Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Detection Improvement

Abierto
  • ¿Algo no está bien?
#80 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
45/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
json, python
Área
data, security

Línea de trabajo

Start by reading the repository’s existing T1190 detection data and its neighboring detection entries to see how guidance is represented in STIX. Compare the proposed API patterns with that structure and references, then determine which additions fit the existing data model. Done means the agreed API-specific guidance is represented consistently in the relevant T1190 data.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

T1190 — Exploit Public-Facing Application: API-Specific Detection Guidance

Current state: T1190 detection focuses on web application exploit signatures. API exploitation patterns are underrepresented.

Proposed Detection Additions
Data Source Data Component Description
Application Log Application Log Content Monitor API gateway and application logs for requests containing anomalous parameter values in JSON request bodies, such as nested objects with unexpected depth, array parameters with abnormal element counts, or field names matching internal-only properties (role, isAdmin, permissions). These patterns may indicate mass assignment or injection attempts against API endpoints.
Application Log Application Log Content Monitor API authentication logs for JWT tokens with manipulated header parameters. Tokens containing "alg": "none", jku or x5u headers pointing to external domains, or kid values containing path traversal sequences (../) indicate API-specific exploitation attempts.
Network Traffic Network Traffic Content Monitor for HTTP requests to API endpoints containing Server-Side Request Forgery indicators in JSON body fields: internal IP addresses (127.0.0.1, 169.254.169.254, 10.x.x.x, 192.168.x.x), cloud metadata hostnames (metadata.google.internal), or unusual URL schemes (file://, gopher://) in parameters that accept URLs (webhookUrl, callbackUrl, importUrl, templateUrl).
Network Traffic Network Traffic Content Monitor API rate limiting headers (X-RateLimit-Remaining, Retry-After) in outbound responses. A high volume of 429 responses from API endpoints to a single source, combined with subsequent successful requests from varied source addresses, may indicate rate limit bypass attempts preceding credential stuffing or data scraping.
Cloud Service Cloud Service Metadata Monitor cloud API gateway access logs for OAuth scope escalation attempts — token requests where the requested scope exceeds the originally authorized scope, or API calls that use access tokens to perform operations outside the token's scope claim.
References
  • OWASP. (2023). OWASP API Security Top 10 2023. OWASP Foundation.
  • PortSwigger. (2023). API Testing Methodology. PortSwigger Web Security Academy.
Lenguaje dominante
Python
Estrellas
701
Forks
150
Sin PR fusionados en 30 d

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de mitre-attack/attack-stix-data

Todos los issues de mitre-attack/attack-stix-data

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.