API Authentication

Test Cases

1. Basic Credentials

{
  "login": "admin",
  "password": "admin"
}

2. Empty Credentials

{
  "login": "",
  "password": ""
}

3. Null Values

{
  "login": null,
  "password": null
}

4. Credentials as Numbers

{
  "login": 123,
  "password": 456
}

6. Credentials as Booleans

{
  "login": true,
  "password": false
}

7. Credentials as Arrays

{
  "login": ["admin"],
  "password": ["password"]
}

8. Credentials as Objects

{
  "login": {"username": "admin", "password": {"password": "password"}}
}

9. Special Characters in Credentials

{
  "login": "@dm!n",
  "password": "p@ssw0rd#"
}

10. SQL Injection

{
  "login": "admin' --",
  "password": "password"
}

11. HTML Tags in Credentials

{
  "login": "<h1> admin </h1>",
  "password": "ololo-HTML-XSS"
}

12. Unicode in Credentials

{
  "login": "\u0061\u0064\u006D\u0069\u006E",
  "password": "\u0070\u0061\u0073\u0073\u0077\u006F\u0072\u0064"
}

13. Credentials with Escape Characters

{
  "login": "ad\\nmin",
  "password": "pa\\ssword"
}

14. Credentials with White Space

{
  "login": " ",
  "password": " "
}

15. Overlong Values

{
  "login": "aaaaaaaaaa... (10000 a's)",
  "password": "bbbbbbbbbb... (10000 b's)"
}

16. Malformed JSON (Missing Brace)

{ "login": "admin", "password": "admin"

17. Malformed JSON (Extra Comma)

{
  "login": "admin",
  "password": "admin",
}

18. Missing Login Key

{
  "password": "admin"
}

19. Missing Password Key

{
  "login": "admin"
}

20. Swapped Key Values

{
  "admin": "login",
  "password": "password"
}

21. Extra Keys

{
  "login": "admin",
  "password": "admin",
  "extra": "extra"
}

22. Missing Colon

{
  "login" "admin",
  "password": "password"
}

23. Invalid Boolean as Credentials

{
  "login": yes,
  "password": no
}

25. All Keys, No Values

{
  "": "",
  "": ""
}

26. Nested Objects

{
  "login": {"innerLogin": "admin", "password": {"innerPassword": "password"}}
}

27. Case Sensitivity Testing

{
  "LOGIN": "admin",
  "PASSWORD": "password"
}

28. Login as a Number, Password as a String

{
  "login": 1234,
  "password": "password"
}

29. Login as a String, Password as a Number

{
  "login": "admin",
  "password": 1234
}

30. Repeated Keys

{
  "login": "admin",
  "login": "user",
  "password": "password"
}

31. Single Quotes Instead of Double

{
  'login': 'admin',
  'password': 'password'
}

33. Login and Password with Only Special Characters

{
  "login": "@#$%^&*",
  "password": "!@#$%^&*"
}

34. Unicode Escape Sequence

{
  "login": "\u0041\u0044\u004D\u0049\u004E",
  "password": "\u0050\u0041\u0053\u0053\u0057\u004F\u0052\u0044"
}

35. Value as Object Instead of String

{
  "login": {"$oid": "507c7f79bcf86cd7994f6c0e"},
  "password": "password"
}

37. Nonexistent Variables as Values

{
  "login": undefined,
  "password": undefined
}

38. Extra Nested Objects

{
  "login": "admin",
  "password": "password",
  "extra": {"key1": "value1", "key2": "value2"}
}

39. Hexadecimal Values

{
  "login": "0x1234",
  "password": "0x5678"
}

40. Extra Symbols After Valid JSON

{
  "login": "admin",
  "password": "password"
}@@@@@@

41. Only Keys, Without Values

{
  "login":,
  "password":
}

42. Insertion of Control Characters

{
  "login": "ad\u0000min",
  "password": "pass\u0000word"
}

43. Long Unicode Strings

{
  "login": "aaaaaaaaaa... (10000 a's in Unicode)",
  "password": "aaaaaaaaaa... (10000 a's in Unicode)"
}

