Project 72: API Security Assessment

Module: Module 8: Exploit Development & Malware Fundamentals  |  Level: Advanced  | 
Primary tool: Postman (free) + OWASP crAPI  |  Estimated time: 2–4 hours

Objective: Test a modern API for the OWASP API Top 10 issues (BOLA, excessive data exposure, etc.).

Free lab environment

OWASP crAPI (Completely Ridiculous API, free) — https://github.com/OWASP/crAPI

crAPI is a free, open-source, deliberately vulnerable modern API application built by OWASP specifically for API-security training; run it locally with Docker Compose.

Lab workflow

  1. Deploy OWASP crAPI (local Docker Compose instance) locally via Docker Compose and confirm it is only reachable from your own machine.
  2. Using Postman (free) + OWASP crAPI, explore the API’s intended behavior and authentication flow before testing anything adversarial.
  3. Attempt to test a modern API for the OWASP API Top 10 issues (BOLA, excessive data exposure, etc.), changing one parameter (e.g. an object ID) at a time.
  4. The moment you get a signal the technique works, capture evidence immediately.
  5. Write the exact authorization check that is missing on the affected endpoint.
  6. Note which OWASP API Security Top 10 category this finding maps to.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

  • your Postman collection/request proving a BOLA (broken object-level authorization) finding
  • your written remediation for that exact endpoint

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.

PreviousNext