Implementacija PSD2 klijenta

master's thesis

• Title (english): PSD2 client implementation
• Author: Tarik Karamehmedović
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Dejan Škvorc (član povjerenstva)
• Committee member: Leonardo Jelenković (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2022-07-12, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Uvođenjem revidirane direktive o platnim uslugama, banke su morale otvoriti svoje sustave
trećim pružateljima platnih usluga. S obzirom na to da banke rukuju s izrazito osjetljivim
podacima, potrebno je posebnu pozornost obratiti na sigurnost API-ja. Kako bi se to osiguralo,
API je potrebno temeljito testirati. Kako bi se implementirao alat proučavalo se Erste PSD2
XS2A sučelje, sve komponente HTTP zahtjeva te česte ranjivosti aplikacijskih programskih
sučelja. Nakon toga se u radu razvio alat namijenjen za automatizirano testiranje i provođenje
napada nad REST API-jima. Uz standardne komponente potrebne za testiranje API-ja,
razvijene su i komponente koje olakšavaju testiranje bankovnih PSD2 XS2A sučelja. Na kraju
su, uz pomoć implementiranog alata, implementirani testovi i napadi na probnoj instanci Erste
PSD2 XS2A sučelja.

Abstract (english)

With the introduction of the revised Payment Services Directive, banks had to open their
systems to third party payment service providers. Given that banks handle extremely sensitive
data, special attention needs to be paid to the security of APIs. To ensure this, the API needs to
be thoroughly tested. In order to implement the tool, the Erste PSD2 XS2A interface, all
components of HTTP requests, and common vulnerabilities in application programming
interfaces were studied. After that, a tool intended for automated testing and execution of
attacks on REST APIs was developed. In addition to the standard components required for API
testing, components have been developed to facilitate testing of banking PSD2 XS2A
interfaces. Finally, with the help of the implemented tool, tests, and attacks on the test instance
of the Erste PSD2 XS2A interface were implemented.

• Keywords: PSD2; testiranje; NextGenPSD2; sigurnost; alat; Python; HTTP
• Keywords (english): PSD2; testing; NextGenPSD2; security; tool; Python; HTTP
• Language: croatian
• URN:NBN: urn:nbn:hr:168:305849
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-14 09:04:41