⚠ FOR SECURITY TESTING PURPOSES ONLY — DO NOT DEPLOY IN PRODUCTION
Insecure APIs
Insecure API / IDOR
REST endpoints with no authentication, IDOR via sequential IDs, unauthenticated secret exposure, and verbose error responses leaking internal structure.
> Show hints
- [1] GET /api/vuln/users — returns all users including passwords and API keys
- [2] GET /api/vuln/users/1 through /4 — IDOR, no auth required
- [3] GET /api/vuln/secret — exposes DB password and JWT signing key
- [4] Try a non-existent ID to see verbose error with internal stack trace
[1] Unauthenticated User List
GET /api/vuln/users — no auth required. Returns all users including passwords and API keys.
[2] IDOR — Access Any User
GET /api/vuln/users/:id — no ownership check. Try IDs 1–4 or a non-existent ID for verbose errors.
[3] Exposed Secret Endpoint
GET /api/vuln/secret — no auth. Returns DB password, JWT signing key, and a flag.