Vulnerable API: vulnerable to a number of vulnerabilities on the OWASP API top 10

Vulnerable API

This is a Laravel App which I’ve used for several demos which is vulnerable to a number of vulnerabilities on the OWASP API top 10. This is not a CTF, the bugs are quite clear and not hidden, however, I suspect this will be a useful demo!

Vulnerabilities

Find out more about the OWASP API Top 10

• API1:2019 Broken Object Level Authorization
• API2:2019 Broken User Authentication
• API3:2019 Excessive Data Exposure
• API5:2019 Broken Function Level Authorization
• API6:2019 Mass Assignment
• API7:2019 Security Misconfiguration

Your Goals

1. Find the emails of the administrator
2. Brute forces the API to find new endpoints
3. Find out what grades everyone got in a class
4. Edit someone’s grade
5. Make an account
6. Access the GraphQL API
7. Change another account’s password
8. Login to your account
9. Access admin API
10. Find out what vulnerabilities the IT admins have ignored
11. Make your account an admin
12. Access the admin control panel
13. Fire a blind XSS in the admin control panel and validate with your new admin account
14. Delete everything
15. Restore everything

Install & Use