Documentation Powered by ReDoc

vAPI (1.1)

Download OpenAPI specification:Download

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises.

Authentication

noauthAuth

Security Scheme Type HTTP
HTTP Authorization Scheme noauth

API1

Broken Object Level Authorization

You can register yourself as a User , Thats it ....or is there something more?

Create User

Authorizations:
noauthAuth
header Parameters
Content-Type
string
Example: application/json
Accept
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "username": "",
  • "name": "",
  • "course": "",
  • "password": ""
}

Get User

path Parameters
api1_id
required
string
header Parameters
Authorization-Token
string
Example: {{api1_auth}}
Content-Type
string
Example: application/json

Responses

Update User

Authorizations:
noauthAuth
path Parameters
api1_id
required
string
header Parameters
Authorization-Token
string
Example: {{api1_auth}}
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "username": "",
  • "name": "",
  • "course": "",
  • "password": ""
}

API2

Broken Authentication

We don't seem to have credentials for this , How do we login? (There's something in the Resources Folder given to you )

User Login

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "email": "",
  • "password": ""
}

Get Details

header Parameters
Authorization-Token
string
Example: {{api2_auth}}

Responses

API3

Excessive Data Exposure

We have all been there , right? Giving away too much data and the Dev showing it . Try the Android App in the Resources folder

Create User

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "username": "",
  • "password": "",
  • "name": ""
}

API4

Lack of Resources & Rate Limiting

We believe OTPs are a great way of authenticating users and secure too if implemented correctly!

Mobile Login

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "mobileno": "8000000535"
}

Verify OTP

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "otp": "9999"
}

Get Details

header Parameters
Authorization-Token
string
Example: {{api4_key}}
Content-Type
string
Example: application/json

Responses

API5

Broken Function Level Authorization

You can register yourself as a User. Thats it or is there something more? (I heard admin logins often but uses different route)

Create User

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "username": "testuser2",
  • "password": "test123",
  • "name": "Test User",
  • "address": "ABC",
  • "mobileno": "888888888"
}

Get User

path Parameters
api5_id
required
string
header Parameters
Authorization-Token
string
Example: {{api5_auth}}

Responses

API6

Mass Assignment

Welcome to our store , We will give you credits if you behave nicely. Our credit management is super secure

Create User

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "name": "",
  • "username": "",
  • "password": ""
}

Get User

header Parameters
Authorization-Token
string
Example: {{api6_auth}}

Responses

API7

Security Misconfiguration

Hey , its an API right? so we ARE expecting Cross Origin Requests . We just hope it works fine.

Create User

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "username": "",
  • "password": ""
}

User Login

header Parameters
Authorization-Token
string
Example: {{api7_auth}}
Content-Type
string
Example: application/json

Responses

Get Key

header Parameters
Content-Type
string
Example: application/json

Responses

User Logout

header Parameters
Content-Type
string
Example: application/json

Responses

API8

Injection

I think you won't get credentials for this.You can try to login though.

User Login

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "username": "",
  • "password": ""
}

Get Secret

header Parameters
Authorization-Token
string
Example: {{api8_auth}}

Responses

API9

Improper Assets Management

Hey Good News!!!!! We just launched our v2 API :)

API9 > v2

Login

header Parameters
Content-Type
string
Example: application/json
Request Body schema: application/json
object

Responses

Request samples

Content type
application/json
{
  • "username": "richardbranson",
  • "pin": "****"
}

API10

Nothing has been logged or monitored , You caught us :( !

Get Flag

I am not kidding!

header Parameters
Content-Type
string
Example: application/json

Responses