Lion Cipher Lab

Test a REST API against the OWASP API Security Top 10 (Part 2): BFLA, mass assignment, and rate-limit abuse

• AppSec / DevSecOps
• Intermediate
• ~75 min
• Free · no account required

Why it matters

Part 1 showed you APIs that hand back data they should not — you read another user's object (BOLA) and saw fields the web page hides (excessive data exposure). But the flaws that turn a bad day into a breach are the ones that let an attacker ACT: promote themselves to admin, delete other people's records, give themselves free products, drain a balance, or brute-force a login because nothing stops them. Those live in the deeper half of the OWASP API Security Top 10, and this lab reproduces the three that matter most on your own copy of crAPI. Broken Function Level Authorization (API5) is the…

What you'll learn

• reading the full OWASP API Security Top 10 (2023) and placing each flaw on it
• telling Broken Function Level Authorization (BFLA) apart from Broken Object Level Authorization (BOLA): wrong FUNCTION/role vs wrong OBJECT
• finding a privileged or admin endpoint a normal user was never meant to call, by changing the HTTP method or guessing the path
• reproducing mass assignment: adding an extra field to a request body and watching the server bind it to the object (a free item, a bumped balance, a role)
• seeing Unrestricted Resource Consumption: hammering an endpoint or brute-forcing a short code because nothing rate-limits you
• sending crafted POST/PUT requests with curl, including a JSON body with -d
• using the browser Network tab (F12) and crAPI's challenges list to discover the exact endpoints
• stating the precise server-side fix for each flaw (role check, property allow-list, rate limit)
• doing all of it strictly on an API you own and run yourself, never one belonging to anyone else

Steps in this lab

1. Same one rule as Part 1: your machine, your API, nobody else's
2. The whole OWASP API Top 10, and where Part 1 and Part 2 sit on it
3. Start your own crAPI and log in (recap from Part 1)
4. Find the endpoints: the Network tab and the challenges list
5. API5 - Broken Function Level Authorization: reach a function your role should not
6. API3 (write side) - Mass Assignment: add a field the form never sends
7. API4 - Unrestricted Resource Consumption: the missing brake
8. What you proved, the defender's checklist, and where it goes next

Open the full interactive lab →