Function test_no_authentication

tests/security/test_access_control.py:45–95

Test if API requires authentication

(tester)

def test_no_authentication(tester):
    """Test if API requires authentication"""
    print("\n[*] Testing authentication requirements...")

    # Test 1: Direct connection without credentials
    print("  - Testing unauthenticated access...")
    try:
        with SerialStudioClient() as client:
            result = client.command("api.getCommands")

            tester.log_vulnerability(
                "HIGH",
                "No Authentication",
                "API accepts connections without any authentication",
            )

            # List available commands
            commands = result.get("commands", [])
            print(f"    Accessible commands: {len(commands)}")

            # Check for sensitive commands
            sensitive_commands = []
            for cmd in commands:
                cmd_name = cmd.get("name", "")
                if any(
                    keyword in cmd_name.lower()
                    for keyword in [
                        "disconnect",
                        "connect",
                        "open",
                        "close",
                        "write",
                        "set",
                        "delete",
                        "remove",
                    ]
                ):
                    sensitive_commands.append(cmd_name)

            if sensitive_commands:
                tester.log_vulnerability(
                    "CRITICAL",
                    "Authorization",
                    f"Unauthenticated access to {len(sensitive_commands)} sensitive commands",
                )
                print(f"    Sensitive commands exposed: {len(sensitive_commands)}")
                for cmd in sensitive_commands[:10]:
                    print(f"      - {cmd}")

    except Exception as e:
        print(f"    Authentication may be required: {e}")


def test_network_binding(tester):