{ "info": { "author": "OpenStack Security Group", "author_email": "openstack-dev@lists.openstack.org", "bugtrack_url": null, "classifiers": [ "Environment :: Console", "Intended Audience :: Developers", "Intended Audience :: Information Technology", "License :: OSI Approved :: Apache Software License", "Natural Language :: English", "Operating System :: MacOS :: MacOS X", "Operating System :: POSIX :: Linux", "Programming Language :: Python", "Programming Language :: Python :: 2", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.5", "Topic :: Security", "Topic :: Software Development :: Testing", "Topic :: Utilities" ], "description": "========================\nTeam and repository tags\n========================\n\n.. image:: http://governance.openstack.org/badges/syntribos.svg\n :target: http://governance.openstack.org/reference/tags/index.html\n\n\n.. image:: http://img.shields.io/badge/docs-latest-brightgreen.svg?style=flat\n :target: http://docs.openstack.org/developer/syntribos/\n\n.. image:: http://img.shields.io/pypi/v/syntribos.svg\n :target: http://pypi.python.org/pypi/syntribos/\n\n.. image:: http://img.shields.io/pypi/pyversions/syntribos.svg\n :target: http://pypi.python.org/pypi/syntribos/\n\n.. image:: http://img.shields.io/pypi/wheel/syntribos.svg\n :target: http://pypi.python.org/pypi/syntribos/\n\n.. image:: http://img.shields.io/irc/%23openstack-security.png\n :target: http://webchat.freenode.net/?channels=openstack-security\n\n\n=================================================\nSyntribos, An Automated API Security Testing Tool\n=================================================\n\n::\n\n syntribos\n xxxxxxx\n x xxxxxxxxxxxxx x\n x xxxxxxxxxxx x\n xxxxxxxxx\n x xxxxxxx x\n xxxxx\n x xxx x\n x\n xxxxxxxxxxxxxxx xxxxxxxxxxxxxxx\n xxxxxxxxxxxxx xxxxxxxxxxxxx\n xxxxxxxxxxx xxxxxxxxxxx\n xxxxxxxxx xxxxxxxxx\n xxxxxx xxxxxx\n xxx xxx\n x x\n x\n === Automated API Scanning ===\n\n\n\nSyntribos is an open source automated API security testing tool that is\nmaintained by members of the `OpenStack Security Project `_.\n\nGiven a simple configuration file and an example HTTP request, syntribos\ncan replace any API URL, URL parameter, HTTP header and request body\nfield with a given set of strings. Syntribos iterates through each position\nin the request automatically. Syntribos aims to automatically detect common\nsecurity defects such as SQL injection, LDAP injection, buffer overflow, etc.\nIn addition, syntribos can be used to help identify new security defects\nby automated fuzzing.\n\nSyntribos has the capability to test any API, but is designed with\n`OpenStack `__ applications in mind.\n\nList of Tests\n~~~~~~~~~~~~~\n\nWith syntribos, you can initiate automated testing of any API with minimal\nconfiguration effort. Syntribos is ideal for testing the OpenStack API as it\nwill help you in automatically downloading a set of templates of some of the\nbigger OpenStack projects like nova, neutron, keystone, etc.\n\nA short list of tests that can be run using syntribos is given below:\n\n* Buffer Overflow\n* Command Injection\n* CORS Wildcard\n* Integer Overflow\n* LDAP Injection\n* SQL Injection\n* String Validation\n* XML External Entity\n* Cross Site Scripting (XSS)\n* Regex Denial of Service (ReDoS)\n* JSON Parser Depth Limit\n* User Defined\n\nBuffer Overflow\n---------------\n\n`Buffer overflow`_ attacks, in the context of a web application,\nforce an application to handle more data than it can hold in a buffer.\nIn syntribos, a buffer overflow test is attempted by injecting a large\nstring into the body of an HTTP request.\n\nCommand Injection\n-----------------\n\n`Command injection`_ attacks are done by injecting arbitrary commands in an\nattempt to execute these commands on a remote system. In syntribos, this is\nachieved by injecting a set of strings that have been proven as successful\nexecutors of injection attacks.\n\nCORS Wildcard\n-------------\n\n`CORS wildcard`_ tests are used to verify if a web server allows cross-domain\nresource sharing from any external URL (wild carding of\n`Access-Control-Allow-Origin` header), rather than a white list of URLs.\n\nInteger Overflow\n----------------\n\n`Integer overflow`_ tests in syntribos attempt to inject numeric values that\nthe remote application may fail to represent within its storage. For example,\ninjecting a 64 bit number into a 32 bit integer type.\n\nLDAP Injection\n--------------\n\nSyntribos attempts `LDAP injection`_ attacks by injecting LDAP statements\ninto HTTP requests; if an application fails to properly sanitize the\nrequest content, it may be possible to execute arbitrary commands.\n\nSQL Injection\n-------------\n\n`SQL injection`_ attacks are one of the most common web application attacks.\nIf the user input is not properly sanitized, it is fairly easy to\nexecute SQL queries that may result in an attacker reading sensitive\ninformation or gaining control of the SQL server. In syntribos,\nan application is tested for SQL injection vulnerabilities by injecting\nSQL strings into the HTTP request.\n\nString Validation\n-----------------\n\nSome string patterns are not sanitized effectively by the input validator and\nmay cause the application to crash. String validation attacks in syntribos\ntry to exploit this by inputting characters that may cause string validation\nvulnerabilities. For example, special unicode characters, emojis, etc.