Merge pull request akto-api-security#411 from akto-api-security/test_…

…name_modify

Test name modify

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/ContentTypeHeaderMissing.yaml

@@ -11,7 +11,7 @@ info:
  impact: "When the Content-Type header is missing, it can lead to various security risks, data integrity issues and possible DOS attacks"
  category:
  name: MHH
- shortName: MHH
+ shortName: Misconfigured HTTP Headers
  displayName: Misconfigured HTTP Headers (MHH)
  subCategory: CONTENT_TYPE_HEADER_MISSING
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/DjangoUrlExposed.yaml

@@ -1,6 +1,6 @@
 id: DJANGO_URL_EXPOSED
 info:
- name: Django url exposed
+ name: Django url exposed due to debug mode enable
  description: "The error response contains information related to urls which may help in more sophisticated attacks"
  details: >
  "The endpoint appears to be give out information related to endpoints existing in the application, on trying an invalid request, possibly due to DJANGO DEBUG mode being enabled. The original request
@@ -10,7 +10,7 @@ info:
  impact: "This information can be used to facilitate more sophisticated attacks on your application"
  category:
  name: VEM
- shortName: VEM
+ shortName: Verbose Error Messages
  displayName: Verbose Error Messages (VEM)
  subCategory: DJANGO_URL_EXPOSED
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/HeadMethodTest.yaml

@@ -18,7 +18,7 @@ info:
  money transactions and sending personal messages."
  category:
  name: UHM
- shortName: UHM
+ shortName: Unnecessary HTTP Methods
  displayName: Unnecessary HTTP Methods (UHM)
  subCategory: HEAD_METHOD_TEST
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/InvalidFileInput.yaml

@@ -1,6 +1,6 @@
 id: INVALID_FILE_INPUT
 info:
- name: Invalid File Input
+ name: Invalid File Input Leaking Sensitive Details Via Verbose Error Message
  description: "The error response contains information which may help in more sophisticated attacks"
  details: >
  "The error response contains information about the database or an inconsistent error message.<br>"
@@ -13,7 +13,7 @@ info:
  impact: "This information can be used to facilitate more sophisticated attacks on your application"
  category:
  name: VEM
- shortName: VEM
+ shortName: Verbose Error Messages
  displayName: Verbose Error Messages (VEM)
  subCategory: INVALID_FILE_INPUT
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/JwtAddJku.yaml

@@ -16,7 +16,7 @@ info:
  if the token contains a \"username\": \"joe\" claim, they could change this to \"username\": \"admin\"."
  category:
  name: NO_AUTH
- shortName: Broken Authentication
+ shortName: Broken User Authentication
  displayName: Broken User Authentication (BUA)
  subCategory: ADD_JKU_TO_JWT
  severity: HIGH

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/JwtInvalidSignature.yaml

@@ -14,7 +14,7 @@ info:
  contains a \"username\": \"joe\" claim, they could change this to \"username\": \"admin\"."
  category:
  name: NO_AUTH
- shortName: Broken Authentication
+ shortName: Broken User Authentication
  displayName: Broken User Authentication (BUA)
  subCategory: JWT_INVALID_SIGNATURE
  severity: HIGH

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/JwtNoneAlgo.yaml

@@ -13,7 +13,7 @@ info:
  They can also exploit this vulnerability by supplying an arbitrary claim in the JWT payload to escalate their privileges or impersonate other users. For example, if the token contains a \"username\": \"joe\" claim, they could change this to \"username\": \"admin\"."
  category:
  name: NO_AUTH
- shortName: Broken Authentication
+ shortName: Broken User Authentication
  displayName: Broken User Authentication (BUA)
  subCategory: JWT_NONE_ALGO
  severity: HIGH

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/MustContainResponseHeaders.yaml

