CAPIS · Web Exploitation

API Security Specialist

Intermediate

A 3-day hands-on certification. A private fintech REST API and its internal service are provisioned on booking. Complete 16 tasks across the OWASP API Security Top 10 (BOLA, mass assignment, SSRF, SQLi, BFLA, JWT attacks and more). Passing the practical (70%) then requires a written report that an examiner reviews before certification.

Flags / tasks 16

Environment Live targets

Access Super VIP

Price TBA

Objectives

Flag every task to complete the lab

16 aims

1 Open the API documentation. What is the path of the interactive API docs page?

2 What Server header does the API report on its responses?

3 The users endpoint does not enforce object-level authorization (BOLA). Enumerate user 1 and submit the flag in their note field.

4 What is the administrator's email address (found by enumerating the users endpoint)?

5 The PATCH user endpoint is vulnerable to mass assignment. Escalate your role to admin and submit the flag returned.

6 Authenticate via the login endpoint and inspect the returned JWT header. Which signing algorithm does it use?

7 The debug endpoint exposes runtime internals (security misconfiguration). What is the flag it reveals?

8 What is the JWT signing secret leaked by the debug endpoint?

9 Forge an admin JWT with the leaked secret (broken function-level authorization) and query the admin flag endpoint. Submit the flag.

10 The transactions search is vulnerable to SQL injection. Inject a condition that always evaluates true and submit the flag.

11 The user response leaks an API key (excessive data exposure). Use it on the internal stats endpoint and submit the flag.

12 A deprecated API version (v2) is still active (improper inventory). Enumerate a user via v2 and submit the legacy flag.

13 The internal service (second port) exposes a flag route reachable only from the API host. What is that route?

14 Use the webhook test endpoint to SSRF into the internal service and submit the flag.

15 Which API version is marked deprecated but is still active?

16 The API accepts JWT tokens signed with the 'none' algorithm (broken authentication). Craft one with role 'root' and access the root endpoint. Submit the flag.

Learning outcomes

Mapped skills

OWASP API Security Top 10 (2023)
OWASP Web Security Testing Guide v4.2 (API/GraphQL)
OWASP Top 10 (2021)

On start, a dedicated live environment is provisioned for you. While your Super VIP membership is active you can spawn it, work through the objectives, and destroy it whenever you like. Progress is saved as you go. Complete all objectives to earn a unique, publicly verifiable credential (verify link, score snapshot and integrity hash) bound to this Pro Lab.