Technical Writeup
Web App & API Pentesting Lab
OWASP Top 10 · API Security Top 10 · Burp Suite · Structured Reporting
Hands-on penetration testing against intentionally vulnerable targets with a focus on producing professional-grade findings reports - not just exploiting but documenting reproduction steps, impact, and remediation guidance. Lab targets span OWASP Top 10 web vulnerabilities and the OWASP API Security Top 10, with emphasis on the API-specific issues most common in fintech and SaaS environments.
Techniques Practiced
- BOLA (API1): accessed other users' vehicle location data by modifying GUIDs; no server-side ownership check
- OTP brute force (API2): no rate limiting on 4-digit OTP; account takeover via Burp Intruder in under 3 minutes
- Rate limiting bypass (API4): X-Forwarded-For header rotation, null byte email mutation, distributed request threading
- SQL injection: login bypass and full user table extraction via UNION SELECT; MD5 hashes cracked offline with hashcat
- GraphQL introspection enabled: full schema leaked including undocumented admin mutations (deleteUser, resetPassword)
- All findings documented to professional report standard: severity (CVSS v3.1), endpoint, reproduction steps, evidence, impact, remediation
MITRE ATT&CK
API1: BOLAAPI2: Broken AuthAPI4: Rate LimitingA03: InjectionA10: SSRF
Tools
Burp SuiteOWASP ZAPDVWAcrAPIJuice ShophashcatDockerPostman