Home / Attacks & tests / AJAX weakness
1 test case
AJAX weakness
AJAX testing examines the requests an application issues from script rather than from a form submission. The endpoints behind them are ordinary server endpoints, but they are frequently designed on the assumption that only the application's own script will ever call them.
What an attacker is trying to achieve
The attacker calls these endpoints directly, without the script that normally wraps them, and without whatever the interface was doing to constrain the request. What the interface treated as a private helper is simply another entry point.
Test cases
1 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
WEB-AJAX-01 AJAX Endpoint Weaknesses
Objective — Determine whether endpoints intended to be called only by the application's own client-side code enforce the same authentication, authorisation and validation as the interface that normally calls them.
How it is tested — Extract every script-invoked endpoint from captured traffic and from the client bundles, including those reached only on branches the interface rarely takes. Call each directly, without the expected headers, without a session, and with a session belonging to another role. Vary content type and method, and submit parameters the client always sends fixed. Establish whether these endpoints return more data than the interface displays, which is common where the client filters the response.
Prerequisites — Captured traffic and the client-side bundles; accounts at more than one role; a client able to issue requests without the application's script.
Indicators — An endpoint responding without the expected headers or session; a response containing fields the interface never displays; validation applied by the client and not the server.
Coverage — WSTG-CLNT-02WSTG-ATHZ-02V13.2.1CWE-602CWE-285
Depth — Manual The productive part is reading the client bundle for endpoints that captured traffic never exercised.
What we need from you
The application exercised through a proxy so every script-issued request is captured; accounts at each role; and the client-side bundles retrieved, since endpoints invoked only on rare branches appear there and nowhere else.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- WSTG-CLNT-02 — Testing for JavaScript Execution
- WSTG-ATHZ-02 — Testing for Bypassing Authorization Schema
- V13.2.1 — Verify that enabled RESTful HTTP methods are a valid choice for the user or action, such as preventing normal users using DELETE or PUT on protected API or resources.
- CWE-602 — Client-Side Enforcement of Server-Side Security
- CWE-285 — Improper Authorization
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.