@@ -1,6 +1,6 @@
 id: MUST_CONTAIN_RESPONSE_HEADERS
 info:
- name: Must contain response headers
+ name: Missing HTTP Response Headers
  description: "The response does not contain some HTTP security headers."
  details: >
  "The endpoint seems to be missing some HTTP security headers which provide yet another layer of 
@@ -13,7 +13,7 @@ info:
  impact: "This information can be used to facilitate more sophisticated attacks on your application."
  category:
  name: MHH
- shortName: MHH
+ shortName: Misconfigured HTTP Headers
  displayName: Misconfigured HTTP Headers (MHH)
  subCategory: MUST_CONTAIN_RESPONSE_HEADERS
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/OpenRedirect.yaml

@@ -9,7 +9,7 @@ info:
  impact: "This behavior can be leveraged to facilitate phishing attacks against users of the application."
  category:
  name: SM
- shortName: Misconfiguration
+ shortName: Security Misconfiguration
  displayName: Security Misconfiguration (SM)
  subCategory: OPEN_REDIRECT
  severity: HIGH

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/PageDos.yaml

@@ -1,6 +1,6 @@
 id: PAGINATION_MISCONFIGURATION
 info:
- name: Possible Dos by Pagination misconfiguration
+ name: Possible DOS attack by Pagination misconfiguration
  description: "Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the user."
  details: "Such vulnerabilities arise when there is no max limit imposed on the number of resources returned. Typically, the number of objects to be returned is provided by a parameter in the API call. An attacker can set it as a large number. "
  impact: "This can impact the API server performance, leading to Denial of Service (DoS). It also leaves the door open to authentication flaws such as brute force."

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/RandomMethodTest.yaml

@@ -18,7 +18,7 @@ info:
  money transactions and sending personal messages."
  category:
  name: UHM
- shortName: UHM
+ shortName: Unnecessary HTTP Methods
  displayName: Unnecessary HTTP Methods (UHM)
  subCategory: RANDOM_METHOD_TEST
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnAWSMetaEndpointAbusingEnclosedAlphanumerics.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_AWS_META_ENDPOINT_ENCLOSED
 info:
- name: "Sensitive AWS details exposed via replacing url param with encoded url"
+ name: "Sensitive AWS details exposed via replacing url param with encoded url due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with metadata endpoint provided by AWS in enclosed alphanumerics. The application responded with 2XX success code and also gave out sensitive AWS information in response."
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with metadata endpoint provided by AWS in enclosed alphanumerics. The application responded with 2XX success code and also gave out sensitive AWS information in response. Server-Side Request Forgery (SSRF) flaws occur whenever an API is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.\n

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnCSVUpload.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_CSV_UPLOAD
 info:
- name: "Sensitive AWS details exposed via replacing CSV param"
+ name: "Sensitive AWS details exposed via replacing CSV param due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing CSV upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response."
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing CSV upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response. Server-Side Request Forgery (SSRF) flaws occur whenever an API is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.\n

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnFiles.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_FILES
 info:
- name: "Sensitive AWS details exposed via replacing file param"
+ name: "Sensitive AWS details exposed via replacing file param due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing file parameter with sensitive file path. The application responded with 2XX success code and also gave out sensitive AWS information in response."
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replayed by replacing file parameter with sensitive file path. The application responded with 2XX success code and also gave out sensitive AWS information in response. Server-Side Request Forgery (SSRF) flaws occur whenever an API is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.\n

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnImageUpload.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_IMAGE_UPLOAD
 info:
- name: "Sensitive AWS details exposed via replacing image param"
+ name: "Sensitive AWS details exposed via replacing image param due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing image upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response."
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing image upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response. Server-Side Request Forgery (SSRF) flaws occur whenever an API is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.\n

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnLocalhost.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_LOCALHOST
 info:
- name: "Sensitive localhost details exposed via replacing URI param with localhost/admin"
+ name: "Sensitive localhost details exposed via replacing URI param with localhost/admin due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin. The application responded with 2XX success code and also gave out admin-related details." 
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin. The application responded with 2XX success code and also gave out admin-related details.

