vAPI — API Security Assessment

Case summary

A full controlled vAPI assessment traversing the OWASP API Top 10 (2019) plus JWT, SSRF, and XSS Arena challenges, with thirteen confirmed findings documented from Critical to Medium severity.

Overview

The sections below are a concise case-file overview. The detailed assessment report is kept separate so the case page remains readable while the complete evidence and findings remain available to readers who want them.

Context

vAPI is a deliberately vulnerable, self-hosted API (Docker, localhost:9000) built around the OWASP API Security Top 10 (2019). I used it to practice the whole assessment workflow: lab setup, request inspection, controlled exploitation, evidence capture and remediation guidance.

Objective

Find, exploit and document every vulnerability class the lab contains, and write each one up the way a client report would: what it is, how I proved it, what it could cost, and how to fix it.

Scope

The self-hosted vAPI environment only. All ten OWASP API Top 10 (2019) categories plus three Arena challenges: weak JWT tokens, SSRF and stored XSS.

Approach

Postman collection proxied through Burp Suite so every request and response could be inspected and replayed. Burp Intruder and ffuf for credential attacks, SQLMap for injection, jwt_tool for token manipulation. Each finding got the same record: what it is, steps, evidence, impact, remediation.

Results: 13 confirmed findings

• Critical (3): BOLA (API1), reading other users’ records by changing the object ID. Broken authentication (API2), credential stuffing worked because there was no rate limiting, lockout or CAPTCHA. Injection (API8), SQLMap enumerated and dumped database contents.
• High (9): Excessive data exposure (API3), lack of rate limiting (API4), function-level authorization (API5), mass assignment (API6), security misconfiguration (API7), improper asset management (API9), and the three Arena challenges: weak JWT tokens, SSRF and stored XSS.
• Medium (1): Insufficient logging and monitoring (API10).

Impact

In a production API the three critical findings together mean full database compromise, complete account takeover and mass unauthorized data disclosure.

Remediation priorities

Enforce authorization on the server for every object and function. Add rate limiting and lockout on authentication. Parameterize queries and validate input and output. Control outbound requests. Handle tokens securely. Retire legacy endpoints. Log security-relevant events.

What I Learned

Authentication is not authorization. Legacy endpoints are part of the attack surface. Evidence quality matters as much as the exploit. The OWASP Top 10 is a baseline, not a ceiling.