\n\nXML External Entity\n-------------------\n\n`XML external entity`_ attacks target the web application's XML parser.\nIf an XML parser allows processing of external entities referenced in an\nXML document then an attacker might be able to cause a denial of service,\nor leakage of information, etc. Syntribos tries to inject a few malicious\nstrings into an XML body while sending requests to an application in an\nattempt to obtain an appropriate response.\n\nCross Site Scripting (XSS)\n----------------------------\n\n`XSS`_ attacks inject malicious JavaScript into a web\napplication. Syntribos tries to find potential XSS issues by injecting\nstring containing \"script\" and other HTML tags into request fields.\n\nRegex Denial of Service (ReDoS)\n-------------------------------\n\n`ReDoS`_ attacks attempt to produce a denial of service by\nproviding a regular expression that takes a very long time to evaluate.\nThis can cause the regex engine to backtrack indefinitely, which can\nslow down some parsers or even cause a processing halt. The attack\nexploits the fact that most regular expression implementations have\nan exponential time worst case complexity.\n\nJSON Parser Depth Limit\n-----------------------\n\nThere is a possibility that the JSON parser will reach depth limit and crash,\nresulting in a successful overflow of the JSON parsers depth limit, leading\nto a DoS vulnerability. Syntribos tries to check for this, and raises an issue\nif the parser crashes.\n\nUser defined Test\n-----------------\n\nThis test gives users the ability to fuzz using user defined fuzz data and\nprovides an option to look for failure strings provided by the user. The fuzz\ndata needs to be provided using the config option :option:`[user_defined]`.\n\nExample::\n\n [user_defined]\n payload=\n failure_strings=<[list_of_failure_strings] # optional\n\nOther than these built-in tests, you can extend syntribos by writing\nyour own custom tests. To do this, download the source code and look at\nthe tests in the ``syntribos/tests`` directory. The CORS test may be an easy\none to emulate. In the same way, you can also add different extensions\nto the tests. To see how extensions can be written please see the\n``syntribos/extensions`` directory.\n\n.. _buffer overflow: https://en.wikipedia.org/wiki/Buffer_overflow\n.. _Command injection: https://www.owasp.org/index.php/Command_Injection\n.. _CORS wildcard: https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)\n.. _Integer overflow: https://en.wikipedia.org/wiki/Integer_overflow\n.. _LDAP injection: https://www.owasp.org/index.php/LDAP_injection\n.. _SQL injection: https://www.owasp.org/index.php/SQL_Injection\n.. _XML external entity: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing\n.. _XSS: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)\n.. _ReDoS: https://en.wikipedia.org/wiki/ReDoS\n\n**Details**\n\n* `Documentation`_\n* Free software: `Apache license`_\n* `Launchpad project`_\n* `Blueprints`_\n* `Bugs`_\n* `Source code`_\n\nSupported Operating Systems\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSyntribos has been developed primarily in Linux and Mac environments and would\nwork on most Unix and Linux based Operating Systems. At this point, we are not\nsupporting Windows, but this may change in the future.\n\n.. _Documentation: https://docs.openstack.org/developer/syntribos/\n.. _Apache license: https://github.com/openstack/syntribos/blob/master/LICENSE\n.. _Launchpad project: https://launchpad.net/syntribos\n.. _Blueprints: https://blueprints.launchpad.net/syntribos\n.. _Bugs: https://bugs.launchpad.net/syntribos\n.. _Source code: https://github.com/openstack/syntribos\n\n============\nInstallation\n============\n\nSyntribos can be installed directly from `pypi with pip `__.\n\n::\n\n pip install syntribos\n\nFor the latest changes, install syntribos from `source `__\nwith `pip `__.\n\nClone the repository::\n\n $ git clone https://github.com/openstack/syntribos.git\n\nChange directory into the repository clone and install with pip::\n\n $ cd syntribos\n $ pip install .\n\n======================================\nInitializing the syntribos Environment\n======================================\n\nOnce syntribos is installed, you must initialize the syntribos environment.\nThis can be done manually, or with the ``init`` command.\n\n::\n\n $ syntribos init\n\n.. Note::\n By default, ``syntribos init`` fetches a set of default payload files\n from a `remote repository `_\n maintained by our development team. These payload files are necessary for\n our fuzz tests to run. To disable this behavior, run syntribos with the\n ``--no_downloads`` flag. Payload files can also be fetched by running\n ``syntribos download --payloads`` at any time.\n\nTo specify a custom root for syntribos to be installed in,\nspecify the ``--custom_install_root`` flag after ``init``. This will skip\nprompts for information from the terminal, which can be handy for\nJenkins jobs and other situations where user input cannot be retrieved.