API Pentesting | TryHackMe | practical challenge

Explore how to identify and exploit common API security vulnerabilities.

Disclaimer: This blog post is based on a Capture The Flag (CTF) challenge hosted on TryHackMe and it is intended for educational purposes only.

Learning Objectives

By the end of this room, you will be able to:

• Understand the fundamentals of RESTful APIs, including how requests and responses are structured and how authentication is typically handled
• Read and interpret API requests and responses in JSON format
• Identify and exploit common API vulnerabilities outlined in the OWASP API Security Top 10, such as BOLA, Broken Authentication, and Mass Assignment
• Understand how modifying request parameters, headers, and body fields can expose security flaws
• Recognise defensive strategies that protect APIs against the vulnerabilities explored in the room

🛠️ Type: Walkthrough

👤 Role: Pentest

💪 Difficulty: Easy

🔗Link : https://tryhackme.com/room/apitesting

Decode the JWT returned by the login endpoint. What role is assigned to the testuser account?

Access user 1’s profile through the BOLA vulnerability. What is their email address?

Retrieve user 1’s order history. What is the flag contained in one of their orders?

Were you able to modify another user’s data using a PATCH request? (yea/nay)

yea

What HTTP status code indicates that rate limiting is in effect?

429

What password did you discover for the admin account?

In the raw API response for sarah.chen, what sensitive field contains a bcrypt hash?

What information is revealed in the internal_notes field of sarah.chen's profile?

What is the term for the developer practice of applying all client-supplied fields directly to a data model without filtering?

mass assignment

After adding "role": "admin" to the PATCH request, what is your new role?

Using your escalated privileges, access the admin users endpoint. How many total users are registered on the platform?

What is the flag returned by the admin endpoint?

Task 6 Putting It All Together

In practice, exploiting an API typically involves chaining multiple findings together. A BOLA vulnerability on its own might provide read access to another user’s data. Combined with excessive data exposure and mass assignment, it provides a path from regular user to full administrative control.

This task presents a challenge that requires you to combine techniques from earlier tasks.

The Challenge

Open the Challenge Simulator in the static site. You start as testuser (user ID 4) with the role customer. Your objective is to escalate your access and retrieve the flag from a restricted admin endpoint.

The simulator has three locked steps. Each step unlocks the next when completed correctly. No hints are provided in the simulator itself, but every technique you need was covered in Tasks 3 through 5.

Step 1 requires you to inspect your own profile and identify a field that reveals information about the user object’s structure.

Step 2 requires you to craft a request that modifies a field the front-end does not expose.

Step 3 requires you to use your new access level to query a restricted endpoint.

What field in the profile response did you use to identify the escalation path?

role

What value did you set that field to?

admin

What is the flag?

This room covered the fundamentals of API security testing, progressing from RESTful API architecture through to chaining multiple vulnerabilities in a simulated attack scenario.

Recap

Task 2 established the foundation: HTTP methods and their CRUD mappings, status codes relevant to security testing, JSON request and response structure, and the three common authentication mechanisms (API keys, Bearer tokens, and JWTs).

Task 3 introduced BOLA, the number one OWASP API Security Top 10 risk. You accessed other users’ profiles and orders by changing object IDs in requests, and confirmed that the vulnerability extended to write operations.

Task 4 demonstrated brute-forcing an unprotected login endpoint and examined how APIs that return entire database objects in their responses leak sensitive data to anyone who inspects the raw JSON.

Task 5 escalated privileges through mass assignment by injecting a role field into a profile update request, and covered rate limiting abuse beyond authentication endpoints.

Task 6 required you to chain these techniques without guidance, progressing from profile inspection to privilege escalation to flag retrieval.