How this template works
APIs Selection
The template uses API selection filters to specify the criteria for selecting the APIs to be tested. In this case, the filters include response code, method, response payload, and query parameters. For example, it selects APIs with a response code between 200 and 299, uses the "GET" method, and checks if the response payload contains the HTML doctype declaration.
Execute request
The template defines a single request to be executed. It modifies the query parameter by injecting a malicious script that triggers an alert with the document's domain. This is done to test for XSS vulnerabilities in the targeted API.
Validation
The template specifies the expected response payload for validation. It checks if the response payload contains either the script that triggers the alert or the HTML doctype declaration. If the validation fails, it indicates that the API is vulnerable to XSS attacks.
Frequently asked questions
"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "
Security team,
Rippling