\n\nIf you've already run the ``init`` command but want to start over with a fresh\nenvironment, you can specify the ``--force`` flag to overwrite existing files.\nThe ``--custom_install_root`` and ``--force`` flags can be combined to\noverwrite files in a custom install root.\n\n**Example:**\n\n::\n\n $ syntribos init --custom_install_root /your/custom/path --force\n\n\n\n=============\nConfiguration\n=============\n\nAll configuration files should have a ``[syntribos]`` section.\nAdd other sections depending on what extensions you are using\nand what you are testing. For example, if you are using the\nbuilt-in identity extension, you would need the ``[user]``\nsection. The sections ``[logging]`` and ``[remote]`` are optional.\n\nThe basic structure of a syntribos configuration\nfile is given below::\n\n [syntribos]\n #\n # End point URLs and versions of the services to be tested.\n #\n endpoint=http://localhost:5000\n # Set payload and templates path\n templates=\n payloads=\n\n [user]\n #\n # User credentials and endpoint URL to get an AUTH_TOKEN\n # This section is only needed if you are using the identity extension.\n #\n endpoint=\n username=\n password=\n\n [remote]\n #\n # Optional, to define remote URI and cache_dir explicitly\n #\n templates_uri=\n payloads_uri=\n cache_dir=\n\n [logging]\n log_dir=\n\nThe endpoint URL specified in the ``[syntribos]`` section is the endpoint URL\ntested by syntribos. The endpoint URL in the ``[user]`` section is used to\nget an AUTH_TOKEN. To test any project, update the endpoint URL under\n``[syntribos]`` to point to the API and also modify the user\ncredentials if needed.\n\nDownloading templates and payloads remotely\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nPayload and template files can be downloaded remotely in syntribos.\nIn the config file under the ``[syntribos]`` section, if the ``templates``\nand ``payloads`` options are not set, by default syntribos will\ndownload all the latest payloads and the templates for a few OpenStack\nprojects.\n\nTo specify a URI to download custom templates and payloads\nfrom, use the ``[remotes]`` section in the config file.\nAvailable options under ``[remotes]`` are ``cache_dir``, ``templates_uri``,\n``payloads_uri``, and ``enable_cache``. The ``enable_cache`` option is\n``True`` by default; set to ``False`` to disable caching of remote\ncontent while syntribos is running. If the ``cache_dir`` set to a path,\nsyntribos will attempt to use that as a base directory to save downloaded\ntemplate and payload files.\n\nThe advantage of using these options are that you will be able to get\nthe latest payloads from the official repository and if you are\nusing syntribos to test OpenStack projects, then, in most cases you\ncould directly use the well defined templates available with this option.\n\nThis option also helps to easily manage different versions of templates\nremotely, without the need to maintain a set of different versions offline.\n\nTesting OpenStack keystone API\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nA sample config file is given in ``examples/configs/keystone.conf``.\nCopy this file to a location of your choice (the default file path for the\nconfiguration file is: ``~/.syntribos/syntribos.conf``) and update the\nnecessary fields, such as user credentials, log, template directory, etc.\n\n::\n\n $ vi examples/configs/keystone.conf\n\n\n\n [syntribos]\n #\n # As keystone is being tested in the example, enter your\n #\n # keystone auth endpoint url.\n endpoint=http://localhost:5000\n # Set payload and templates path\n templates=\n payloads=\n\n [user]\n #\n # User credentials\n #\n endpoint=http://localhost:5000\n username=\n password=\n # Optional, only needed if Keystone V3 API is used\n #user_id=\n # Optional, api version if required\n #version=v2.0\n # Optional, for getting scoped tokens\n #user_id=\n # If user id is not known\n # For V3 API\n #domain_name=\n #project_name=\n # For Keystone V2 API\n #tenant_name=\n\n #[alt_user]\n #\n # Optional, Used for cross auth tests (-t AUTH)\n #\n #endpoint=http://localhost:5000\n #username=\n #password=\n # Optional, for getting scoped tokens\n #user_id=\n # If user id is not known\n # For V3 API\n #domain_name=\n #project_name=\n # For Keystone V2 API\n #tenant_name=\n\n [remote]\n #\n # Optional, Used to specify URLs of templates and payloads\n #\n #cache_dir=\n #templates_uri=https://github.com/your_project/templates.tar\n #payloads_uri=https://github.com/your_project/payloads.tar\n # To disable caching of these remote contents, set the following variable to False\n #enable_caching=True\n\n [logging]\n #\n # Logger options go here\n #\n log_dir=\n # Optional, compresses http_request_content,\n # if you don't want this, set this option to False.\n http_request_compression=True\n\n========\nCommands\n========\n\nBelow are the set of commands that can be specified while\nusing syntribos:\n\n- **init**\n\n This command sets up the syntribos environment after installation. Running\n this command creates the necessary folders for templates, payloads,\n and logs; as well a sample configuration file.\n\n ::\n\n $ syntribos init\n\n To learn more about ``syntribos init``, see the installation instructions\n `here `_.