Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

3078 test unauthenticated requests rejected #3217

Merged
merged 2 commits into from
Apr 10, 2023
Merged

3078 test unauthenticated requests rejected #3217

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e75ecc1
BB: Add a test for unauthenticated API access
mssalvatore Apr 10, 2023
ea5323c
BB: Fix typehints in MonkeyIslandRequests.*_json()
mssalvatore Apr 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions envs/monkey_zoo/blackbox/island_client/monkey_island_requests.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
import logging
from http import HTTPStatus
from typing import Dict

import requests

from common.types import JSONSerializable

from .i_monkey_island_requests import IMonkeyIslandRequests

ISLAND_USERNAME = "test"
Expand Down Expand Up @@ -89,17 +90,17 @@ def put(self, url, data):
self.addr + url, data=data, headers=self.get_auth_header(), verify=False
)

def put_json(self, url, json: Dict):
def put_json(self, url, json: JSONSerializable):
return requests.put( # noqa: DUO123
self.addr + url, json=json, headers=self.get_auth_header(), verify=False
)

def post_json(self, url, json: Dict):
def post_json(self, url, json: JSONSerializable):
return requests.post( # noqa: DUO123
self.addr + url, json=json, headers=self.get_auth_header(), verify=False
)

def patch(self, url, data: Dict):
def patch(self, url, data: JSONSerializable):
return requests.patch( # noqa: DUO123
self.addr + url, data=data, headers=self.get_auth_header(), verify=False
)
Expand Down
70 changes: 70 additions & 0 deletions envs/monkey_zoo/blackbox/test_blackbox.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,6 +316,76 @@ def test_agent__cannot_access_nonagent_endpoints(island):
)


def test_unauthenticated_user_cannot_access_API(island):
island_requests = MonkeyIslandRequests(island)

assert (
island_requests.post(AGENT_EVENTS_ENDPOINT, data=None).status_code
== HTTPStatus.UNAUTHORIZED
)
assert (
island_requests.post(AGENT_HEARTBEAT_ENDPOINT, data=None).status_code
== HTTPStatus.UNAUTHORIZED
)
assert island_requests.put(PUT_LOG_ENDPOINT, data=None).status_code == HTTPStatus.UNAUTHORIZED
assert island_requests.get(GET_AGENT_PLUGINS_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.get("/api/agent-plugins/plugin-type/plugin-name/manifest").status_code
== HTTPStatus.UNAUTHORIZED
)
assert island_requests.get(GET_AGENT_SIGNALS_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.post(GET_AGENTS_ENDPOINT, data=None).status_code == HTTPStatus.UNAUTHORIZED
)
assert island_requests.get(GET_AGENT_EVENTS_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert island_requests.get(PUT_LOG_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.post(TERMINATE_AGENTS_ENDPOINT, data=None).status_code
== HTTPStatus.UNAUTHORIZED
)
Comment on lines +319 to +345
Copy link
Contributor

@ilija-lazoroski ilija-lazoroski Apr 10, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Long test. At least let's divide them by method: POST, GET, and PUT.

Copy link
Collaborator Author

@mssalvatore mssalvatore Apr 10, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think an all around better approach would be to publish something like an OpenAPI spec and then redesign this test to programatically try all endpoints, but that's out of scope for this release.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Breaking these up could result in a large number of login requests which is unnecessary. A whole lot of refactoring needs to happen in this file anyway. I say we just push it until later.

assert island_requests.get(GET_AGENTS_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.post(CLEAR_SIMULATION_DATA_ENDPOINT, data=None).status_code
== HTTPStatus.UNAUTHORIZED
)
assert island_requests.get(MONKEY_EXPLOITATION_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert island_requests.get(GET_ISLAND_LOG_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert island_requests.get(ISLAND_MODE_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.put(ISLAND_MODE_ENDPOINT, data=None).status_code == HTTPStatus.UNAUTHORIZED
)
assert (
island_requests.post(ISLAND_RUN_ENDPOINT, data=None).status_code == HTTPStatus.UNAUTHORIZED
)
assert island_requests.get(GET_MACHINES_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert island_requests.get(GET_NODES_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.put(PROPAGATION_CREDENTIALS_ENDPOINT, data=None).status_code
== HTTPStatus.UNAUTHORIZED
)
assert (
island_requests.get(PROPAGATION_CREDENTIALS_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
)
assert (
island_requests.get(GET_RANSOMWARE_REPORT_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
)
assert island_requests.get(REMOTE_RUN_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.post(REMOTE_RUN_ENDPOINT, data=None).status_code == HTTPStatus.UNAUTHORIZED
)
assert island_requests.get(GET_REPORT_STATUS_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.post(RESET_AGENT_CONFIG_ENDPOINT, data=None).status_code
== HTTPStatus.UNAUTHORIZED
)
assert island_requests.get(GET_SECURITY_REPORT_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert island_requests.get(GET_ISLAND_VERSION_ENDPOINT).status_code == HTTPStatus.UNAUTHORIZED
assert (
island_requests.put(PUT_AGENT_CONFIG_ENDPOINT, data=None).status_code
== HTTPStatus.UNAUTHORIZED
)


LOGOUT_AGENT_ID = uuid4()


Expand Down