⛏️ Write a test to check whether we can create/update an object with invalid Integer causing buffer overflows

[arjun-akto]

💭 Introduction:

We want a test to check whether an attacker can create/update entity with an invalid Integer value, possibly causing buffer overflows.

🎯 Requirements:

1. Filters - API with Integer as an input in GET query parameter or JSON body parameter

2. Execute - It should replace the value with

• special characters
• A very long string (> 255 characters)
• Use whitespaces
• A negative integer
• A very long integer causing integer overflow
• Zero
• NULL
• NULL character

3. Validation - If the application responds with a exception trace, it is a vulnerability.

📚 Reading

You can find a detailed documentation of test editor rules [here]

Find 100+ examples of YAML tests [here]

✅ Task summary:

• Ask to be assigned to the issue.
• Wait to be assigned. We will try to assign in less than 2 hours.
• Signup for [Akto](https://app.akto.io/)
• Fork the [tests-library] repository, create a new branch and commit the yaml file which will be called in your test.
• Submit both the PR here.

✌🏻 Hints:

You can build the yaml template by referring this [link]

🙋🏼‍♂️ Questions:

If you have questions, need any help, or just want to hang out, make sure to join us on our [Discord server].

[coder-oj]

Hi, can you please assign this issue to me?
@arjun-akto

[arjun-akto]

Hi @coder-oj . I have assigned the issue to you. Please feel free to connect us on our Discord server for any doubts.

[harshalkh]

@arjun-akto could you please assign this to me? I have some analysis on this one.

[arjun-akto]

Hi @harshalkh . I have assigned the issue to you. Please feel free to connect us on our Discord server for any doubts.

[harshalkh]

@arjun-akto I have raised PR, can you please review...

[avneesh-akto]

Added comments to the PR

[harshalkh]

Added comments to the PR

Let me check

[ankush-jain-akto]

This looks like a close-to-good test. I think it still needs some very small edits, but I will merge it for now

[RaagaAkto]

Hi @harshalkh, please fill out this form here so we can send you Akto swags. Will let you know ETA of swags soon, thanks for your contribution! 🚀

[RaagaAkto]

Hi @harshalkh, we've received your details, swags should reach you in a month!