\n\n- **run**\n\n This command runs syntribos with the given config options.\n\n ::\n\n $ syntribos --config-file keystone.conf -t SQL run\n\n- **dry_run**\n\n This command ensures that the template files given for this run parse\n successfully and without errors. It then runs a debug test which sends no\n requests of its own.\n\n ::\n\n $ syntribos --config-file keystone.conf dry_run\n\n.. Note::\n If any external calls referenced inside the template file do make\n requests, the parser will still make those requests even for a dry run.\n\n- **list_tests**\n\n This command will list the names of all the tests\n that can be executed by the ``run`` command with their description.\n\n ::\n\n $ syntribos --config-file keystone.conf list_tests\n\n- **download**\n\n This command will download templates and payload files. By default, it will\n download a set of OpenStack template files (with the ``--templates``\n flag), or a set of payloads (with the ``--payloads`` flag) to your\n syntribos root directory. However, the behavior of this command can be\n configured in the ``[remote]`` section of your config file.\n\n ::\n\n $ syntribos download --templates\n\n.. Important::\n All these commands, except ``init``, will only work if a configuration file\n is specified. If a configuration file is present in the default\n path ( ``~/.syntribos/syntribos.conf`` ), then you\n do not need to explicitly specify a config file and\n can run syntribos using the command ``syntribos run``.\n\n=================\nRunning syntribos\n=================\n\nTo run syntribos against all the available tests, specify the\ncommand ``syntribos`` with the configuration file without\nspecifying any test type.\n\n::\n\n $ syntribos --config-file keystone.conf run\n\nFuzzy-matching test names\n~~~~~~~~~~~~~~~~~~~~~~~~~\n\nIt is possible to limit syntribos to run a specific test type using\nthe ``-t`` flag.\n\n::\n\n $ syntribos --config-file keystone.conf -t SQL run\n\n\nThis will match all tests that contain ``SQL`` in their name. For example:\n``SQL_INJECTION_HEADERS``, ``SQL_INJECTION_BODY``, etc.\n\nSpecifying a custom root directory\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nIf you set up the syntribos environment with a custom root (i.e. with\n``syntribos init --custom_install_root``), you can point to it with the\n``--syntribos-custom_root`` configuration option. Syntribos will look for a\n``syntribos.conf`` file inside this directory, and will read further\nconfiguration information from there.\n\n===================\nLogging and Results\n===================\n\nThere are two types of logs generated by syntribos:\n\n#. The results log is a collection of issues generated at the end of a\n syntribos run to represent results.\n#. The debug log contains debugging information captured during a particular\n run. Debug logs may include exception messages, warnings, raw\n but sanitized request/response data, and a few more details. A modified\n version of Python logger is used for collecting debug logs in syntribos.\n\nResults Log\n~~~~~~~~~~~\n\nThe results log includes failures and errors. The ``\"failures\"`` key represents\ntests that have failed, indicating a possible security vulnerability. The\n``\"errors\"`` key gives us information on any unhandled exceptions, such as\nconnection errors, encountered on that run.\n\nExample failure object:\n\n::\n\n {\n \"defect_type\": \"xss_strings\",\n \"description\": \"The string(s): '[\\\"\\\"]',\n known to be commonly returned after a successful XSS attack, have been found in the\n response. This could indicate a vulnerability to XSS attacks.\",\n \"failure_id\": 33,\n \"instances\": [\n {\n \"confidence\": \"LOW\",\n \"param\": {\n \"location\": \"data\",\n \"method\": \"POST\",\n \"type\": null,\n \"variables\": [\n \"type\",\n \"details/name\",\n ]\n },\n \"severity\": \"LOW\",\n \"signals\": {\n \"diff_signals\": [\n \"LENGTH_DIFF_OVER\"\n ],\n \"init_signals\": [\n \"HTTP_CONTENT_TYPE_JSON\",\n \"HTTP_STATUS_CODE_2XX_201\"\n ],\n \"test_signals\": [\n \"FAILURE_KEYS_PRESENT\",\n \"HTTP_CONTENT_TYPE_JSON\",\n \"HTTP_STATUS_CODE_2XX_201\",\n ]\n },\n \"strings\": [\n \"\"\n ]\n }\n ],\n \"url\": \"127.0.0.1/test\"\n }\n\n\nError form:\n\n::\n\n ERROR:\n {\n \"error\": \"Traceback (most recent call last):\\n File \\\"/Users/test/syntribos/tests/fuzz/base_fuzz.py\\\",\n line 58, in tearDownClass\\n super(BaseFuzzTestCase, cls).tearDownClass()\\n\n File \\\"/Users/test/syntribos/tests/base.py\\\", line 166, in tearDownClass\\n\n raise sig.data[\\\"exception\\\"]\\nReadTimeout: HTTPConnectionPool(host='127.0.0.1', port=8080):\n Read timed out. (read timeout=10)\\n\",\n \"test\": \"tearDownClass (syntribos.tests.fuzz.sql.image_data_image_data_get.template_SQL_INJECTION_HEADERS_sql-injection.txt_str21_model1)\"\n }\n\n\nDebug Logs\n~~~~~~~~~~\n\nDebug logs include details about HTTP requests, HTTP responses, and other\ndebugging information such as errors and warnings across the project. The\npath where debug logs are saved by default is ``.syntribos/logs/``.\nDebug logs are arranged in directories based on the timestamp in these\ndirectories and files are named according to the templates.