Vulnerable REST API – OWASP 2023

A vulnerable RESTful application written in Node and React based on OWASP API security top 10 2023 edition. Common API vulnerabilities and attack scenarios are also included to make it more comprehensive.

How to install

Option 1: Run on Docker (recommended)

git clone https://github.com/bnematzadeh/vulnerable-rest-api.git

cd vulnerable-rest-api/

Add your SMTP credentials and provider in server/smtp_config.list. I personally recommend the elasticemail:

Create an account
Navigate to settings/Create SMTP Credentials
Edit “server/smtp_config.list” and add your credentials

docker-compose up --build

Access the Application

Client: localhost:3000
API: localhost:3001

Option 2: Run on Your Machine (Manual Installation)

Make sure you have already installed Node and MongoDB on your system.

Client Setup
- cd client/
- npm install
- npm start
- Access the application via http://localhost:3000
Server Setup
- Set your SMTP credentials as environment variables based on server/config/custom-environment-variables.json
- Make sure the mongodb service is running
  - cd server/
  - npm install
  - npm install migrate-mongo --dev-save && npm run db:up
  - npm start
  - The API is available on http://localhost:3001

Vulnerabilities

API1:2023 – Broken Object Level Authorization
API2:2023 – Broken Authentication
API3:2023 – Broken Object Property Level Authorization
API4:2023 – Unrestricted Resource Consumption
API5:2023 – Broken Function Level Authorization
API6:2023 – Unrestricted Access to Sensitive Business Flows
API7:2023 – Server Side Request Forgery
API8:2023 – Security Misconfiguration
API9:2023 – Improper Inventory Management
API10:2023 – Unsafe Consumption of APIs
Bonus
- Injection
- Web Cache Deception
- Weak Implementation of Reset Password (Account Takeover)

GitHub

View Github