# Pynt vs OWASP crAPI

[OWASP **crAPI**](https://github.com/OWASP/crAPI) (Completely Ridiculous API) is an intentionally vulnerable API designed to help security professionals and developers learn about API security risks. It simulates real-world API security flaws, including:

* **Broken Object Level Authorization (BOLA)**
* **Broken User Authentication**
* **Excessive Data Exposure**
* **Security Misconfigurations**
* **Injection Attacks**

crAPI provides a hands-on environment for practicing API security testing, exploiting vulnerabilities, and learning how to secure APIs effectively. It's useful for penetration testers, security engineers, and developers looking to improve their API security skills.

## crAPI Security Challenges

Pynt uncovers the underlying vulnerabilities in crAPI (such as BOLA, mass assignment, SQL/NoSQL injection, etc.), rather than demonstrating the full exploits themselves. The goal is to identify where the API is weak and prove that those weaknesses can be triggered, without carrying out the destructive or business-logic-breaking steps of the exploit. This way, Pynt provides actionable findings while keeping testing safe and controlled.

<table data-full-width="true"><thead><tr><th width="47.703125">#</th><th width="361.8671875">Category</th><th>Challenge</th><th>Pynt Coverage</th><th>How to run ?</th></tr></thead><tbody><tr><td>1</td><td>BOLA (Broken Object-Level Authorization)</td><td>Access details of another user’s vehicle</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - User data leakage to other users - Resource-ID authorization</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>2</td><td>BOLA (Broken Object-Level Authorization)</td><td>Access mechanic reports of other users</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - User data leakage to other users - Resource-ID authorization</td><td><a href="#how-to-scan-crapi-with-pynt-using-pynt-modified-postman-collection">crAPI modified postman collection</a></td></tr><tr><td>3</td><td>Broken Authentication</td><td>Reset the password of a different user</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Rate-limit enforcement for OTP Endpoints</td><td><a href="#how-to-scan-crapi-with-pynt-using-pynt-modified-postman-collection">crAPI modified postman collection</a></td></tr><tr><td>4</td><td>Excessive Data Exposure</td><td>Find an API endpoint that leaks sensitive information of other users</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Excessive Data Exposure</td><td><a href="#how-to-scan-crapi-with-pynt-using-pynt-modified-postman-collection">crAPI modified postman collection</a></td></tr><tr><td>5</td><td>Excessive Data Exposure</td><td>Find an API endpoint that leaks an internal property of a video</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Mass assignment by manipulation of hidden attributes</td><td><a href="#how-to-scan-crapi-with-pynt-using-pynt-modified-postman-collection">crAPI modified postman collection</a></td></tr><tr><td>6</td><td>Rate Limiting / DoS</td><td>Abuse the “contact mechanic” feature for a denial-of-service attack</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Multiple Requests Rate Limit (Need to enable in Pynt dashboard. Application -> tests -> include in scans)</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>7</td><td>BFLA (Broken Function-Level Authorization)</td><td>Delete a video of another user</td><td><span data-gb-custom-inline data-tag="emoji" data-code="274c">❌</span> - Will be supported in the upcoming update to the Business logic package </td><td></td></tr><tr><td>8</td><td>Mass Assignment</td><td>Get an item for free</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Negative Value Injection</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>9</td><td>Mass Assignment</td><td>Increase your balance by $1,000 or more</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Negative Value Injection</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>10</td><td>Mass Assignment</td><td>Update internal video properties</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Mass assignment by manipulation of hidden attributes</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>11</td><td>SSRF (Server-Side Request Forgery)</td><td>Make crAPI send an HTTP call to “www.google.com” and return the response</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Remote resource access</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>12</td><td>NoSQL Injection</td><td>Get free coupons without knowing the coupon code</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - NoSQL Injection</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>13</td><td>SQL Injection</td><td>Redeem a coupon that has already been claimed</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - PostgreSQL Injection</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>14</td><td>Unauthenticated Access</td><td>Find an endpoint that does not perform authentication checks</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Ignored authentication token</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>15</td><td>JWT Vulnerabilities</td><td>Forge valid JWT tokens</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - JWT Forgery via External JWKS</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr><tr><td>S1</td><td>Secret Challenge</td><td>Undisclosed (advanced hidden challenge)</td><td><span data-gb-custom-inline data-tag="emoji" data-code="2705">✅</span> - Negative Value Injection</td><td><a href="#how-to-scan-crapi-with-pynt-using-the-crapi-postman-collection">crAPI official postman collection</a></td></tr></tbody></table>

