The JSON Boundary scan checks if your service handles unexpected input values correctly.
Typically, attackers try to send values that fall outside of the expected range, causing the service to reveal the system data through error messages or stack traces. The JSON Boundary scan checks how your service acts in such cases by sending various unexpected inputs. For example, for an input field that accepts any integer value between
10, the JSON Boundary scan checks its behavior if a user enters
If the scan does not reveal any information about possible vulnerabilities, it passes successfully.
If the scan has Failed, that may mean your service is sensitive to values that fall outside of the normal range, and its vulnerabilities are exposed.
The JSON Boundary scan will replace the value of each field in the simulated JSON request with random data several times until all available fields are checked.
The scan inputs vary according to a value type:
|Value Type||Possible Inputs|
Very large string,
String with control characters (
String with non-alphanumeric characters
Smallest possible integer value,
Largest possible integer value,
Smallest possible double value,
Largest possible double value
The JSON Boundary scan uses assertions to validate each response and check if it includes any information about potential vulnerabilities.
If a response passes all assertions,
PASS will be logged for that response. If any assertion fails,
FAIL will be logged.
|If you have not applied any assertions to the scan,
Sensitive Information Exposure – Validates that your server does not reveal any information that is useful for attacks (such as stack traces if the server crashes).
Response SLA – Validates that your service responds within expected time even after receiving unexpected input.
The JSON Boundary scan checks the boundaries for all simulated JSON request’s fields. Use the following options to configure the scan Strategy:
|Request Delay (ms)||Set a pause between requests during the scan in milliseconds.|
|Apply to Failed TestSteps||Select to run the scan even if the target test step fails.|
|Run only once||Select to run the scan only once for each test step, even if ReadyAPI runs that step several times for a test case.|