Skip to content

Instantly share code, notes, and snippets.

@kmcquade

kmcquade/README.md

Last active August 22, 2024 18:58
Show Gist options
  • Save kmcquade/65201c1bd45dfd5ac7f612ae29d24939 to your computer and use it in GitHub Desktop.
Save kmcquade/65201c1bd45dfd5ac7f612ae29d24939 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
README.md

This is an interesting exercise in how ZAP handles Swagger files on import. My primary concern is that ZAP does not support importing injectable URL parameters from a Swagger file, and interprets a path like {id} as a literal id string.

You can see the difference between the endpoints that NightVision discovers (on the left) and the spidered URLs from ZAP (on the right): https://www.diffchecker.com/JKaeR6rg/ (expires in 30 days).

If you clone this gist, you can run python3 print_endpoints.py to print the endpoints that are in swagger-paths.csv (the ones discovered by NightVision).

And you can see the endpoints that are discovered by the ZAP Spider in spidered-paths.csv.

Observation

  • Notice how when a URL like http://juice-shop:3000/api/Addresss/{id} is provided to ZAP, ZAP imports a URL like this: http://juice-shop:3000/api/Addresss/id. It does not consider id to be an injectable parameter, but it should!
Raw
juice-shop-nv-swagger.yml
components: {}
info:
title: juice-shop-api
version: "0.1"
description: This OpenAPI Spec was generated by NightVision Security's API Discovery product. Please contact NightVision for more information or commercial inquiries.
contact:
name: NightVision API Testing
email: [email protected]
url: https://www.nightvision.net/support
termsOfService: https://www.nightvision.net/policies/terms-of-use
license:
name: Commercial License by NightVision
url: https://www.nightvision.net/contact-us
openapi: 3.0.0
paths:
/api/Addresss:
get:
operationId: api_Addresss_GET
responses:
default:
description: Default response
x-name: api_Addresss_GET
x-source: server.ts~~409
post:
operationId: api_Addresss_POST
responses:
default:
description: Default response
x-name: api_Addresss_POST
x-source: server.ts~~408
x-name: api_Addresss
/api/Addresss/{id}:
delete:
operationId: api_Addresss_{id}_DELETE
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Addresss_{id}_DELETE
x-source: server.ts~~411
get:
operationId: api_Addresss_{id}_GET
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Addresss_{id}_GET
x-source: server.ts~~412
put:
operationId: api_Addresss_{id}_PUT
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Addresss_{id}_PUT
x-source: server.ts~~410
x-name: api_Addresss_{id}
/api/BasketItems:
post:
operationId: api_BasketItems_POST
responses:
default:
description: Default response
x-name: api_BasketItems_POST
x-source: server.ts~~387
x-name: api_BasketItems
/api/BasketItems/{id}:
put:
operationId: api_BasketItems_{id}_PUT
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_BasketItems_{id}_PUT
x-source: server.ts~~386
x-name: api_BasketItems_{id}
/api/Cards:
get:
operationId: api_Cards_GET
responses:
default:
description: Default response
x-name: api_Cards_GET
x-source: server.ts~~399
post:
operationId: api_Cards_POST
responses:
default:
description: Default response
x-name: api_Cards_POST
x-source: server.ts~~398
x-name: api_Cards
/api/Cards/{id}:
delete:
operationId: api_Cards_{id}_DELETE
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Cards_{id}_DELETE
x-source: server.ts~~401
get:
operationId: api_Cards_{id}_GET
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Cards_{id}_GET
x-source: server.ts~~402
put:
operationId: api_Cards_{id}_PUT
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Cards_{id}_PUT
x-source: server.ts~~400
x-name: api_Cards_{id}
/api/Challenges:
post:
operationId: api_Challenges_POST
responses:
default:
description: Default response
x-name: api_Challenges_POST
x-source: server.ts~~338
x-name: api_Challenges
/api/Complaints:
get:
operationId: api_Complaints_GET
responses:
default:
description: Default response
x-name: api_Complaints_GET
x-source: server.ts~~341
post:
operationId: api_Complaints_POST
responses:
default:
description: Default response
x-name: api_Complaints_POST
x-source: server.ts~~342
x-name: api_Complaints
/api/Deliverys:
get:
operationId: api_Deliverys_GET
responses:
default:
description: Default response
x-name: api_Deliverys_GET
x-source: server.ts~~413
x-name: api_Deliverys
/api/Deliverys/{id}:
get:
operationId: api_Deliverys_{id}_GET
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Deliverys_{id}_GET
x-source: server.ts~~414
x-name: api_Deliverys_{id}
/api/Feedbacks:
post:
operationId: api_Feedbacks_POST
responses:
default:
description: Default response
x-name: api_Feedbacks_POST
x-source: server.ts~~362
x-name: api_Feedbacks
/api/Feedbacks/{id}:
put:
operationId: api_Feedbacks_{id}_PUT
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Feedbacks_{id}_PUT
x-source: server.ts~~393
x-name: api_Feedbacks_{id}
/api/PrivacyRequests:
get:
operationId: api_PrivacyRequests_GET
responses:
default:
description: Default response
x-name: api_PrivacyRequests_GET
x-source: server.ts~~405
post:
operationId: api_PrivacyRequests_POST
responses:
default:
description: Default response
x-name: api_PrivacyRequests_POST
x-source: server.ts~~404
x-name: api_PrivacyRequests
/api/Products:
post:
operationId: api_Products_POST
responses:
default:
description: Default response
x-name: api_Products_POST
x-source: server.ts~~334
x-name: api_Products
/api/Products/{id}:
delete:
operationId: api_Products_{id}_DELETE
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Products_{id}_DELETE
x-source: server.ts~~336
x-name: api_Products_{id}
/api/Quantitys:
post:
operationId: api_Quantitys_POST
responses:
default:
description: Default response
x-name: api_Quantitys_POST
x-source: server.ts~~390
x-name: api_Quantitys
/api/Quantitys/{id}:
delete:
operationId: api_Quantitys_{id}_DELETE
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Quantitys_{id}_DELETE
x-source: server.ts~~389
x-name: api_Quantitys_{id}
/api/Recycles:
get:
operationId: api_Recycles_GET
responses:
default:
description: Default response
x-name: api_Recycles_GET
x-source: server.ts~~345
post:
operationId: api_Recycles_POST
responses:
default:
description: Default response