<h2 align="center">Other Notable findings by Pynt</h2>

<table data-full-width="true"><thead><tr><th width="340.7578125">Vulnerability </th><th width="446.8828125">Endpoint</th><th>explanation</th></tr></thead><tbody><tr><td>User data leakage to other users - credentials authorization</td><td>POST /identity/api/v2/user/change-email</td><td>User can initiate email change for a different user, the verify will not work so the impact is Low</td></tr><tr><td>User data manipulation by other users - Resource-ID authorization</td><td>POST /workshop/api/merchant/contact_mechanic.</td><td>User can initiate a mechanic call for a different User, impact is low</td></tr><tr><td>Exposed .env File</td><td>/.env</td><td><p></p><p>Pynt detected an exposed environment file located in the server root</p></td></tr></tbody></table>

## How to get crAPI ?&#x20;

First we will need to setup crAPI as described here: <https://github.com/OWASP/crAPI>

Or just use prebuilt images:

#### Linux machines:

```bash
curl -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/main/deploy/docker/docker-compose.yml

docker-compose pull

docker-compose -f docker-compose.yml --compatibility up -d
```

#### Windows machines:

```bash
curl.exe -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/main/deploy/docker/docker-compose.yml

docker-compose pull

docker-compose -f docker-compose.yml --compatibility up -d
```

## How to scan crAPI with Pynt using the crAPI postman collection ?

#### Get the official crAPI postman collection and environment files:

<pre data-full-width="false"><code><strong>wget https://raw.githubusercontent.com/OWASP/crAPI/refs/heads/main/postman_collections/crAPI.postman_collection.json
</strong>wget https://raw.githubusercontent.com/OWASP/crAPI/refs/heads/main/postman_collections/crAPI.postman_environment.json
wget -O crAPI.postman_environment2.json https://raw.githubusercontent.com/OWASP/crAPI/refs/heads/main/postman_collections/crAPI.postman_environment.json
</code></pre>

The second environment file will make Pynt run the collection twice, simulating traffic for two users. This enables Pynt to perform Business Logic Attacks.

{% hint style="danger" %}
On Mac and Windows PCs modify the base URLs in the environment files to be `localhost` and not `127.0.0.1`&#x20;

```
"values": [{
        "key": "url",
        "value": "http://localhost:8888",
        "enabled": true
    },
    {
        "key": "url_mail",
        "value": "http://localhost:8025",
        "enabled": true
    }
],
```

{% endhint %}

### Install Pynt CLI

`python3 -m pip install pyntcli`

Run Pynt with crAPI postman collection:

{% code overflow="wrap" fullWidth="false" %}

```bash
pynt newman --collection crAPI.postman_collection.json --environment crAPI.postman_environment.json crAPI.postman_environment2.json
```

{% endcode %}

## How to scan crAPI with Pynt using Pynt modified postman collection ?

To get some challenges we created two new postman collections:

&#x20;[**crAPI-modified.json**](https://raw.githubusercontent.com/pynt-io/pynt/refs/heads/crapi-cloud-files/crapi/crAPI-modified-v2.1.json) - A collection that includes APIs that where missing from the original collection.

{% code overflow="wrap" %}

```bash
wget https://raw.githubusercontent.com/pynt-io/pynt/refs/heads/crapi-cloud-files/crapi/crAPI-modified-v2.1.json
```

{% endcode %}

[**crAPI-alignment\_collection-v2.json**](https://raw.githubusercontent.com/pynt-io/pynt/refs/heads/main/crapi/crAPI-alignment_collection-v3.json) - Populates lot more user data into crAPI database, helps with finding some of the challenges

1. First run the alignment collection against crAPI:

```bash
newman run crAPI-alignment_collection-v2.json -e crAPI.postman_environment.json
```

2. Now run the Pynt scan:

{% code overflow="wrap" %}

```bash
pynt newman --collection crAPI-modified.json --environment crAPI.postman_environment.json crAPI.postman_environment2.json
```

{% endcode %}