How this template works
APIs Selection
The template includes filters to select APIs based on their response code and HTTP method. It specifies that the response code should be between 200 and 299, and the method should contain "GET". These filters ensure that only relevant APIs are targeted for the test.
Execute request
The template uses a single execution type, which means that all the requests specified under the "execute" section will be executed in a single test run. The requests include adding various query parameters with file paths from the "filePaths" word list. This allows the test to check if the web application is vulnerable to Local File Inclusion by manipulating file paths.
Validation
The template specifies a validation rule for the response payload. It uses a regular expression to match a specific pattern in the response. In this case, it checks if the response payload contains the string "root:.*:0:0:". If the pattern is found, it indicates that the test has successfully exploited the vulnerability and accessed the sensitive file.
Frequently asked questions
"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "
Security team,
Rippling
