OWASPApiTop10

**APISandbox/OWASPApiTop10** is an open source shooting range project specially designed for API security teaching and drills. It covers all typical vulnerability scenarios of OWASP API Top 10. This project is suitable for security researchers, developers, testers, and college teachers and students to learn, demonstrate and test common security risks and best practices for API interfaces. You can use it after registering and logging in. ####Main characteristics - ** Complete coverage of the OWASP API Top 10**: Each risk point is equipped with a real and interactive vulnerability interface to facilitate understanding and reproduction of the vulnerability principle. - ** One-click deployment **: Supports rapid deployment of Docker, making it convenient to build local or cloud environments. - **Swagger UI integration **: Visiting the home page will automatically jump to Swagger documents to facilitate interface testing and call. - ** Rich usage scenarios **: Suitable for security training, penetration test drills, automated security tool testing and other scenarios. - ** Detailed vulnerability description **: Each vulnerability point has a detailed description and utilization instructions to help users get started quickly. ####Vulnerability types covered 1. ** Missing object-level authorization **: If a user can traverse other people's information 2. ** Identity authentication flaw **: If SecretKey leaks lead to forged login 3. ** Excessive exposure of data **: If the interface returns all user emails 4. ** Insufficient resource and rate restrictions **: If the login interface can be blasted 5. ** Functional level authorization defect **: If all user details can be obtained 6. ** Large-scale assignment vulnerability **: If you can register as an administrator 7. ** Security configuration error **: such as source code leakage, unauthorized access to static resources 8. ** Injection attack **: For example, SQL injection obtains sensitive information 9. ** Improper asset management **: If the history interface is not disabled, information is leaked 10. ** Insufficient logging and monitoring **: If malicious interfaces have no logging ####Applicable objects - API developers and architects - Safety Test Engineer - penetration testers - Teachers and students of information security-related courses in colleges and universities