Create 13.1.3.yaml (#11)

* Create 13.1.3.yaml

Based on requirement 13.1.3, this template checks whether the API URLs expose sensitive Information through query strings.

Signed-off-by: Hamed Salimian <[email protected]>

.github/workflows/template-sign.yml

@@ -14,16 +14,28 @@ jobs:
     if: github.repository == 'OWASP/www-project-asvs-security-evaluation-templates-with-nuclei'
     steps:
       - uses: actions/checkout@v4
+
       - uses: projectdiscovery/actions/setup/nuclei@v1
       - run: nuclei -lfa -duc -sign -ud $GITHUB_WORKSPACE -t .
         env:
           NUCLEI_USER_CERTIFICATE: ${{ secrets.NUCLEI_USER_CERTIFICATE }}
           NUCLEI_USER_PRIVATE_KEY: ${{ secrets.NUCLEI_USER_PRIVATE_KEY }}
+
+      # Set up GPG for automatic commit signing
+      - name: Set up GPG
+        run: |
+          echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import
+          git config --global user.name "Signing Bot"
+          git config --global user.email "[email protected]"
+          git config --global commit.gpgSign true
+          git config --global user.signingkey ${{ secrets.GPG_KEY_ID }}
+
       - uses: projectdiscovery/actions/setup/git@v1
       - uses: projectdiscovery/actions/commit@v1
         with:
           files: '.'
           message: 'chore: sign templates 🤖'
+
       - name: Push changes
         run: |
           git pull origin $GITHUB_REF --rebase

templates/9.1.3.yaml

@@ -45,4 +45,4 @@ ssl:
       - type: json
         json:
           - " .tls_version"
-# digest: 4a0a00473045022065282575a135691de3ce419d2ea546daa99ef87c3fa4742f597f5f081a4b2118022100fbae7e4a55c4493731649f3929a8e1fcd831156092c7e31e0cbc96a76c37d56a:236a7c23afe836fbe231d6e037cff444
+# digest: 4b0a00483046022100ad668aabd5f22ba949265c214a22dd6393fc9d65118f5551704be20c9791b4fa022100a7d26f7b256f003b8db0d8794e22f7e63f051f5674b5ff4ed8a01b6cfa8787e3:236a7c23afe836fbe231d6e037cff444

templates/code/12.1.1.2.yaml

@@ -56,5 +56,4 @@ http:
         status:
           - 500
           - 503
-
-# digest: 4b0a00483046022100a1a000f9e17a6e0742509f92e5bfc0bff3e4593e92006c1df43768dd84f93a56022100ee377b3ab8e4140a4b89335af54301c3603f629fdb11d7b2bca8f1d93f58342a:236a7c23afe836fbe231d6e037cff444
+# digest: 490a00463044022028a06b48a69139c9fccf8c6eb53a580241f2f1938a086024b52e7a3ca70323f102204a76989a347bb16dbb1d946dfaa0db5bb074cc279cd27f543eec2b4d6c405a51:236a7c23afe836fbe231d6e037cff444

templates/headless/13.1.3.yaml

@@ -0,0 +1,45 @@
+id: ASVS-4-0-3-V13-1-3
+
+info:
+  name: ASVS 13.1.3 Check
+  author: Hamed Salimian
+  severity: medium
+  classification:
+    cwe-id: CWE-598
+  reference:
+    - https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/06-Session_Management_Testing/04-Testing_for_Exposed_Session_Variables.html
+    - https://github.com/danielmiessler/SecLists/blob/master/Discovery/Variables/secret-keywords.txt
+    - https://github.com/danielmiessler/SecLists/blob/master/Miscellaneous/Web/session-id.txt
+  tags: asvs,13.1.3
+  description: |
+    Verify API URLs do not expose sensitive information, such as the API key, session tokens etc.
+
+
+headless:
+  - steps:
+      - args:
+          url: "{{BaseURL}}"
+        action: navigate
+
+      - action: waitload
+
+      - action: script
+        name: urls
+        args:
+          code: |
+            () => {
+             return [...new Set(Array.from(document.querySelectorAll('[src], [href], [url], [action]')).map(i => i.src || i.href || i.url || i.action))].join('\r\n')
+            }
+
+    extractors:
+      - type: regex
+        part: urls
+        regex:
+          - (i?)(https?|wss?)://[^\s?]+(?:\?|&)(?:session|ASP.NET_SessionId|ASPSESSIONID|SITESERVER|cfid|cftoken|jsessionid|sessid|sid|viewstate|zenid|PHPSESSID|ConsumerKey|ConsumerSecret|DB_USERNAME|HEROKU_API_KEY|HOMEBREW_GITHUB_API_TOKEN|JEKYLL_GITHUB_TOKEN|PT_TOKEN|SESSION_TOKEN|SF_USERNAME|SLACK_BOT_TOKEN|access-token|access_token|access_token_secret|accesstoken|admin|api-key|api_key|api_secret_key|api_token|auth_token|authkey|authorization|authorization_key|authorization_token|authtoken|aws_access_key_id|aws_secret_access_key|bearer|bot_access_token|bucket|client-secret|client_id|client_key|client_secret|clientsecret|consumer_key|consumer_secret|dbpasswd|email|encryption-key|encryption_key|encryptionkey|id_dsa|irc_pass|key|oauth_token|pass|password|private_key|private-key|privatekey|secret|secret-key|secret_key|secret_token|secretkey|secretkey|session_key|session_secret|slack_api_token|slack_secret_token|slack_token|ssh-key|ssh_key|sshkey|token|username|xoxa-2|xoxr)=[^&\s]+
+
+    matchers:
+      - type: regex
+        part: urls
+        regex:
+          - (i?)(https?|wss?)://[^\s?]+(?:\?|&)(?:session|ASP.NET_SessionId|ASPSESSIONID|SITESERVER|cfid|cftoken|jsessionid|sessid|sid|viewstate|zenid|PHPSESSID|ConsumerKey|ConsumerSecret|DB_USERNAME|HEROKU_API_KEY|HOMEBREW_GITHUB_API_TOKEN|JEKYLL_GITHUB_TOKEN|PT_TOKEN|SESSION_TOKEN|SF_USERNAME|SLACK_BOT_TOKEN|access-token|access_token|access_token_secret|accesstoken|admin|api-key|api_key|api_secret_key|api_token|auth_token|authkey|authorization|authorization_key|authorization_token|authtoken|aws_access_key_id|aws_secret_access_key|bearer|bot_access_token|bucket|client-secret|client_id|client_key|client_secret|clientsecret|consumer_key|consumer_secret|dbpasswd|email|encryption-key|encryption_key|encryptionkey|id_dsa|irc_pass|key|oauth_token|pass|password|private_key|private-key|privatekey|secret|secret-key|secret_key|secret_token|secretkey|secretkey|session_key|session_secret|slack_api_token|slack_secret_token|slack_token|ssh-key|ssh_key|sshkey|token|username|xoxa-2|xoxr)=[^&\s]+
+# digest: 4a0a0047304502200bb9a7013c8b23ed6d393454ecc8d3490da0969a5941940b992a0d840a4ec6de022100a2ff4b3d7ae8fd710402c65a53e16516fa5b41e02b7655cb678965104a89d3b3:236a7c23afe836fbe231d6e037cff444