I Took a Hacking Course So I Decided to Hack

First thing i hacked was API 1 and you know fingering (shhhhh) an API without clear ideas on what the API is supposed to do is sorta damning but yeah I did it either way. I dont like complaints because I'm just badass, I created a sweet user by the way.

Pretty basic you'll guess correct? But no it isnt because after creating my user i realized, hey i can change the parameters present in the parameters being sent, so maybe try changing to other users, and just as you guessed, i was able to get every other user in the system. Heck it didnt even have some authentication.

Vulnerability: Insecure Direct Object Reference (IDOR) • Impact: Full user data exposure

I am supposed to Login but for some weird reason, i cant login because i dont have emails and a password. Good thing they left a list of shitty emails and password, a sweet brute force should do this if they lack rate limit, shall we check it out?

1000 requests later, it doesn't seem like they have anything stopping me from sending a million. Guess what this leads to? ATO via lack of rate limiting using brute forcing.

Vulnerability: Broken Authentication • Impact: Account Takeover

It would look like we need an android device for this, but hey that doesn't stop us. Lets crank up a quick android emulator shall we?

I am pretty sure your device doesn't look this pretty, does it. Well we tried to sign up on the device and it was successful, but the application made me spot something unnatural. I send comments, but i can see not just my own comment but some of my PII, not just that but some other information of other users including their precise location, which is disturbing might i add.

Vulnerability: Excessive Data Exposure • Impact: PII and location leakage

In here it feels like a basic and boring login endpoint? SIKE! We gotta deal with OTP verification. Good thing burpsuite lets me try to sniper attack brute force this bloody target.

Slight warning, you'll need burpsuite pro to help because community version is way too weak but yeah i think we aced that. Don't play with me friends.

Vulnerability: Weak OTP implementation • Impact: Bypass 2FA

Damn I'm beginning to get bored, i need something thrilling pleaseee. Okay wait i think I've found it a "Create User" endpoint. Lets see what fun we can do. I mean yeah we can create basic users? Or maybe not, maybe if we added some parameters we can achieve something different.

A 200 response, of course you can verify but ill leave that up to you. Well maybe I'm not the best when it comes to hacking APIs but this definitely reminds me that im no easy catch.

Vulnerability: Parameter Tampering • Impact: Privilege escalation

We gotta create a new user, honestly i am tired of creating new users but hey lets create another shall we. Well we already created a regular account but lets see if theres anything interesting about it.

First switch the header to GET with the parameters we have and lets see what we have. Well we didnt get anything in all honesty just some internal server error. Okay enough suspense, maybe we tweaked the parameter in the account creation section.

Vulnerability: Information Disclosure • Impact: System information leakage

So lets create a new user on this API endpoint real quick. We also gotta login to the app, but wait, something smells fishy here. Like why is the CORS header screaming "Access-Control-Allow-Origin: *" and still allowing credentials? That's straight-up begging for trouble, right?

So I fired up Burp again, added a fake Origin header like I'm some shady third-party site, and BAM—sent the login request. Guess what? It spat back the full user deets: ID, username, password, authkey, the works! No questions asked, just because the origin was wild-carded.

Vulnerability: CORS Misconfiguration • Impact: Cross-origin data theft

Okay, login endpoint? Boring, but let's poke it with some SQL spice. I threw in a classic "' OR 1-- " into the username in Postman, proxied through Burp, and hit Intruder on sniper mode with a bunch of SQL payloads.

Most gave 403, but one? Boom, 500 error with a MySQL syntax freakout—jackpot, unsanitized inputs confirmed! Time to escalate, pulled out sqlmap like a boss: enumerated the DBs, found "vapi", tables like "a_p_i8_users", columns for password, secret, username.

Vulnerability: SQL Injection • Impact: Full database compromise

This one's got v2 with rate limits (boo), but I sniffed around and spotted a /v1/ path hiding in the shadows—no limits there! Switched the URL in Burp Repeater to /vapi/api9/v1/user/login, crunched up a numbers.txt for PIN brute (0000-9999), and FFUF'd it.

Vulnerability: Improper Assets Management • Impact: Bypass security controls

Boredom strikes again, but wait—"Get Flag" endpoint? Just POST to it in Postman, no fuss, no muss. Grabs the flag straight up. No vuln to exploit, just... there.

Insufficient logging means no one's watching, no alerts, pure stealth access. OWASP nailed it—monitoring is key, or else flags (and real secrets) walk right out the door!

Vulnerability: Insufficient Logging & Monitoring • Impact: Undetected data access

The walkthrough threw in three extras:

• API 11: Undocumented endpoint guessing for hidden admin funcs—fuzzed paths in Burp till /admin/secret dumped the goods
• API 12: XML bomb DoS via external entity—parsed a massive XML payload to crash the parser
• API 13: API chaining abuse, linking vulns from prior APIs into a full account takeover chain

Each spat flags like candy. Felt like leveling up in a video game, OWASP bonuses making me feel invincible!