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnLocalhostDNSPinning.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_LOCALHOST_DNS_PINNING
 info:
- name: "Sensitive localhost details exposed via replacing URI param redirecting to localhost/admin"
+ name: "Sensitive localhost details exposed via replacing URI param redirecting to localhost/admin due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin. The make-127-0-0-1-rr.1u.ms/admin which redirects to localhost/admin." 
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin. The make-127-0-0-1-rr.1u.ms/admin which redirects to localhost/admin.

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnLocalhostEncoded.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_LOCALHOST_ENCODED
 info:
- name: "Sensitive localhost details exposed via replacing URI param to encoded localhost/admin"
+ name: "Sensitive localhost details exposed via replacing URI param to encoded localhost/admin due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin in an encoded format. The application responded with 2XX success code and also gave out admin-related details." 
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing the URI parameter with localhost/admin in an encoded format. The application responded with 2XX success code and also gave out admin-related details.

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnPDFUpload.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_PDF_UPLOAD
 info:
- name: "Sensitive AWS details exposed via replace PDF param"
+ name: "Sensitive AWS details exposed via replace PDF param due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing PDF upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response."
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing PDF upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response. Server-Side Request Forgery (SSRF) flaws occur whenever an API is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.\n

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/SSRFOnXMLUpload.yaml

@@ -1,6 +1,6 @@
 id: SSRF_ON_XML_UPLOAD
 info:
- name: "Sensitive AWS details exposed via replacing XML param"
+ name: "Sensitive AWS details exposed via replacing XML param due to SSRF"
  description: "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing XML upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response."
  details: >
  "The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing XML upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response. Server-Side Request Forgery (SSRF) flaws occur whenever an API is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.\n

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/ServerVersionExposedInvalid.yaml

@@ -16,7 +16,7 @@ info:
  server or compromise its integrity"
  category:
  name: SVD
- shortName: SVD
+ shortName: Server Version Disclosure
  displayName: Server Version Disclosure (SVD)
  subCategory: SERVER_VERSION_EXPOSED_IN_AN_INVALID_REQUEST
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/ServerVersionExposedValid.yaml

@@ -16,7 +16,7 @@ info:
  server or compromise its integrity"
  category:
  name: SVD
- shortName: SVD
+ shortName: Server Version Disclosure
  displayName: Server Version Disclosure (SVD)
  subCategory: SERVER_VERSION_EXPOSED_VIA_RESPONSE_HEADER
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/TraceMethodTest.yaml

@@ -11,7 +11,7 @@ info:
  impact: "TRACE method can be used for debugging purposes. It repeats the content of a request, and an attacker could steal credentials by using a client-side attack."
  category:
  name: UHM
- shortName: UHM
+ shortName: Unnecessary HTTP Methods
  displayName: Unnecessary HTTP Methods (UHM)
  subCategory: TRACE_METHOD_TEST
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/TrackMethodTest.yaml

@@ -11,7 +11,7 @@ info:
  impact: "TRACK method can be used for debugging purposes. It repeats the content of a request, and an attacker could steal credentials by using a client-side attack."
  category:
  name: UHM
- shortName: UHM
+ shortName: Unnecessary HTTP Methods
  displayName: Unnecessary HTTP Methods (UHM)
  subCategory: TRACK_METHOD_TEST
  severity: LOW

apps/dashboard/src/main/resources/inbuilt_test_yaml_files/UnwantedResponseHeaders.yaml

@@ -10,7 +10,7 @@ info:
  impact: "This information can be used to facilitate more sophisticated attacks on your application."
  category:
  name: MHH
- shortName: MHH
+ shortName: Misconfigured HTTP Headers
  displayName: Misconfigured HTTP Headers (MHH)
  subCategory: UNWANTED_RESPONSE_HEADERS
  severity: LOW