x-name: api_Recycles_POST
x-source: server.ts~~346
x-name: api_Recycles
/api/Recycles/{id}:
delete:
operationId: api_Recycles_{id}_DELETE
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Recycles_{id}_DELETE
x-source: server.ts~~350
get:
operationId: api_Recycles_{id}_GET
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Recycles_{id}_GET
x-source: server.ts~~348
put:
operationId: api_Recycles_{id}_PUT
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Recycles_{id}_PUT
x-source: server.ts~~349
x-name: api_Recycles_{id}
/api/SecurityAnswers:
get:
operationId: api_SecurityAnswers_GET
responses:
default:
description: Default response
x-name: api_SecurityAnswers_GET
x-source: server.ts~~355
x-name: api_SecurityAnswers
/api/SecurityQuestions:
post:
operationId: api_SecurityQuestions_POST
responses:
default:
description: Default response
x-name: api_SecurityQuestions_POST
x-source: server.ts~~352
x-name: api_SecurityQuestions
/api/Users:
get:
operationId: api_Users_GET
responses:
default:
description: Default response
x-name: api_Users_GET
x-source: server.ts~~328
post:
operationId: api_Users_POST
requestBody:
content:
application/json:
schema:
properties:
email:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
password:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
passwordRepeat:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
type: object
x-field-kind: normal
x-field-original-type: object
x-field-type: object
x-code: ""
responses:
default:
description: Default response
x-name: api_Users_POST
x-source: server.ts~~368
x-name: api_Users
/api/Users/{id}:
delete:
operationId: api_Users_{id}_DELETE
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Users_{id}_DELETE
x-source: server.ts~~329
get:
operationId: api_Users_{id}_GET
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Users_{id}_GET
x-source: server.ts~~329
put:
operationId: api_Users_{id}_PUT
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: api_Users_{id}_PUT
x-source: server.ts~~329
x-name: api_Users_{id}
/array_844:
get:
operationId: array_844_GET
responses:
default:
description: Default response
x-name: array_844_GET
x-source: server.ts~~195
x-name: array_844
/b2b/v2/orders:
post:
operationId: b2b_v2_orders_POST
responses:
default:
description: Default response
x-name: b2b_v2_orders_POST
x-source: server.ts~~598
x-name: b2b_v2_orders
/dataerasure/:
get:
operationId: dataerasure_GET
responses:
default:
description: Default response
x-name: dataerasure_GET
x-source: routes/dataErasure.ts~~18
post:
operationId: dataerasure_POST
requestBody:
content:
application/json:
schema:
properties:
layout:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
type: object
x-field-kind: normal
x-field-original-type: object
x-field-type: object
x-code: ""
responses:
default:
description: Default response
x-name: dataerasure_POST
x-source: routes/dataErasure.ts~~54
x-name: dataerasure
/file-upload:
post:
operationId: file-upload_POST
responses:
default:
description: Default response
x-name: file-upload_POST
x-source: server.ts~~277
x-name: file-upload
/metrics:
get:
operationId: metrics_GET
responses:
default:
description: Default response
x-name: metrics_GET
x-source: server.ts~~674
x-name: metrics
/profile:
get:
operationId: profile_GET
responses:
default:
description: Default response
x-name: profile_GET
x-source: server.ts~~616
post:
operationId: profile_POST
responses:
default:
description: Default response
x-name: profile_POST
x-source: server.ts~~617
x-name: profile
/profile/image/file:
post:
operationId: profile_image_file_POST
responses:
default:
description: Default response
x-name: profile_image_file_POST
x-source: server.ts~~278
x-name: profile_image_file
/profile/image/url:
post:
operationId: profile_image_url_POST
requestBody:
content:
application/json:
schema:
properties:
imageUrl:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
type: object
x-field-kind: normal
x-field-original-type: object
x-field-type: object
x-code: ""
responses:
default:
description: Default response
x-name: profile_image_url_POST
x-source: server.ts~~279
x-name: profile_image_url
/promotion:
get:
operationId: promotion_GET
responses:
default:
description: Default response
x-name: promotion_GET
x-source: server.ts~~612
x-name: promotion
/redirect:
get:
operationId: redirect_GET
responses:
default:
description: Default response
x-name: redirect_GET
x-source: server.ts~~609
x-name: redirect
/rest/2fa/disable:
post:
operationId: rest_2fa_disable_POST
responses:
default:
description: Default response
x-name: rest_2fa_disable_POST
x-source: server.ts~~431
x-name: rest_2fa_disable
/rest/2fa/setup:
post:
operationId: rest_2fa_setup_POST
responses:
default:
description: Default response
x-name: rest_2fa_setup_POST
x-source: server.ts~~425
x-name: rest_2fa_setup
/rest/2fa/status:
get:
operationId: rest_2fa_status_GET
responses:
default:
description: Default response
x-name: rest_2fa_status_GET
x-source: server.ts~~423
x-name: rest_2fa_status
/rest/2fa/verify:
post:
operationId: rest_2fa_verify_POST
responses:
default:
description: Default response
x-name: rest_2fa_verify_POST
x-source: server.ts~~418
x-name: rest_2fa_verify
/rest/admin/application-configuration:
get:
operationId: rest_admin_application-configuration_GET
responses:
default:
description: Default response
x-name: rest_admin_application-configuration_GET
x-source: server.ts~~557
x-name: rest_admin_application-configuration
/rest/admin/application-version:
get:
operationId: rest_admin_application-version_GET
responses:
default:
description: Default response
x-name: rest_admin_application-version_GET
x-source: server.ts~~556
x-name: rest_admin_application-version
/rest/basket/{id}:
get:
operationId: rest_basket_{id}_GET
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_basket_{id}_GET
x-source: server.ts~~553
x-name: rest_basket_{id}
/rest/basket/{id}/checkout:
post:
operationId: rest_basket_{id}_checkout_POST
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_basket_{id}_checkout_POST
x-source: server.ts~~554
x-name: rest_basket_{id}_checkout
/rest/basket/{id}/coupon/{coupon}:
put:
operationId: rest_basket_{id}_coupon_{coupon}_PUT
parameters:
- in: path
name: coupon
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_basket_{id}_coupon_{coupon}_PUT
