Lion Cipher Lab

Test API security in your own lab

• Penetration Testing / Red Team
• Intermediate
• ~75 min
• Free · no account required

Why it matters

An API is the machine-to-machine doorway behind almost every app you use: when a phone app shows your orders or a website loads your profile without a full page reload, it is quietly calling an API and getting back data. Because APIs hand out data directly, the way they check WHO is asking and WHAT they are allowed to see is where a huge share of modern breaches happen. The security field catalogs these in the OWASP API Security Top 10, and the same few flaws dominate real incidents: an endpoint that confirms you are logged in but not that the record you asked for is actually yours (broken…

What you'll learn

• understanding what an API, an endpoint, REST, and JSON are, in plain language
• installing Docker Desktop and running a deliberately vulnerable API (OWASP crAPI) on your own machine with a couple of commands
• understanding what a bearer token (JWT) is and how you get one by logging in
• sending real HTTP requests from a terminal with curl (and optionally Postman)
• reading a raw JSON API response and picking out the fields the pretty web page hides
• finding a broken object-level authorization (BOLA / IDOR) flaw by changing an object id and seeing another user's data
• spotting excessive data exposure where an endpoint returns more than the user should see
• recognizing broken authentication where an endpoint fails to check the token properly
• naming these against the OWASP API Security Top 10 and stating the fix for each
• doing all of it strictly on an API you own and run yourself, never one belonging to anyone else

Steps in this lab

1. First, the one rule that makes this legal: your machine, your API, nobody else's
2. What an API, an endpoint, REST, and JSON actually are (from zero)
3. The OWASP API Security Top 10, and the three flaws you will hunt
4. Install Docker and run your deliberately vulnerable API
5. Confirm curl, and create TWO accounts on your own crAPI
6. Log in from the terminal and get your token
7. Hunt the BOLA / IDOR flaw: change an object id, see another user's data
8. Spot excessive data exposure: read the fields the web page hides
9. Probe broken authentication: does the endpoint really check the badge?
10. What you proved, the defender's checklist, and where it takes you

Open the full interactive lab →