\n\nFor example:\n\n::\n\n $ ls .syntribos/logs/\n 2016-09-15_11:06:37.198412 2016-09-16_10:11:37.834892 2016-09-16_13:31:36.362584\n 2016-09-15_11:34:33.271606 2016-09-16_10:38:55.820827 2016-09-16_13:36:43.151048\n 2016-09-15_11:41:53.859970 2016-09-16_10:39:50.501820 2016-09-16_13:40:23.203920\n\n::\n\n $ ls .syntribos/logs/2016-09-16_13:31:36.362584\n API_Versions::list_versions_template.log\n API_Versions::show_api_details_template.log\n availability_zones::get_availability_zone_detail_template.log\n availability_zones::get_availability_zone_template.log\n cells::delete_os_cells_template.log\n cells::get_os_cells_capacities_template.log\n cells::get_os_cells_data_template.log\n\nEach log file includes some essential debugging information such as the string\nrepresentation of the request object, signals, and checks used for tests, etc.\n\nExample request::\n\n ------------\n REQUEST SENT\n ------------\n request method.......: PUT\n request url..........: http://127.0.0.1/api\n request params.......:\n request headers size.: 7\n request headers......: {'Content-Length': '0', 'Accept-Encoding': 'gzip, deflate',\n 'Accept': 'application/json',\n 'X-Auth-Token': , 'Connection': 'keep-alive',\n 'User-Agent': 'python-requests/2.11.1', 'content-type': 'application/xml'}\n request body size....: 0\n request body.........: None\n\nExample response::\n\n -----------------\n RESPONSE RECEIVED\n -----------------\n response status..: \n response headers.: {'Content-Length': '70',\n 'X-Compute-Request-Id': ,\n 'Vary': 'OpenStack-API-Version, X-OpenStack-Nova-API-Version',\n 'Openstack-Api-Version': 'compute 2.1', 'Connection': 'close',\n 'X-Openstack-Nova-Api-Version': '2.1', 'Date': 'Fri, 16 Sep 2016 14:15:27 GMT',\n 'Content-Type': 'application/json; charset=UTF-8'}\n response time....: 0.036277\n response size....: 70\n response body....: {\"badMediaType\": {\"message\": \"Unsupported Content-Type\", \"code\": 415}}\n -------------------------------------------------------------------------------\n [2590] : XSS_BODY\n (, 'PUT',\n 'http://127.0.0.1/api')\n {'headers': {'Accept': 'application/json', 'X-Auth-Token': },\n 'params': {}, 'sanitize': False, 'data': '', 'requestslib_kwargs': {'timeout': 10}}\n Starting new HTTP connection (1): 127.0.0.1\n \"PUT http://127.0.0.1/api HTTP/1.1\" 501 93\n\nExample signals captured::\n\n Signals: ['HTTP_STATUS_CODE_4XX_400', 'HTTP_CONTENT_TYPE_JSON']\n Checks used: ['HTTP_STATUS_CODE', 'HTTP_CONTENT_TYPE']\n\nDebug logs are sanitized to prevent storing secrets to log files.\nPasswords and other sensitive information are marked with asterisks using a\nslightly modified version of `oslo_utils.strutils.mask_password `__.\n\nDebug logs also include string compression, wherein long fuzz strings are\ncompressed before being written to the logs. The threshold to start data\ncompression is set to 512 characters. Although it is not recommended to turn\noff compression, it is possible by setting the variable\n``\"http_request_compression\"``, under the logging section in the config file,\nto ``False``.\n\n\n=============================\nAnatomy of a request template\n=============================\n\nThis section describes how to write templates and how to run specific tests.\nTemplates are input files which have raw HTTP requests and may be\nsupplemented with variable data using extensions.\n\nNote: The name of a template file must end with the extension ``.template``\nOtherwise, syntribos will skip the file and will not attempt to parse any files\nthat do not adhere to this naming scheme.\n\nUsing external functions in templates\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nExtensions can be used to supplement syntribos template files with variable\ndata, or data retrieved from external sources.\n\nExtensions are found in ``syntribos/extensions/``.\n\nCalls to extensions are made in the form below:\n\n::\n\n CALL_EXTERNAL|{extension dot path}:{function name}:[arguments]\n\nOne example packaged with syntribos enables the tester to obtain an AUTH\ntoken from keystone. The code is located in ``identity/client.py``.\n\nTo use this extension, you can add the following to your template file:\n\n::\n\n X-Auth-Token: CALL_EXTERNAL|syntribos.extensions.identity.client:get_token_v3:[\"user\"]|\n\nThe ``\"user\"`` string indicates the data from the configuration file we\nadded in ``examples/configs/keystone.conf``.\n\nAnother example is found in ``random_data/client.py``. This returns a\nUUID when random, but unique data is needed. The UUID can be used in place of\nusernames when fuzzing a create user call.\n\n::\n\n \"username\": \"CALL_EXTERNAL|syntribos.extensions.random_data.client:get_uuid:[]|\"\n\nThe extension function can return one value, or be used as a generator if\nyou want it to change for each test.\n\nBuilt in functions\n------------------\n\nSyntribos comes with a slew of utility functions/extensions, these functions\ncan be used to dynamically inject data into templates.