x-source: server.ts~~555
x-name: rest_basket_{id}_coupon_{coupon}
/rest/captcha:
get:
operationId: rest_captcha_GET
responses:
default:
description: Default response
x-name: rest_captcha_GET
x-source: server.ts~~566
x-name: rest_captcha
/rest/chatbot/respond:
post:
operationId: rest_chatbot_respond_POST
requestBody:
content:
application/json:
schema:
properties:
action:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
query:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
type: object
x-field-kind: normal
x-field-original-type: object
x-field-type: object
x-code: ""
responses:
default:
description: Default response
x-name: rest_chatbot_respond_POST
x-source: server.ts~~583
x-name: rest_chatbot_respond
/rest/chatbot/status:
get:
operationId: rest_chatbot_status_GET
responses:
default:
description: Default response
x-name: rest_chatbot_status_GET
x-source: server.ts~~582
x-name: rest_chatbot_status
/rest/continue-code:
get:
operationId: rest_continue-code_GET
responses:
default:
description: Default response
x-name: rest_continue-code_GET
x-source: server.ts~~559
x-name: rest_continue-code
/rest/continue-code-findIt:
get:
operationId: rest_continue-code-findIt_GET
responses:
default:
description: Default response
x-name: rest_continue-code-findIt_GET
x-source: server.ts~~560
x-name: rest_continue-code-findIt
/rest/continue-code-findIt/apply/{continueCode}:
put:
operationId: rest_continue-code-findIt_apply_{continueCode}_PUT
parameters:
- in: path
name: continueCode
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_continue-code-findIt_apply_{continueCode}_PUT
x-source: server.ts~~562
x-name: rest_continue-code-findIt_apply_{continueCode}
/rest/continue-code-fixIt:
get:
operationId: rest_continue-code-fixIt_GET
responses:
default:
description: Default response
x-name: rest_continue-code-fixIt_GET
x-source: server.ts~~561
x-name: rest_continue-code-fixIt
/rest/continue-code-fixIt/apply/{continueCode}:
put:
operationId: rest_continue-code-fixIt_apply_{continueCode}_PUT
parameters:
- in: path
name: continueCode
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_continue-code-fixIt_apply_{continueCode}_PUT
x-source: server.ts~~563
x-name: rest_continue-code-fixIt_apply_{continueCode}
/rest/continue-code/apply/{continueCode}:
put:
operationId: rest_continue-code_apply_{continueCode}_PUT
parameters:
- in: path
name: continueCode
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_continue-code_apply_{continueCode}_PUT
x-source: server.ts~~564
x-name: rest_continue-code_apply_{continueCode}
/rest/country-mapping:
get:
operationId: rest_country-mapping_GET
responses:
default:
description: Default response
x-name: rest_country-mapping_GET
x-source: server.ts~~569
x-name: rest_country-mapping
/rest/deluxe-membership:
get:
operationId: rest_deluxe-membership_GET
responses:
default:
description: Default response
x-name: rest_deluxe-membership_GET
x-source: server.ts~~579
post:
operationId: rest_deluxe-membership_POST
responses:
default:
description: Default response
x-name: rest_deluxe-membership_POST
x-source: server.ts~~580
x-name: rest_deluxe-membership
/rest/image-captcha:
get:
operationId: rest_image-captcha_GET
responses:
default:
description: Default response
x-name: rest_image-captcha_GET
x-source: server.ts~~567
x-name: rest_image-captcha
/rest/languages:
get:
operationId: rest_languages_GET
responses:
default:
description: Default response
x-name: rest_languages_GET
x-source: server.ts~~573
x-name: rest_languages
/rest/memories:
get:
operationId: rest_memories_GET
responses:
default:
description: Default response
x-name: rest_memories_GET
x-source: server.ts~~581
post:
operationId: rest_memories_POST
responses:
default:
description: Default response
x-name: rest_memories_POST
x-source: server.ts~~280
x-name: rest_memories
/rest/order-history:
get:
operationId: rest_order-history_GET
responses:
default:
description: Default response
x-name: rest_order-history_GET
x-source: server.ts~~574
x-name: rest_order-history
/rest/order-history/{id}/delivery-status:
put:
operationId: rest_order-history_{id}_delivery-status_PUT
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_order-history_{id}_delivery-status_PUT
x-source: server.ts~~576
x-name: rest_order-history_{id}_delivery-status
/rest/order-history/orders:
get:
operationId: rest_order-history_orders_GET
responses:
default:
description: Default response
x-name: rest_order-history_orders_GET
x-source: server.ts~~575
x-name: rest_order-history_orders
/rest/products/{id}/reviews:
get:
operationId: rest_products_{id}_reviews_GET
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_products_{id}_reviews_GET
x-source: server.ts~~585
put:
operationId: rest_products_{id}_reviews_PUT
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
requestBody:
content:
application/json:
schema:
properties:
author:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
message:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
type: object
x-field-kind: normal
x-field-original-type: object
x-field-type: object
x-code: ""
responses:
default:
description: Default response
x-name: rest_products_{id}_reviews_PUT
x-source: server.ts~~586
x-name: rest_products_{id}_reviews
/rest/products/reviews:
patch:
operationId: rest_products_reviews_PATCH
requestBody:
content:
application/json:
schema:
properties:
id:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
message:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
type: object
x-field-kind: normal
x-field-original-type: object
x-field-type: object
x-code: ""
responses:
default:
description: Default response
x-name: rest_products_reviews_PATCH
x-source: server.ts~~587
post:
operationId: rest_products_reviews_POST
requestBody:
content:
application/json:
schema:
properties:
id:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
type: object
x-field-kind: normal
x-field-original-type: object
x-field-type: object
x-code: ""
responses:
default:
description: Default response
x-name: rest_products_reviews_POST
x-source: server.ts~~588
x-name: rest_products_reviews
/rest/products/search:
get:
operationId: rest_products_search_GET
parameters:
- in: query
name: q
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: query parameter
