktool.tests.ScenariosDataProvider.positiveScenarioDataProvider() returned a null value
at org.testng.internal.MethodInvocationHelper.invokeDataProvider(MethodInvocationHelper.java:148)
at org.testng.internal.Parameters.handleParameters(Parameters.java:820)
at org.testng.internal.Parameters.handleParameters(Parameters.java:762)
at org.testng.internal.ParameterHandler.handleParameters(ParameterHandler.java:60)
at org.testng.internal.ParameterHandler.createParameters(ParameterHandler.java:39)
at org.testng.internal.TestInvoker$MethodInvocationAgent.invoke(TestInvoker.java:771)
at org.testng.internal.TestInvoker.invokeTestMethods(TestInvoker.java:145)
at org.testng.internal.TestMethodWorker.invokeTestMethods(TestMethodWorker.java:146)
at org.testng.internal.TestMethodWorker.run(TestMethodWorker.java:128)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1541)
at org.testng.TestRunner.privateRun(TestRunner.java:770)
at org.testng.TestRunner.run(TestRunner.java:591)
at org.testng.SuiteRunner.runTest(SuiteRunner.java:402)
at org.testng.SuiteRunner.runSequentially(SuiteRunner.java:396)
at org.testng.SuiteRunner.privateRun(SuiteRunner.java:355)
at org.testng.SuiteRunner.run(SuiteRunner.java:304)
at org.testng.SuiteRunnerWorker.runSuite(SuiteRunnerWorker.java:53)
at org.testng.SuiteRunnerWorker.run(SuiteRunnerWorker.java:96)
at org.testng.TestNG.runSuitesSequentially(TestNG.java:1180)
at org.testng.TestNG.runSuitesLocally(TestNG.java:1102)
at org.testng.TestNG.runSuites(TestNG.java:1032)
at org.testng.TestNG.run(TestNG.java:1000)
at com.imperva.apiattacktool.cli.ApiAttackTool.call(ApiAttackTool.java:87)
at com.imperva.apiattacktool.cli.ApiAttackTool.call(ApiAttackTool.java:13)
at picocli.CommandLine.executeUserObject(CommandLine.java:1781)
at picocli.CommandLine.access$900(CommandLine.java:145)
at picocli.CommandLine$RunLast.handle(CommandLine.java:2139)
at picocli.CommandLine$RunLast.handle(CommandLine.java:2106)
at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:1973)
at picocli.CommandLine.execute(CommandLine.java:1902)
at com.imperva.apiattacktool.ToolMain.main(ToolMain.java:17)