\n\n.. list-table:: **Utility Functions**\n :widths: 15 35 40\n :header-rows: 1\n\n * - Method\n - Parameters\n - Description\n * - hash_it\n - [data, hash_type (optional hash type, default being SHA256)]\n - Returns hashed value of data\n * - hmac_it\n - [data, key, hash_type (optional hash type, default being SHA256)]\n - Returns HMAC based on the has algorithm, data and the key provided\n * - epoch_time\n - [offset (optional integer offset value, default is zero)]\n - Returns the current time minus offset since epoch\n * - utc_datetime\n - []\n - Returns current UTC date time\n * - base64_encode\n - [data]\n - Returns base 64 encoded value of data supplied\n * - url_encode\n - [url]\n - Returns encoded URL\n\nAll these utility functions can be called using the following syntax:\n\n::\n\n CALL_EXTERNAL|common_utils.client.{method_name}:{comma separated parameters in square brackets}\n\nFor example:\n\n::\n\n \"encoded_url\": \"CALL_EXTERNAL|common_utils.client:url_encode:['http://localhost:5000']|\n\nOther functions that return random values can be seen below:\n\n.. list-table:: **Random Functions**\n :widths: 15 35 40\n :header-rows: 1\n\n * - Method\n - Parameters\n - Description\n * - get_uuid\n - []\n - Returns a random UUID\n * - random_port\n - []\n - Returns random port number between 0 and 65535\n * - random_ip\n - []\n - Returns random ipv4 address\n * - random_mac\n - []\n - Returns random mac address\n * - random_integer\n - [beg (optional beginning value, default is 0), end (optional end value)]\n - Returns an integer value between 0 and 1468029570 by default\n * - random_utc_datetime\n - []\n - Returns random UTC datetime\n\nThese can be called using:\n\n::\n\n CALL_EXTERNAL|random_data.client.{method_name}:{comma separated parameters in square brackets}\n\nFor example:\n\n::\n\n \"address\": \"CALL_EXTERNAL|random_data.client:random_ip:[]|\"\n\nAction Field\n~~~~~~~~~~~~\n\nWhile syntribos is designed to test all fields in a request, it can also\nignore specific fields through the use of Action Fields. If you want to\nfuzz against a static object ID, use the Action Field indicator as\nfollows:\n\n::\n\n \"ACTION_FIELD:id\": \"1a16f348-c8d5-42ec-a474-b1cdf78cf40f\"\n\nThe ID provided will remain static for every test.\n\nMeta Variable File\n~~~~~~~~~~~~~~~~~~\n\nSyntribos allows for templates to read in variables from a user-specified\nmeta variable file. These files contain JSON objects that define variables\nto be used in one or more request templates.\n\nThe file must be named `meta.json`, and they take the form:\n::\n\n {\n \"user_password\": {\n \"val\": 1234\n },\n \"user_name\": {\n \"type\": config,\n \"val\": \"user.username\"\n \"fuzz_types\": [\"ascii\"]\n },\n \"user_token\": {\n \"type\": \"function\",\n \"val\": \"syntribos.extensions.identity:get_scoped_token_v3\",\n \"args\": [\"user\"],\n \"fuzz\": false\n }\n }\n\nTo reference a meta variable from a request template, reference the variable\nname surrounded by `|` (pipe). An example request template with meta\nvariables is as follows:\n::\n\n POST /user HTTP/1.1\n X-Auth-Token: |user_token|\n\n {\n \"user\": {\n \"username\": \"|user_name|\",\n \"password\": \"|user_password|\"\n }\n }\n\nNote: Meta-variable usage in templates should take the form `|user_name|`, not\n`user_|name|` or `|user|_|name|`. This is to avoid ambiguous behavior when the\nvalue is fuzzed.\n\nMeta Variable Attributes\n------------------------\n* val - All meta variable objects must define a value, which can be of any json\n DataType. Unlike the other attributes, this attribute is not optional.\n* type - Defining a type instructs syntribos to interpret the variable in a\n certain way. Any variables without a type defined will be read in directly\n from the value. The following types are allowed:\n\n * config - syntribos reads the config value specified by the \"val\"\n attribute and returns that value.\n * function - syntribos calls the function named in the \"val\" attribute\n with any arguments given in the optional \"args\" attribute, and returns the\n value from calling the function. This value is cached, and will be returned\n on subsequent calls.\n * generator - Works the same way as the function type, but its results are\n not cached and the function will be called every time.\n\n* args - A list of function arguments (if any) which can be defined here if the\n variable is a generator or a function\n* fuzz - A boolean value that, if set to false, instructs syntribos to\n ignore this variable for any fuzz tests\n* fuzz_types - A list of strings which instructs syntribos to only use certain\n fuzz strings when fuzzing this variable. More than one fuzz type can be\n defined. The following fuzz types are allowed:\n\n * ascii - strings that can be encoded as ascii\n * url - strings that contain only url safe characters\n\n* min_length/max_length - An integer that instructs syntribos to only use fuzz\n strings that meet certain length requirements\n\nInheritence\n-----------\n\nMeta variable files inherit based on the directory it's in. That is, if you\nhave `foo/meta.json` and `foo/bar/meta.json`, templates in `foo/bar/` will take\ntheir meta variable values from `foo/bar/meta.json`, but they can also\nreference meta variables that are defined only in `foo/meta.json`. This also\nmeans that templates in `foo/baz/` cannot reference variables defined only in\n`foo/bar/meta.json`.\n\nEach directory can have no more than one file named `meta.json`.