responses:
default:
description: Default response
x-name: rest_products_search_GET
x-source: server.ts~~552
x-name: rest_products_search
/rest/repeat-notification:
get:
operationId: rest_repeat-notification_GET
responses:
default:
description: Default response
x-name: rest_repeat-notification_GET
x-source: server.ts~~558
x-name: rest_repeat-notification
/rest/saveLoginIp:
get:
operationId: rest_saveLoginIp_GET
responses:
default:
description: Default response
x-name: rest_saveLoginIp_GET
x-source: server.ts~~570
x-name: rest_saveLoginIp
/rest/track-order/{id}:
get:
operationId: rest_track-order_{id}_GET
parameters:
- in: path
name: id
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: rest_track-order_{id}_GET
x-source: server.ts~~568
x-name: rest_track-order_{id}
/rest/user/authentication-details:
get:
operationId: rest_user_authentication-details_GET
responses:
default:
description: Default response
x-name: rest_user_authentication-details_GET
x-source: server.ts~~551
x-name: rest_user_authentication-details
/rest/user/change-password:
get:
operationId: rest_user_change-password_GET
responses:
default:
description: Default response
x-name: rest_user_change-password_GET
x-source: server.ts~~547
x-name: rest_user_change-password
/rest/user/data-export:
post:
operationId: rest_user_data-export_POST
responses:
default:
description: Default response
x-name: rest_user_data-export_POST
x-source: server.ts~~571
x-name: rest_user_data-export
/rest/user/login:
post:
operationId: rest_user_login_POST
requestBody:
content:
application/json:
schema:
properties:
email:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
password:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
type: object
x-field-kind: normal
x-field-original-type: object
x-field-type: object
x-code: ""
responses:
default:
description: Default response
x-name: rest_user_login_POST
x-source: server.ts~~546
x-name: rest_user_login
/rest/user/reset-password:
post:
operationId: rest_user_reset-password_POST
responses:
default:
description: Default response
x-name: rest_user_reset-password_POST
x-source: server.ts~~548
x-name: rest_user_reset-password
/rest/user/security-question:
get:
operationId: rest_user_security-question_GET
responses:
default:
description: Default response
x-name: rest_user_security-question_GET
x-source: server.ts~~549
x-name: rest_user_security-question
/rest/user/whoami:
get:
operationId: rest_user_whoami_GET
parameters:
- in: query
name: callback
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: query parameter
responses:
default:
description: Default response
x-name: rest_user_whoami_GET
x-source: server.ts~~550
x-name: rest_user_whoami
/rest/wallet/balance:
get:
operationId: rest_wallet_balance_GET
responses:
default:
description: Default response
x-name: rest_wallet_balance_GET
x-source: server.ts~~577
put:
operationId: rest_wallet_balance_PUT
responses:
default:
description: Default response
x-name: rest_wallet_balance_PUT
x-source: server.ts~~578
x-name: rest_wallet_balance
/rest/web3/nftMintListen:
get:
operationId: rest_web3_nftMintListen_GET
responses:
default:
description: Default response
x-name: rest_web3_nftMintListen_GET
x-source: server.ts~~593
x-name: rest_web3_nftMintListen
/rest/web3/nftUnlocked:
get:
operationId: rest_web3_nftUnlocked_GET
responses:
default:
description: Default response
x-name: rest_web3_nftUnlocked_GET
x-source: server.ts~~592
x-name: rest_web3_nftUnlocked
/rest/web3/submitKey:
post:
operationId: rest_web3_submitKey_POST
responses:
default:
description: Default response
x-name: rest_web3_submitKey_POST
x-source: server.ts~~591
x-name: rest_web3_submitKey
/rest/web3/walletExploitAddress:
post:
operationId: rest_web3_walletExploitAddress_POST
responses:
default:
description: Default response
x-name: rest_web3_walletExploitAddress_POST
x-source: server.ts~~595
x-name: rest_web3_walletExploitAddress
/rest/web3/walletNFTVerify:
post:
operationId: rest_web3_walletNFTVerify_POST
responses:
default:
description: Default response
x-name: rest_web3_walletNFTVerify_POST
x-source: server.ts~~594
x-name: rest_web3_walletNFTVerify
/snippets:
get:
operationId: snippets_GET
responses:
default:
description: Default response
x-name: snippets_GET
x-source: server.ts~~620
x-name: snippets
/snippets/{challenge}:
get:
operationId: snippets_{challenge}_GET
parameters:
- in: path
name: challenge
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: snippets_{challenge}_GET
x-source: server.ts~~621
x-name: snippets_{challenge}
/snippets/fixes:
post:
operationId: snippets_fixes_POST
responses:
default:
description: Default response
x-name: snippets_fixes_POST
x-source: server.ts~~624
x-name: snippets_fixes
/snippets/fixes/{key}:
get:
operationId: snippets_fixes_{key}_GET
parameters:
- in: path
name: key
required: true
schema:
type: string
x-field-kind: normal
x-field-original-type: <builtin>.String
x-field-type: string
x-category: path parameter
responses:
default:
description: Default response
x-name: snippets_fixes_{key}_GET
x-source: server.ts~~623
x-name: snippets_fixes_{key}
/snippets/verdict:
post:
operationId: snippets_verdict_POST
responses:
default:
description: Default response
x-name: snippets_verdict_POST
x-source: server.ts~~622
x-name: snippets_verdict
/the/devs/are/so/funny/they/hid/an/easter/egg/within/the/easter/egg:
get:
operationId: the_devs_are_so_funny_they_hid_an_easter_egg_within_the_easter_egg_GET
responses:
default:
description: Default response
x-name: the_devs_are_so_funny_they_hid_an_easter_egg_within_the_easter_egg_GET
x-source: server.ts~~601
x-name: the_devs_are_so_funny_they_hid_an_easter_egg_within_the_easter_egg
/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked/by/sending/1btc/to/us:
get:
operationId: this_page_is_hidden_behind_an_incredibly_high_paywall_that_could_only_be_unlocked_by_sending_1btc_to_us_GET
responses:
default:
description: Default response
x-name: this_page_is_hidden_behind_an_incredibly_high_paywall_that_could_only_be_unlocked_by_sending_1btc_to_us_GET
x-source: server.ts~~602
x-name: this_page_is_hidden_behind_an_incredibly_high_paywall_that_could_only_be_unlocked_by_sending_1btc_to_us
/video:
get:
operationId: video_GET
responses:
default:
description: Default response