44. Newline Characters in Strings

{
  "login": "ad\nmin",
  "password": "pa\nssword"
}

45. Tab Characters in Strings

{
  "login": "ad\tmin",
  "password": "pa\tssword"
}

46. Test with HTML Content in Strings

{
  "login": "admin",
  "password": "password"
}

47. JSON Injection in Strings

{
  "login": "{\"injection\":\"value\"}",
  "password": "password"
}

48. Test with XML Content in Strings

{
  "login": "admin",
  "password": "password"
}

49. Combination of Number, Strings, and Special Characters

{
  "login": "ad123min!@",
  "password": "pa55w0rd!@"
}

50. Use of Environment Variables

{
  "login": "${USER}",
  "password": "${PASS}"
}

51. Backslashes in Strings

{
  "login": "ad\\min",
  "password": "pa\\ssword"
}

52. Long Strings of Special Characters

{
  "login": "!@#$%^&*()... (repeated 1000 times)",
  "password": "!@#$%^&*()... (repeated 1000 times)"
}

53. Empty Key in JSON

{
  "": "admin",
  "password": "password"
}

55. JSON Injection in Key

{
  "{\"injection\":\"value\"} ": "admin",
  "password": "password"
}

56. Quotation Marks in Strings

{
  "login": "\"admin\"",
  "password": "\"password\""
}

57. Credentials as Nested Arrays

{
  "login": [["admin"]],
  "password": [["password"]]
}

58. Credentials as Nested Objects

{
  "login": {"username": {"value": "admin", "password": {"password": {"value": "password"}}}
}

59. Keys as Numbers

{
  123: "admin",
  456: "password"
}

60. Testing with Greater Than and Less Than Signs

{
  "login": "admin>1",
  "password": "alert('hi')",
  "password": "password"
}

85. Negative Numbers as Strings

{
  "login": "-123",
  "password": "-456"
}

86. Values as URLs

{
  "login": "https://admin.com",
  "password": "https://password.com"
}

87. Strings with Email Format

{
  "login": "[e-mail]",
  "password": "[e-mail]"
}

88. Strings with IP Address Format

{
  "login": "192.0.2.0",
  "password": "203.0.113.0"
}

89. Strings with Date Format

{
  "login": "2023-08-03",
  "password": "2023-08-04"
}

90. JSON with Exponential Values

{
  "login": 1e+30,
  "password": 1e+30
}

91. JSON with Negative Exponential Values

{
  "login": -1e+30,
  "password": -1e+30
}

92. Using Zero Width Space (U+200B) in Strings

{
  "login": "admin\u200B",
  "password": "password\u200B"
}

93. Using Zero Width Joiner (U+200D) in Strings

{
  "login": "admin\u200D",
  "password": "password\u200D"
}

94. JSON with Extremely Large Numbers

{
  "login": 12345678901234567890,
  "password": 12345678901234567890
}

95. Strings with Backspace Characters

{
  "login": "admin\b",
  "password": "password\b"
}

96. Test with Emoji in Strings

{
  "login": "admin😀",
  "password": "password😀"
}

97. JSON with Comments (Note: Comments are not officially supported in JSON)

{
  /*"login": "admin", "password": "password"*/
}

98. JSON with Base64 Encoded Values

{
  "login": "YWRtaW4=",
  "password": "cGFzc3dvcmQ="
}

99. Including Null Byte Character (May cause truncation)

{
  "login": "admin\0",
  "password": "password\0"
}

100. JSON with Credentials in Scientific Notation

{
  "login": 1e100,
  "password": 1e100
}

102. Strings with Octal Values

{
  "login": "\141\144\155\151\156",
  "password": "\160\141\163\163\167\157\162\144"
}

103. Writeup Test Case

{
  "root": {
    "username": "admin",
    "password": "admin"
  }
}

104. Writeup Test Case (Alternate Format)

{
  "basic": "username=admin username[]=admin username[0]=admin username=admin&username=admin delete username=admin"
}

---