Exposed API
Five REST API endpoints with broken access controls. IDOR, mass assignment, JWT forgery, BFLA, and SSRF — the API security top five, each running in a live target you can actually attack.
The Machines
Five endpoints. Five broken access controls. All live.
GET /api/v1/users/<id> returns full user objects with no ownership check. User id=2 is admin and the response includes ssh_password. Increment the ID.
PUT /api/v1/profile accepts any field in the JSON body, including role. Set role=admin and the response unlocks admin SSH credentials. No server-side filtering.
HS256 with secret=secret, plus alg:none accepted. Crack the weak secret or strip the signature entirely to forge an admin JWT and access protected endpoints.
Admin endpoint returns 403 normally. Adding X-Internal-Request:true bypasses the auth check entirely. One header, full admin access. Check your request headers.
POST /api/v1/fetch fetches any URL server-side. Point it at localhost:8080/internal/dump — that endpoint returns the SSH private key. Classic SSRF data exfil.
Attack Chain
Recommended order of attack.
Ready to own the API?
Five broken access controls. Five real bounty-class bugs. OWASP API Top 10 in one series.
Launching 11 July 2026 — API security series covering OWASP API Top 10 attack patterns.