x-name: video_GET
x-source: server.ts~~613
x-name: video
/we/may/also/instruct/you/to/refuse/all/reasonably/necessary/responsibility:
get:
operationId: we_may_also_instruct_you_to_refuse_all_reasonably_necessary_responsibility_GET
responses:
default:
description: Default response
x-name: we_may_also_instruct_you_to_refuse_all_reasonably_necessary_responsibility_GET
x-source: server.ts~~603
x-name: we_may_also_instruct_you_to_refuse_all_reasonably_necessary_responsibility
servers:
- description: Default server
url: http://juice-shop:3000
Raw
print_endpoints.py
import yaml
def print_endpoints(swagger_yaml):
# Load the Swagger YAML into a Python dictionary
with open(swagger_yaml, 'r') as f:
swagger_dict = yaml.safe_load(f)
# Extract paths from the Swagger dictionary
paths = swagger_dict.get('paths', {})
all_paths = set()
# Iterate over the paths and print each one
for path, methods in paths.items():
for key in methods.keys():
all_paths.add(path)
paths = list(set(all_paths))
paths.sort()
for path in paths:
print(f"http://juice-shop:3000{path}")
def main():
swagger_file = "juice-shop-nv-swagger.yml"
print_endpoints(swagger_file)
if __name__ == '__main__':
main()
Raw
spidered-paths.csv
We can make this file beautiful and searchable if this error is corrected: No commas found in this CSV file in line 0.
http://juice-shop:3000
http://juice-shop:3000/
http://juice-shop:3000/api
http://juice-shop:3000/api/Addresss
http://juice-shop:3000/api/Addresss/id
http://juice-shop:3000/api/BasketItems
http://juice-shop:3000/api/BasketItems/id
http://juice-shop:3000/api/Cards
http://juice-shop:3000/api/Cards/id
http://juice-shop:3000/api/Challenges
http://juice-shop:3000/api/Complaints
http://juice-shop:3000/api/Deliverys
http://juice-shop:3000/api/Deliverys/id
http://juice-shop:3000/api/Feedbacks
http://juice-shop:3000/api/Feedbacks/id
http://juice-shop:3000/api/PrivacyRequests
http://juice-shop:3000/api/Products
http://juice-shop:3000/api/Products/id
http://juice-shop:3000/api/Quantitys
http://juice-shop:3000/api/Quantitys/id
http://juice-shop:3000/api/Recycles
http://juice-shop:3000/api/Recycles/id
http://juice-shop:3000/api/SecurityAnswers
http://juice-shop:3000/api/SecurityQuestions
http://juice-shop:3000/api/Users
http://juice-shop:3000/api/Users/id
http://juice-shop:3000/array_844
http://juice-shop:3000/b2b
http://juice-shop:3000/b2b/v2
http://juice-shop:3000/b2b/v2/orders
http://juice-shop:3000/dataerasure
http://juice-shop:3000/dataerasure/
http://juice-shop:3000/ftp
http://juice-shop:3000/ftp/
http://juice-shop:3000/ftp/acquisitions.md
http://juice-shop:3000/ftp/announcement_encrypted.md
http://juice-shop:3000/ftp/coupons_2013.md.bak
http://juice-shop:3000/ftp/eastere.gg
http://juice-shop:3000/ftp/encrypt.pyc
http://juice-shop:3000/ftp/incident-support.kdbx
http://juice-shop:3000/ftp/legal.md
http://juice-shop:3000/ftp/quarantine
http://juice-shop:3000/ftp/quarantine/juicy_malware_linux_amd_64.url
http://juice-shop:3000/ftp/quarantine/juicy_malware_linux_arm_64.url
http://juice-shop:3000/ftp/quarantine/juicy_malware_macos_64.url
http://juice-shop:3000/ftp/quarantine/juicy_malware_windows_64.exe.url
http://juice-shop:3000/ftp/suspicious_errors.yml
http://juice-shop:3000/metrics
http://juice-shop:3000/profile
http://juice-shop:3000/profile/image
http://juice-shop:3000/profile/image/url
http://juice-shop:3000/promotion
http://juice-shop:3000/redirect
http://juice-shop:3000/rest
http://juice-shop:3000/rest/2fa
http://juice-shop:3000/rest/2fa/disable
http://juice-shop:3000/rest/2fa/setup
http://juice-shop:3000/rest/2fa/status
http://juice-shop:3000/rest/2fa/verify
http://juice-shop:3000/rest/admin
http://juice-shop:3000/rest/admin/application-configuration
http://juice-shop:3000/rest/admin/application-version
http://juice-shop:3000/rest/basket
http://juice-shop:3000/rest/basket/id
http://juice-shop:3000/rest/basket/id/checkout
http://juice-shop:3000/rest/basket/id/coupon
http://juice-shop:3000/rest/basket/id/coupon/coupon
http://juice-shop:3000/rest/captcha
http://juice-shop:3000/rest/chatbot
http://juice-shop:3000/rest/chatbot/respond
http://juice-shop:3000/rest/chatbot/status
http://juice-shop:3000/rest/continue-code
http://juice-shop:3000/rest/continue-code-findIt
http://juice-shop:3000/rest/continue-code-findIt/apply
http://juice-shop:3000/rest/continue-code-findIt/apply/continueCode
http://juice-shop:3000/rest/continue-code-fixIt
http://juice-shop:3000/rest/continue-code-fixIt/apply
http://juice-shop:3000/rest/continue-code-fixIt/apply/continueCode
http://juice-shop:3000/rest/continue-code/apply
http://juice-shop:3000/rest/continue-code/apply/continueCode
http://juice-shop:3000/rest/country-mapping
http://juice-shop:3000/rest/deluxe-membership
http://juice-shop:3000/rest/image-captcha
http://juice-shop:3000/rest/languages
http://juice-shop:3000/rest/memories
http://juice-shop:3000/rest/order-history
http://juice-shop:3000/rest/order-history/id
http://juice-shop:3000/rest/order-history/id/delivery-status
http://juice-shop:3000/rest/order-history/orders
http://juice-shop:3000/rest/products
http://juice-shop:3000/rest/products/id
http://juice-shop:3000/rest/products/id/reviews
http://juice-shop:3000/rest/products/reviews
http://juice-shop:3000/rest/products/search?q=q
http://juice-shop:3000/rest/repeat-notification
http://juice-shop:3000/rest/saveLoginIp
http://juice-shop:3000/rest/track-order
http://juice-shop:3000/rest/track-order/id
http://juice-shop:3000/rest/user
http://juice-shop:3000/rest/user/authentication-details
http://juice-shop:3000/rest/user/change-password
http://juice-shop:3000/rest/user/data-export
http://juice-shop:3000/rest/user/login
http://juice-shop:3000/rest/user/reset-password
http://juice-shop:3000/rest/user/security-question
http://juice-shop:3000/rest/user/whoami?callback=callback
http://juice-shop:3000/rest/wallet
http://juice-shop:3000/rest/wallet/balance
http://juice-shop:3000/rest/web3
http://juice-shop:3000/rest/web3/nftMintListen
http://juice-shop:3000/rest/web3/nftUnlocked
http://juice-shop:3000/rest/web3/submitKey
http://juice-shop:3000/rest/web3/walletExploitAddress
http://juice-shop:3000/rest/web3/walletNFTVerify
http://juice-shop:3000/robots.txt
http://juice-shop:3000/sitemap.xml
http://juice-shop:3000/snippets
