API Security OWASP Medium
crAPI
API security assessment of the Completely Ridiculous API (crAPI) vulnerable application. Explored REST API vulnerabilities including broken authentication, excessive data exposure, mass assignment, and security misconfiguration.
Date
2025
Tools
Burp SuitePostmancURLOWASP ZAP
Skills
API SecurityBOLABFLAMass AssignmentJWT AnalysisRate Limiting
Objective
Identify and exploit common API security vulnerabilities in crAPI to understand REST API attack vectors.
Key Findings
- Broken Object Level Authorization (BOLA)
- Broken Function Level Authorization (BFLA)
- Excessive Data Exposure
- Mass Assignment
- Security Misconfiguration
- Insufficient Logging
Skills Demonstrated
API reconnaissance, endpoint enumeration, request manipulation, authentication/authorization testing, and API-specific vulnerability identification.