\n\nRunning a specific test\n~~~~~~~~~~~~~~~~~~~~~~~\n\nAs mentioned above, some tests included with syntribos by default\nare: LDAP injection, SQL injection, integer overflow, command injection,\nXML external entity, reflected cross-site scripting,\nCross Origin Resource Sharing (CORS), SSL, Regex Denial of Service,\nJSON Parser Depth Limit, and User defined.\n\nIn order to run a specific test, use the :option:`-t, --test-types`\noption and provide ``syntribos`` with a keyword, or keywords, to match from\nthe test files located in ``syntribos/tests/``.\n\nFor SQL injection tests, see below:\n\n::\n\n $ syntribos --config-file keystone.conf -t SQL run\n\nTo run SQL injection tests against the template body only, see below:\n\n::\n\n $ syntribos --config-file keystone.conf -t SQL_INJECTION_BODY run\n\nFor all tests against HTTP headers only, see below:\n\n::\n\n $ syntribos --config-file keystone.conf -t HEADERS run\n\n\n============\nUnit testing\n============\n\nTo execute unit tests automatically, navigate to the ``syntribos`` root\ndirectory and install the test requirements.\n\n::\n\n $ pip install -r test-requirements.txt\n\nNow, run the ``unittest`` as below:\n\n::\n\n $ python -m unittest discover tests/unit -p \"test_*.py\"\n\nIf you have configured tox you could also run the following:\n\n::\n\n $ tox -e py27\n $ tox -e py35\n\nThis will run all the unit tests and give you a result output\ncontaining the status and coverage details of each test.\n\n=======================\nContributing Guidelines\n=======================\n\nSyntribos is an open source project and contributions are always\nwelcome. If you have any questions, we can be found in the\n#openstack-security channel on Freenode IRC.\n\n1. Follow all the `OpenStack Style Guidelines `__\n (e.g. PEP8, Py3 compatibility)\n2. Follow `secure coding guidelines `__\n3. Ensure all classes/functions have appropriate `docstrings `__\n in `RST format `__\n4. Include appropriate unit tests for all new code(place them in the\n ``tests/unit`` folder)\n5. Test any change you make using tox:\n\n ::\n\n pip install tox\n tox -e pep8\n tox -e py27\n tox -e py35\n tox -e cover\n\nAnyone wanting to contribute to OpenStack must follow\n`the OpenStack development workflow `__\n\nSubmit all changes through the code review process in Gerrit\ndescribed above. All pull requests on Github will be closed/ignored.\n\nFile bugs on the `syntribos launchpad site `__,\nand not on Github. All Github issues will be closed/ignored.\n\nSubmit blueprints `here `__ for all\nbreaking changes, feature requests, and other unprioritized work.\n\n\n.. Note:: README.rst is a file that can be generated by running\n ``python readme.py`` from the ``syntribos/scripts`` directory. When the\n README file needs to be updated; modify the corresponding rst file in\n ``syntribos/doc/source`` and have it generate by running the script.\n\n\n\n", "description_content_type": null, "docs_url": null, "download_url": "", "downloads": { "last_day": -1, "last_month": -1, "last_week": -1 }, "home_page": "https://docs.openstack.org/syntribos/latest/", "keywords": "", "license": "Apache License, Version 2.0", "maintainer": "", "maintainer_email": "", "name": "syntribos", "package_url": "https://pypi.org/project/syntribos/", "platform": "", "project_url": "https://pypi.org/project/syntribos/", "project_urls": { "Homepage": "https://docs.openstack.org/syntribos/latest/" }, "release_url": "https://pypi.org/project/syntribos/0.5.0/", "requires_dist": [ "oslo.i18n (>=3.15.3)", "six (>=1.9.0)", "requests (>=2.14.2)", "oslo.config (>=4.6.0)", "oslo.utils (>=3.31.0)", "python-cinderclient (>=3.2.0)", "python-glanceclient (>=2.8.0)", "python-neutronclient (>=6.3.0)", "python-novaclient (>=9.1.0)" ], "requires_python": "", "summary": "API Security Scanner", "version": "0.5.0" }, "last_serial": 3375563, "releases": { "0.0.1": [], "0.1.2": [ { "comment_text": "", "digests": { "md5": "0b11a6419d3e29eef3ff988b631ff2e9", "sha256": "f993c51dace434efae66ea326fcf9d1b4c7a12c6b2324f5932108d010c8df24b" }, "downloads": -1, "filename": "syntribos-0.1.2-py2-none-any.whl", "has_sig": false, "md5_digest": "0b11a6419d3e29eef3ff988b631ff2e9", "packagetype": "bdist_wheel", "python_version": "py2", "requires_python": null, "size": 49724, "upload_time": "2016-02-24T01:25:58", "url": "https://files.pythonhosted.org/packages/33/d7/9bd02de701a3cee613c413a01895bc05637f5cce202e6ba1fef38f7ea481/syntribos-0.1.2-py2-none-any.whl" }, { "comment_text": "", "digests": { "md5": "662479285ef8284468e17793dcf2531a", "sha256": "497d8bdd1e33847c4fcf77796853f4c55f95fb2a089f670a43d8782796339836" }, "downloads": -1, "filename": "syntribos-0.1.2.tar.gz", "has_sig": false, "md5_digest": "662479285ef8284468e17793dcf2531a", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 78049, "upload_time": "2016-02-24T01:26:07", "url": "https://files.pythonhosted.org/packages/22/86/ff346fda82e260456b144249f5a924be5025f8741924f6edc9ffcbc9fc46/syntribos-0.1.2.tar.gz" } ], "0.2.2": [ { "comment_text": "", "digests": { "md5": "e65187c1ccd7c02dc5e8edb603f933da", "sha256": "c29cdae8d2dfeb62bcec81df347ad317467032da98f0e3b20c9e0e97bd0651df" }, "downloads": -1, "filename": "syntribos-0.2.2-py2-none-any.whl", "has_sig": false, "md5_digest": "e65187c1ccd7c02dc5e8edb603f933da", "packagetype": "bdist_wheel", "python_version": "py2", "requires_python": null, "size": 