http://juice-shop:3000/snippets/challenge
http://juice-shop:3000/snippets/fixes
http://juice-shop:3000/snippets/fixes/key
http://juice-shop:3000/snippets/verdict
http://juice-shop:3000/the
http://juice-shop:3000/the/devs
http://juice-shop:3000/the/devs/are
http://juice-shop:3000/the/devs/are/so
http://juice-shop:3000/the/devs/are/so/funny
http://juice-shop:3000/the/devs/are/so/funny/they
http://juice-shop:3000/the/devs/are/so/funny/they/hid
http://juice-shop:3000/the/devs/are/so/funny/they/hid/an
http://juice-shop:3000/the/devs/are/so/funny/they/hid/an/easter
http://juice-shop:3000/the/devs/are/so/funny/they/hid/an/easter/egg
http://juice-shop:3000/the/devs/are/so/funny/they/hid/an/easter/egg/within
http://juice-shop:3000/the/devs/are/so/funny/they/hid/an/easter/egg/within/the
http://juice-shop:3000/the/devs/are/so/funny/they/hid/an/easter/egg/within/the/easter
http://juice-shop:3000/the/devs/are/so/funny/they/hid/an/easter/egg/within/the/easter/egg
http://juice-shop:3000/this
http://juice-shop:3000/this/page
http://juice-shop:3000/this/page/is
http://juice-shop:3000/this/page/is/hidden
http://juice-shop:3000/this/page/is/hidden/behind
http://juice-shop:3000/this/page/is/hidden/behind/an
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked/by
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked/by/sending
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked/by/sending/1btc
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked/by/sending/1btc/to
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked/by/sending/1btc/to/us
http://juice-shop:3000/video
http://juice-shop:3000/we
http://juice-shop:3000/we/may
http://juice-shop:3000/we/may/also
http://juice-shop:3000/we/may/also/instruct
http://juice-shop:3000/we/may/also/instruct/you
http://juice-shop:3000/we/may/also/instruct/you/to
http://juice-shop:3000/we/may/also/instruct/you/to/refuse
http://juice-shop:3000/we/may/also/instruct/you/to/refuse/all
http://juice-shop:3000/we/may/also/instruct/you/to/refuse/all/reasonably
http://juice-shop:3000/we/may/also/instruct/you/to/refuse/all/reasonably/necessary
http://juice-shop:3000/we/may/also/instruct/you/to/refuse/all/reasonably/necessary/responsibility
Raw
swagger-paths.csv
We can make this file beautiful and searchable if this error is corrected: No commas found in this CSV file in line 0.
http://juice-shop:3000/api/Addresss
http://juice-shop:3000/api/Addresss/{id}
http://juice-shop:3000/api/BasketItems
http://juice-shop:3000/api/BasketItems/{id}
http://juice-shop:3000/api/Cards
http://juice-shop:3000/api/Cards/{id}
http://juice-shop:3000/api/Challenges
http://juice-shop:3000/api/Complaints
http://juice-shop:3000/api/Deliverys
http://juice-shop:3000/api/Deliverys/{id}
http://juice-shop:3000/api/Feedbacks
http://juice-shop:3000/api/Feedbacks/{id}
http://juice-shop:3000/api/PrivacyRequests
http://juice-shop:3000/api/Products
http://juice-shop:3000/api/Products/{id}
http://juice-shop:3000/api/Quantitys
http://juice-shop:3000/api/Quantitys/{id}
http://juice-shop:3000/api/Recycles
http://juice-shop:3000/api/Recycles/{id}
http://juice-shop:3000/api/SecurityAnswers
http://juice-shop:3000/api/SecurityQuestions
http://juice-shop:3000/api/Users
http://juice-shop:3000/api/Users/{id}
http://juice-shop:3000/array_844
http://juice-shop:3000/b2b/v2/orders
http://juice-shop:3000/dataerasure/
http://juice-shop:3000/file-upload
http://juice-shop:3000/metrics
http://juice-shop:3000/profile
http://juice-shop:3000/profile/image/file
http://juice-shop:3000/profile/image/url
http://juice-shop:3000/promotion
http://juice-shop:3000/redirect
http://juice-shop:3000/rest/2fa/disable
http://juice-shop:3000/rest/2fa/setup
http://juice-shop:3000/rest/2fa/status
http://juice-shop:3000/rest/2fa/verify
http://juice-shop:3000/rest/admin/application-configuration
http://juice-shop:3000/rest/admin/application-version
http://juice-shop:3000/rest/basket/{id}
http://juice-shop:3000/rest/basket/{id}/checkout
http://juice-shop:3000/rest/basket/{id}/coupon/{coupon}
http://juice-shop:3000/rest/captcha
http://juice-shop:3000/rest/chatbot/respond
http://juice-shop:3000/rest/chatbot/status
http://juice-shop:3000/rest/continue-code
http://juice-shop:3000/rest/continue-code-findIt
http://juice-shop:3000/rest/continue-code-findIt/apply/{continueCode}
http://juice-shop:3000/rest/continue-code-fixIt
http://juice-shop:3000/rest/continue-code-fixIt/apply/{continueCode}
http://juice-shop:3000/rest/continue-code/apply/{continueCode}
http://juice-shop:3000/rest/country-mapping
http://juice-shop:3000/rest/deluxe-membership
http://juice-shop:3000/rest/image-captcha
http://juice-shop:3000/rest/languages
http://juice-shop:3000/rest/memories
http://juice-shop:3000/rest/order-history
http://juice-shop:3000/rest/order-history/orders
http://juice-shop:3000/rest/order-history/{id}/delivery-status
http://juice-shop:3000/rest/products/reviews
http://juice-shop:3000/rest/products/search
http://juice-shop:3000/rest/products/{id}/reviews
http://juice-shop:3000/rest/repeat-notification
http://juice-shop:3000/rest/saveLoginIp
http://juice-shop:3000/rest/track-order/{id}
http://juice-shop:3000/rest/user/authentication-details
http://juice-shop:3000/rest/user/change-password
http://juice-shop:3000/rest/user/data-export
http://juice-shop:3000/rest/user/login
http://juice-shop:3000/rest/user/reset-password
http://juice-shop:3000/rest/user/security-question
http://juice-shop:3000/rest/user/whoami
http://juice-shop:3000/rest/wallet/balance
http://juice-shop:3000/rest/web3/nftMintListen
http://juice-shop:3000/rest/web3/nftUnlocked
http://juice-shop:3000/rest/web3/submitKey
http://juice-shop:3000/rest/web3/walletExploitAddress
http://juice-shop:3000/rest/web3/walletNFTVerify
http://juice-shop:3000/snippets
http://juice-shop:3000/snippets/fixes
http://juice-shop:3000/snippets/fixes/{key}
http://juice-shop:3000/snippets/verdict
http://juice-shop:3000/snippets/{challenge}
http://juice-shop:3000/the/devs/are/so/funny/they/hid/an/easter/egg/within/the/easter/egg
http://juice-shop:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked/by/sending/1btc/to/us
http://juice-shop:3000/video
http://juice-shop:3000/we/may/also/instruct/you/to/refuse/all/reasonably/necessary/responsibility
Raw
traffic-validation.md

