Understand API vulnerabilities and perform security testing.

Welcome!

You are a Junior Security Tester at CyberSecure Solutions. The company has provided an intentionally vulnerable API application for security testing.

Your task is to identify API endpoints, analyze requests, test authentication and authorization, identify common vulnerabilities, and document your findings.

Topic : Cryptography and Cloud Security 

1) Cloud Architecture & Web Application Hosting

2) Access Control & Identity Exploitation

3) API Security in Cloud Environments Storage, Data Exposure & Misuse

4) Cloud Attack Simulation & Defense

Install Docker and Docker Compose on Kali Linux, deploy the OWASP crAPI vulnerable application, and verify that all required containers are running correctly.

Install Docker, Docker Compose, and Git:

Enable and start the Docker service:

Check the Docker service status:

Press q to exit the service-status screen.

Verify the Docker installation:

Verify Docker Compose:

Test whether Docker can run a container:

Download the official OWASP crAPI project from GitHub.

Move to the home directory and create a folder named crAPI

Clone the official crAPI repository into a folder named crAPI:

Enter the Docker deployment directory:

Confirm that the required files are present:

Verify that docker-compose.yml appears in the output

Download the container images required by crAPI and Launch crAPI and its supporting services

Confirm that you are inside the deployment directory:

Download the required container images:

Wait for every image to finish downloading

Start the complete crAPI environment:

Wait a few minutes for the application and databases to initialize.

Display the Compose service status:

Display all running Docker containers:

Understand how an application communicates with its API.

Start the vulnerable API application.

Open the application in the browser on 127.0.0.1:8888

Enter details and Login  the application

Open mailhog application in the browser on 127.0.0.1:8025

Once Login is completed now Add a Vehicle

Open Burp Suite

Browse through the application

Go to Proxy → HTTP History

Identify API requests

Record:

Check whether protected API endpoints require valid authentication.

Log in to the application

Capture an API request in Burp Suite

Identify the authentication token

Send the request to Repeater

Send the request normally

Remove the authentication token

Send the request again

Compare the responses

Check whether one user can access another user's data.

Create User A and User B.

Log in as User A

Capture a request containing an object ID

Example:

GET /api/user/101

Send the request to Repeater

Change the ID:

GET /api/user/102

Send the request

Check the response

If User A can access User B's information, it may be a BOLA/IDOR vulnerability.

Original Request :-

GET /workshop/api/mechanic/mechanic_report?report_id=6

HTTP/1.1

Modified Request :-

GET /workshop/api/mechanic/mechanic_report?report_id=5

HTTP/1.1

Result :-

The API returned report details belonging to another user while using the attacker's valid session.

Check whether users can perform unauthorized actions or submit unsafe input

Locate folders containing:

Part A — Authorization

Locate folders containing:

Log in as a normal user

Identify a privileged API function

Capture the request

Send it using the normal user's token

Check the response

If the normal user can perform the privileged action, document the vulnerability

Part B — Input Validation

Find an API parameter that accepts user input.

Send a normal request

Modify the input with harmless special characters such as:

• '
• "
• {}
• []

Locate folders containing:

Observe the response

Check for detailed errors, stack traces, or unexpected behavior

• '
• "
• {}
• []

Original Request :-

GET /workshop/api/mechanic/download_report?filename=report_6

HTTP/1.1 Authorization: Bearer <JWT>

Modified Request :-

GET /workshop/api/mechanic/download_report?filename=report_5

HTTP/1.1 Authorization: Bearer <JWT>

Result :-

The server successfully returned the report belonging to another

user without performing an ownership check.

Locate folders containing:

For each finding, record:

Example Finding

Vulnerability: BOLA / IDOR

Endpoint: GET /api/user/{id}

Severity: High

Description: The API does not verify whether the logged-in user owns

the requested object.

Impact: A user may access another user's information by changing

the object ID.

Recommendation: Implement server-side authorization and verify object ownership before returning the requested data.

Example Finding

Vulnerability: BOLA / IDOR

Endpoint: GET /api/user/{id}

Severity: High

Description: The API does not verify whether the logged-in user owns

the requested object.

Impact: A user may access another user's information by changing

the object ID.

Recommendation: Implement server-side authorization and verify object ownership before returning the requested data.

Great job!

You have successfully completed your lab on API Security Assessment.

In this lab, you have: Identified API endpoints, Analyzed API requests and responses, Tested authentication and authorization controls, Identified common API security vulnerabilities, and Documented the security findings from the intentionally vulnerable API application.

You are now ready to move to the next stage of API security testing.

Topic : Cryptography and Cloud Security 

1) Cloud Architecture & Web Application Hosting

2) Access Control & Identity Exploitation

3) API Security in Cloud Environments Storage, Data Exposure & Misuse

4) Cloud Attack Simulation & Defense