111218, "upload_time": "2016-10-27T04:39:38", "url": "https://files.pythonhosted.org/packages/3e/48/ddfdec8eba1bc2616a997a660ed96e74e3ed548f72c20d949025da838769/syntribos-0.2.2-py2-none-any.whl" }, { "comment_text": "", "digests": { "md5": "e22d65311744b4ead4826ab3d44c69fa", "sha256": "6a3b96097e987462c2014e75425398a22ffddd2807bd4a88022022db22c6ef35" }, "downloads": -1, "filename": "syntribos-0.2.2.tar.gz", "has_sig": false, "md5_digest": "e22d65311744b4ead4826ab3d44c69fa", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 140173, "upload_time": "2016-10-27T04:39:41", "url": "https://files.pythonhosted.org/packages/ca/aa/9d58b2537387c54b0b93446afc36375bdf381bab7a43db210f8a78bcf6ea/syntribos-0.2.2.tar.gz" } ], "0.3.0": [ { "comment_text": "", "digests": { "md5": "41ff7c70ea1e1ed2a6d1931219a4f496", "sha256": "bc225f050440ae3616424abdc916513657d00fa3778e1697f7a22710903286cf" }, "downloads": -1, "filename": "syntribos-0.3.0-py2-none-any.whl", "has_sig": false, "md5_digest": "41ff7c70ea1e1ed2a6d1931219a4f496", "packagetype": "bdist_wheel", "python_version": "py2", "requires_python": null, "size": 117968, "upload_time": "2016-11-14T17:12:13", "url": "https://files.pythonhosted.org/packages/ee/59/96b7c7a72e5ee6281512a89bf25b90c7e20cf91badd3de28574c9c2ece19/syntribos-0.3.0-py2-none-any.whl" }, { "comment_text": "", "digests": { "md5": "c447daa5e3428f932f4ce76644c2bfac", "sha256": "d87bfe76e515b5ad3287a0715530602aa63264ea506225caf6266a7e566baa7e" }, "downloads": -1, "filename": "syntribos-0.3.0.tar.gz", "has_sig": false, "md5_digest": "c447daa5e3428f932f4ce76644c2bfac", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 156327, "upload_time": "2016-11-14T17:12:17", "url": "https://files.pythonhosted.org/packages/74/58/8d7f84250aff8ce31ddbf0802ecae526378cdbc2649700f2ff373596e191/syntribos-0.3.0.tar.gz" } ], "0.4.0": [ { "comment_text": "", "digests": { "md5": "dcae1b05ff29f8d3215c21c648604024", "sha256": "26efb529d0f69f460b1fa77f0146aa11130823ccaee4cc85a991339c0872e415" }, "downloads": -1, "filename": "syntribos-0.4.0-py2-none-any.whl", "has_sig": false, "md5_digest": "dcae1b05ff29f8d3215c21c648604024", "packagetype": "bdist_wheel", "python_version": "py2", "requires_python": null, "size": 132765, "upload_time": "2017-10-25T20:13:27", "url": "https://files.pythonhosted.org/packages/e1/d2/31126d6c49c6118f7ba96a2391ba5fcbcfae3c08e4a1b5cdbf529bcabd28/syntribos-0.4.0-py2-none-any.whl" }, { "comment_text": "", "digests": { "md5": "043da7edca7ab37406b815cc3fc5eff7", "sha256": "5662f1efa3910b819599290109e4c85947acc2fe1890ceca9d4fa8e4a833ac8c" }, "downloads": -1, "filename": "syntribos-0.4.0.tar.gz", "has_sig": false, "md5_digest": "043da7edca7ab37406b815cc3fc5eff7", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 141362, "upload_time": "2017-10-25T20:13:31", "url": "https://files.pythonhosted.org/packages/c0/d9/35487447b146f2193ca437f1c66feb7907dc5f02c8c9ae0dbb31d4b98100/syntribos-0.4.0.tar.gz" } ], "0.5.0": [ { "comment_text": "", "digests": { "md5": "4caae657b19ee393ba81c33c14370279", "sha256": "63025bf28cc7883e11c53420ec8a083496a48b2b5ef4226fb5b4a4035e6a38f7" }, "downloads": -1, "filename": "syntribos-0.5.0-py2-none-any.whl", "has_sig": false, "md5_digest": "4caae657b19ee393ba81c33c14370279", "packagetype": "bdist_wheel", "python_version": "py2", "requires_python": null, "size": 132793, "upload_time": "2017-11-29T22:14:54", "url": "https://files.pythonhosted.org/packages/d3/34/0b3a859db864f34ef3f8d33e74472d86033c214df10b7ac3eb748783b764/syntribos-0.5.0-py2-none-any.whl" }, { "comment_text": "", "digests": { "md5": "1cda02387a611b4885e040e3f4011067", "sha256": "5c6b8ec6a7599fa6209465897407b73a8aecb8d1a46beac816f6481a6ee1a40c" }, "downloads": -1, "filename": "syntribos-0.5.0.tar.gz", "has_sig": false, "md5_digest": "1cda02387a611b4885e040e3f4011067", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 140663, "upload_time": "2017-11-29T22:14:58", "url": "https://files.pythonhosted.org/packages/4b/96/e0a49a1e0277b28e145a55aff9abe6662cbf6a70a9493e1054797cebe575/syntribos-0.5.0.tar.gz" } ] }, "urls": [ { "comment_text": "", "digests": { "md5": "4caae657b19ee393ba81c33c14370279", "sha256": "63025bf28cc7883e11c53420ec8a083496a48b2b5ef4226fb5b4a4035e6a38f7" }, "downloads": -1, "filename": "syntribos-0.5.0-py2-none-any.whl", "has_sig": false, "md5_digest": "4caae657b19ee393ba81c33c14370279", "packagetype": "bdist_wheel", "python_version": "py2", "requires_python": null, "size": 132793, "upload_time": "2017-11-29T22:14:54", "url": "https://files.pythonhosted.org/packages/d3/34/0b3a859db864f34ef3f8d33e74472d86033c214df10b7ac3eb748783b764/syntribos-0.5.0-py2-none-any.whl" }, { "comment_text": "", "digests": { "md5": "1cda02387a611b4885e040e3f4011067", "sha256": "5c6b8ec6a7599fa6209465897407b73a8aecb8d1a46beac816f6481a6ee1a40c" }, "downloads": -1, "filename": "syntribos-0.5.0.tar.gz", "has_sig": false, "md5_digest": "1cda02387a611b4885e040e3f4011067", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 140663, "upload_time": "2017-11-29T22:14:58", "url": "https://files.pythonhosted.org/packages/4b/96/e0a49a1e0277b28e145a55aff9abe6662cbf6a70a9493e1054797cebe575/syntribos-0.5.0.tar.gz" } ] }