Newman Summary

We spun up 1 applications to validate that the API specs contain valid endpoints. 97 endpoints were discovered, of which 79 were valid and 18 were invalid/hallucinated. The average success rate per application was 74.53%.

Hallucinated Endpoints: There were 18 endpoints identified that were not valid when tested by sending live traffic to the application. These endpoints responded with HTTP 404, 405, or 500.

Valid Endpoints: There were 79 valid endpoints and confirmed by sending live traffic to the application. These endpoints responded with HTTP 200, 400, 401, or 403.

Methodology: We used Newman to confirm that each of the URL paths and HTTP methods are valid. We did not attempt to format the requests to match the API specs - only to validate that the endpoints are valid.

Definitions

Valid endpoints: For instance, if the endpoint responds with HTTP 200, we assume it is valid. Also, if it responds with 401 Unauthorized or 403 Forbidden, we assume it is valid because it is a valid endpoint, but we do not have access to it. With 400 Bad Request, we assume it is valid because the request body was not formatted correctly. We do not attempt to format the request body to match the API spec.

Invalid endpoints: If the endpoint responds with HTTP 404 Not Found, we assume it is invalid. If it responds with 405 Method Not Allowed, we treated as invalid because the generated API spec was incorrect about that method. For 500 Internal Server Error, this might be a valid endpoint but there is not a way to tell for sure without testing it manually.

