Topic

api

14 resources across 1 kinds

Labs & practice targets

crAPI
Completely Ridiculous API — intentionally vulnerable microservice API (vehicle-owner theme) built around the OWASP API Security Top 10 (BOLA/BFLA/mass assignment).
Open ↗
Damn Vulnerable C# Application (API)
Deliberately vulnerable C#/.NET API-only application for learning and practicing API security.
Open ↗
Damn Vulnerable RESTaurant
Stateful FastAPI game teaching privilege escalation and long-horizon API workflows with attack/fix modes.
Open ↗
DVWS-node
Damn Vulnerable Web Services (Node) — app with a web service and API covering IDOR, mass assignment, NoSQL/SQLi, SSRF, JWT and XXE.
Open ↗
Generic University
Vulnerable Laravel API (student-grades theme) aligned to the OWASP API Security Top 10; bugs are visible, not hidden.
Open ↗
OWASP crAPI
Realistic microservices app for advanced API testing: multi-user authorization, API chaining, and business workflows.
Open ↗
Pixi
OWASP DevSlop MEAN-stack app with deliberately insecure APIs for scanning and API-security demos.
Open ↗
Tiredful API
Intentionally broken Django REST API teaching information disclosure, IDOR, access control, throttling and injection flaws.
Open ↗
VAmPI
Vulnerable REST API teaching BOLA, mass assignment, JWT, SQLi, enumeration, and rate limits, with vulnerable and secure modes as positive/negative controls.
Open ↗
vAPI
Vulnerable Adversely Programmed Interface — self-hostable PHP/Laravel API mirroring the OWASP API Top 10 through exercises.
Open ↗
vuln-node.js-express.js-app
Very vulnerable Node/Express web app and API (Swagger/Sqlite/Sequelize) for testing security tools and pentesting.
Open ↗
vulnerable-api (mattvaldes)
Example Python (Bottle) API vulnerable to TLS issues, user enumeration, auth bypass, SQLi and session-management flaws.
Open ↗
VulnerableLightApp
Vulnerable .NET/C# API built for educational purposes.
Open ↗
Websheep
App based on willingly vulnerable RESTful APIs (Angular/Node).
Open ↗