Possible DOS attack by Pagination misconfiguration
Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the user.
Lack of Resources & Rate Limiting (RL)
How this template works
APIs Selection
The template uses query parameters to filter the API requests. It looks for query parameters with keys that match certain regular expressions (such as "limit", "size", or "page") and extracts their corresponding values. These values are then stored as variables for later use.
Execute request
The template modifies the query parameter "limitKey" by appending a "0" to its value. This is done using the "modify_query_param" action. The modified request is then sent to the API server.
Validation
The template validates the response received from the API server. It checks that the response code is between 200 and 299 (indicating a successful response). Additionally, it compares the length of the response payload to the original length stored in the "original_length" variable. The validation passes if the response payload length is greater than the original length. Note: The template is designed to detect and mitigate the potential DOS attack caused by pagination misconfiguration in APIs. It ensures that the API server imposes a limit on the number of resources returned, preventing performance issues and potential authentication flaws.
Frequently asked questions
What is the purpose of the "PAGINATION_MISCONFIGURATION" array in this test
How does pagination misconfiguration lead to a possible Denial of Service (DoS) attack
What are the potential authentication flaws that can arise from pagination misconfiguration
What is the significance of the "RL" category in the array
What are some tags associated with the pagination misconfiguration vulnerability
Can you provide a reference link for further information on the pagination misconfiguration vulnerability
"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "
Security team,
Rippling