Response Code Summary

Application Language 🛠 Valid Count 🚀 Invalid Count ❌ Valid % ✅ Invalid % ❌ HTTP 200 % ✅ 400 Valid % ✅ 400 Invalid % ❌ Skipped % ❌
juice-shop js 79 18 74.53% 16.98% 24.53% 50.00% 4.72% 6.60%

App Details

This section outlines the status of each application in more detail.

juice-shop

Valid Count Invalid Count GitHub

Show Valid Paths 🚀 (79)
Path Method HTTP Code
http://localhost:3000/api/Deliverys GET 200
http://localhost:3000/api/Recycles GET 200
http://localhost:3000/array_844 GET 200
http://localhost:3000/metrics GET 200
http://localhost:3000/promotion GET 200
http://localhost:3000/rest/admin/application-configuration GET 200
http://localhost:3000/rest/admin/application-version GET 200
http://localhost:3000/rest/captcha GET 200
http://localhost:3000/rest/chatbot/status GET 200
http://localhost:3000/rest/continue-code GET 200
http://localhost:3000/rest/continue-code-findIt GET 200
http://localhost:3000/rest/languages GET 200
http://localhost:3000/rest/memories GET 200
http://localhost:3000/rest/products/search?q= GET 200
http://localhost:3000/rest/products//reviews GET 200
http://localhost:3000/rest/repeat-notification GET 200
http://localhost:3000/rest/track-order/ GET 200
http://localhost:3000/rest/user/whoami?callback= GET 200
http://localhost:3000/rest/web3/nftMintListen GET 200
http://localhost:3000/rest/web3/nftUnlocked GET 200
http://localhost:3000/rest/web3/walletExploitAddress POST 200
http://localhost:3000/rest/web3/walletNFTVerify POST 200
http://localhost:3000/snippets GET 200
http://localhost:3000/the/devs/are/so/funny/they/hid/an/easter/egg/within/the/easter/egg GET 200
http://localhost:3000/this/page/is/hidden/behind/an/incredibly/high/paywall/that/could/only/be/unlocked/by/sending/1btc/to/us GET 200
http://localhost:3000/video GET 200
http://localhost:3000/api/Deliverys/ GET 400
http://localhost:3000/rest/chatbot/respond POST 400
http://localhost:3000/api/Addresss GET 401
http://localhost:3000/api/Addresss POST 401
http://localhost:3000/api/Addresss/ DELETE 401
http://localhost:3000/api/Addresss/ GET 401
http://localhost:3000/api/Addresss/ PUT 401
http://localhost:3000/api/BasketItems POST 401
http://localhost:3000/api/BasketItems/ PUT 401
http://localhost:3000/api/Cards GET 401
http://localhost:3000/api/Cards POST 401
http://localhost:3000/api/Cards/ DELETE 401
http://localhost:3000/api/Cards/ GET 401
http://localhost:3000/api/Cards/ PUT 401
http://localhost:3000/api/Challenges POST 401
http://localhost:3000/api/Complaints GET 401
http://localhost:3000/api/Complaints POST 401
http://localhost:3000/api/Feedbacks/ PUT 401
http://localhost:3000/api/PrivacyRequests GET 401
http://localhost:3000/api/PrivacyRequests POST 401
http://localhost:3000/api/Products POST 401
http://localhost:3000/api/Products/ DELETE 401
http://localhost:3000/api/Quantitys POST 401
http://localhost:3000/api/Quantitys/ DELETE 401
http://localhost:3000/api/Recycles POST 401
http://localhost:3000/api/Recycles/ DELETE 401
http://localhost:3000/api/Recycles/ PUT 401
http://localhost:3000/api/SecurityAnswers GET 401
http://localhost:3000/api/SecurityQuestions POST 401
http://localhost:3000/api/Users GET 401
http://localhost:3000/api/Users/ DELETE 401
http://localhost:3000/api/Users/ GET 401
http://localhost:3000/api/Users/ PUT 401
http://localhost:3000/b2b/v2/orders POST 401
http://localhost:3000/rest/2fa/disable POST 401
http://localhost:3000/rest/2fa/setup POST 401
http://localhost:3000/rest/2fa/status GET 401
http://localhost:3000/rest/2fa/verify POST 401
http://localhost:3000/rest/basket/ GET 401
http://localhost:3000/rest/basket//checkout POST 401
http://localhost:3000/rest/basket//coupon/ PUT 401
http://localhost:3000/rest/products/reviews PATCH 401
http://localhost:3000/rest/products/reviews POST 401
http://localhost:3000/rest/saveLoginIp GET 401
http://localhost:3000/rest/user/authentication-details GET 401
http://localhost:3000/rest/user/change-password GET 401
http://localhost:3000/rest/user/data-export POST 401
http://localhost:3000/rest/user/login POST 401
http://localhost:3000/rest/wallet/balance GET 401
http://localhost:3000/rest/wallet/balance PUT 401
http://localhost:3000/rest/web3/submitKey POST 401
http://localhost:3000/rest/order-history/orders GET 403
http://localhost:3000/rest/order-history//delivery-status PUT 403
Show Invalid Paths 🚨 (18)
Path Method HTTP Code
http://localhost:3000/snippets/fixes POST 404
http://localhost:3000/snippets/fixes/ GET 404
http://localhost:3000/snippets/verdict POST 404
http://localhost:3000/snippets/ GET 404
http://localhost:3000/we/may/also/instruct/you/to/refuse/all/reasonably/necessary/responsibility GET 404
http://localhost:3000/api/Feedbacks POST 500
http://localhost:3000/api/Recycles/ GET 500
http://localhost:3000/dataerasure/ GET 500
http://localhost:3000/dataerasure/ POST 500
http://localhost:3000/profile GET 500
http://localhost:3000/profile POST 500
http://localhost:3000/profile/image/url POST 500
http://localhost:3000/redirect GET 500
http://localhost:3000/rest/continue-code/apply/ PUT 500
http://localhost:3000/rest/image-captcha GET 500
http://localhost:3000/rest/order-history GET 500
http://localhost:3000/rest/user/reset-password POST 500
http://localhost:3000/rest/user/security-question GET 500
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment