Muhammad FaqihApplication security · Penetration testing

Security assessment · API security

crAPI

An assessment of crAPI, an intentionally vulnerable API, covering access control, authentication and input validation.

Lab assessment · Simulated environment

Assessment overview

Testing question

Can a signed-in user access someone else’s data?

Approach

I tested access control, authentication and input validation, then documented the findings with requests, responses and screenshots.

Results

19 test cases: 11 FAIL and 8 PASS, with 49 screenshots. These are lab results, not production metrics. The counts describe test cases, not distinct controls.

Security assessment / Report

Penetration testing report

View the HTML report or open an available original PDF below. Each PDF link shows its language.

HTML · EN View report 19 test cases · 11 FAIL / 8 PASS PDF · EN Original PDF report Open PDF (EN) PDF · ID Original PDF report Open PDF (ID)

Evidence / Test-case index

Browse test cases

PASS means the application behaved as expected in that test. FAIL means the test confirmed a security weakness. Counts refer to test cases, not distinct controls.

01
Broken Function Level Authorization - Workshop - Management Users EndpointThe management endpoint /workshop/api/management/users/all -- which should be restricted to administrators -- is reachable by an ordinary authenticated user (role=user). The endpoint returns data for every user in t…
FAIL
02
Broken Object Level Authorization - Vehicle - Location TrackingThe vehicle location endpoint returns another user's GPS position given only a vehicle UUID. The server verifies authentication but does not verify object ownership (BOLA/IDOR).
FAIL
03
Broken Object Level Authorization - Workshop - Mechanic ReportThe mechanic_report endpoint accepts a sequential report_id and returns service reports belonging to other users (VIN and owner email) without verifying any relationship to the caller.
FAIL
04
Improper Inventory Management - Authentication - OTP Endpoint VersionsThe OTP verification endpoint exists in several versions that are active at the same time: the older /identity/api/auth/v2/check-otp still works alongside the current v3. Retired/undocumented versions enlarge the at…
FAIL
05
JWT Signature Not Verified - Authentication - JWT ValidationThe crAPI identity service does not verify JWT signatures. A token with the header alg:none and no signature is accepted, and an RS256 token whose payload was modified without re-signing is also accepted. An attacke…
FAIL
06
NoSQL Injection - Community - Coupon ValidationThe validate-coupon endpoint passes the JSON value coupon_code straight into a MongoDB query without type sanitization. Query operators (e.g. $ne, $gt) match any coupon without knowing its code.
FAIL
07
OTP Bruteforce Protection Bypass - Authentication - Password ResetReset OTP verification (/v3/check-otp) locks after 9 attempts per session, BUT this limit is reset every time /forget-password is called, and that endpoint itself has no rate limit or CAPTCHA. The brute-force protec…
FAIL
08
Server-Side Request Forgery - Workshop - Contact MechanicThe contact_mechanic endpoint accepts a full URL in the mechanic_api parameter and performs a server-side HTTP request to that URL, then reflects the response. An attacker can point it at INTERNAL services that are …
FAIL
09
Unauthenticated Order Access - Shop - Order DetailsThe endpoint GET /workshop/api/shop/orders/{order_id} returns full order details without authentication, and order_id is sequential and easy to enumerate.
FAIL
10
Unrestricted Resource Consumption - Authentication - Login Rate LimitingThe crAPI login endpoint applies neither rate limiting nor account lockout. Repeated failed login attempts are not limited, enabling brute force/credential stuffing and unbounded consumption of server resources.
FAIL
11
Unsafe Consumption of APIs - Workshop - Contact Mechanic UpstreamThe contact_mechanic endpoint consumes the response from the mechanic API (a client-controlled URL) and reflects it back to the user without validating or filtering its structure or content. The application implicit…
FAIL
12
Broken Access Control - Login - CSRF Token Cookie Binding
PASS
13
Broken Object Level Authorization - Shop - Return OrderTested whether the order return action (return_order) is vulnerable to BOLA by attempting to return an order belonging to another user.
PASS
14
Broken Object Level Authorization - Vehicle - Location Tracking (Unauthenticated)Tested access to the vehicle location endpoint without any authentication.
PASS
15
Broken Object Level Authorization - Workshop - Mechanic Report (Unauthenticated)Tested access to the mechanic_report endpoint without authentication.
PASS
16
Mass Assignment - Authentication - User RegistrationTested whether the registration endpoint is vulnerable to mass assignment by injecting privileged fields (role=admin, isAdmin=true) into the signup body.
PASS
17
NoSQL Injection - Community - Coupon Validation (Normal Input)Tested coupon validation with ordinary string input (valid and unknown), without NoSQL operators.
PASS
18
OTP Bruteforce Protection - Authentication - Password Reset (Per-Session Lockout)Tested OTP brute force within a single OTP session without requesting a new OTP.
PASS
19
Unrestricted Access to Sensitive Business Flow - Shop - Coupon ClaimTested whether a sensitive business flow (claiming a coupon to top up the balance) can be abused by claiming the same coupon repeatedly (replay).
PASS