[SOLVED] Cs6035 api security fall2025

BACKGROUND:

You’ve been hired by the IPLRA (International Programming Language Review Association) to conduct a security audit for their newly released API. They are excited to finally release an API to the community for developers across the world to leverage. In fact, they see this API as a way to increase their amount of reviews by 800%. The only thing standing in their way is a final audit and approval, by you. Unfortunately, after only 5 minutes of looking at the API, you’ve found issues and need to report them. Your goal is to bring visibility to these vulnerabilities in their API by finding the flags for each scenario. Good luck on your flag hunt and we hope you enjoy learning all about modern web APIs.

Note: The IPLRA is not real and we made it up.

SETUP:

To get set up for the flags, carefully follow the steps below.
You will need switch users. Log into the VM with the following user.

The username, password and VM location are located on Canvas.

 

Run this at the terminal to start the API

$ ./StartContainer.sh

project_apisecurity.json is available in the /home/apisec/Desktop folder. Put all flags in this file and submit it as your final deliverable.

To access the Web API open Chrome in the VM and navigate to this URL. This is the Swagger documentation page that describes the API and allows for testing:

http://localhost:8080/swagger/index.html

_*Note: You can also click the “Swagger UI” bookmark in _Chrome

******GATECH_ID IS A REQUIRED HEADER******

NOTE: This is not the Georgia Tech Username, it is the GTID that you can find using the steps in the Quick Start Guide

Be very careful! When you copy and paste be sure to strip off all leading spaces or special characters.

Submission Details:

File submission instructions:

This project needs to be submitted via gradescope. Navigate to the course in Canvas, click ‘Gradescope’, click ‘Project API Security’ and submit there.

The contents of the submission file should be the following. There is a project_apisecurity.json file in your vm with a template set up, or you can copy-paste this to your newly created project_apisecurity.json file elsewhere and replace the placeholders with the flags you retrieve from each relevant task.

Note: You can use TextEdit or Vim to create and edit this file. Do not use LibreOffice or any Word Document editor. It must be in proper JSON format with no special characters in order to pass the autograder and these Word Document editors are likely to introduce special characters.

If you can’t find the file in the VM just copy this format below:

{

“flag1”: “<copy flag 1 here>”,

“flag2”: “<copy flag 2 here>”,

“flag3”: “<copy flag 3 here>”,

“flag4”: “<copy flag 4 here>”,

“flag5”: “<copy flag 5 here>”,

“flag6”: “<copy flag 6 here>”,

“flag7”: “<copy flag 7 here>”,

“flag8”: “<copy flag 8 here>”

}

An example of what the submitted file content should look like:

{

“flag1”: “4ec60c3e084d8387f0f33916e9b08b99d5264a486c29130dd4a5a530b958c5c0f1faeaca2ce30b478281ec546a4729f629b531a86cb27d86c089f0c542”,

“flag2”: “f496d9514c01e8019cd2bc21edfeb8e33f4a29af14a8bf92f7b3c14b5e06c5c0f1faeaca2ce30b478281ec546a4729f629b531a86cb27d86c089f0c442”,

“flag3”: “b621bba0bb535f2f7a222bd32994d3875bcfcad651160c543de0a01dbe2e0c5c0f1faeaca2ce30b478281ec546a4729f629b531a86cb27d86cf0c49542”,

“flag4”: “f38e2cafb43ab4a0a647a8b08fc97bca25aa7cfb517029d5dd02faf49bff5c5c0f1faeaca2ce30b478281ec546a4729f629b531a86cb27d86c08c49542”,

“flag5”: “1711ee5eb85b9020d1f4193ee6d884abd12a2eadc4890d28c490ae0c36446c5c0f1faeaca2ce30b478281ec546a4729f629b531a86cb27d86c08949542”,

“flag6”: “1711ee5eb85b9020d1f4193ee6d884abd12a2eadc4890d28c490ae0c36446c5c0f1faeaca2ce30b478281ec546a4729f629b531a86cb27d86c08949542”,

“flag7”: “1711ee5eb85b9020d1f4193ee6d884abd12a2eadc4890d28c490ae0c36446c5c0f1faeaca2ce30b478281ec546a4729f629b531a86cb27d86c08949542”,

“flag8”: “f38e2cafb43ab4a0a647a8b08fc97bca25aa7cfb517029d5dd02faf49bff5c5c0f1faeaca2ce30b478281ec546a4729f629b531a86cb27d86c08c49542”

}

Table of contents

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FLAG 1: Swagger Intro (10 pts)

This flag will introduce you to basic API functionality using a documentation and test harness tool called Swagger. Swagger is a very popular tool used to develop and test web APIs and has plugins/modules in most programming languages. You can learn more about Swagger here: https://swagger.io/

You’ll need to leverage Swagger (or any other http tool you desire such as curl or Postman) to determine how the API is configured and what endpoints to invoke to earn this flag.

Warning: The site doesn’t use file storage or a database, all data is stored in memory. If you crash the web API or restart the VM, any data you have created/modified will have been lost and you’ll need to begin at step 1.

To earn your flag you must perform the following actions by making API calls.

Hints:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FLAG 2: Stolen Credentials (15 pts)

In order to get this flag you need to create a new reviewer in the system. Unfortunately, the developers locked down this functionality some time ago so you’ll need an auth token in order to perform it. You read in the newspaper last week that Programming Reviews LLC had a big data breach so there is a good chance you can come across some credentials.

To earn your flag you must perform the following actions.

Hints:

Include your flag2 into the json file and now onto Flag 3!

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FLAG 3: JWT Intro (15 pts)

Now that you’ve used an Auth token we’re going to dig a bit deeper into JWT (JSON Web Tokens). This flag is simple and designed only to get you acquainted with how JWTs are constructed. There are numerous resources to help you work with JWTs, one we recommend is https://jwt.io/ but you are not required to use this site for the project. Choose any library, tool or site you wish to inspect and construct JWT tokens.

To earn your flag you must perform the following actions.

Hints:

The next few flags will require some trial and error and a bit of research on your part to succeed. Your task is to craft JWT tokens such that you can use the token to successfully authenticate and earn your flag.

 

 

FLAG 4: Hack JWTs – #1 (15 pts)

You are a PHP ninja! You can’t get enough of this language. When you learned that others hate it and gave it bad reviews you felt the need to “correct the situation”. You’ve learned of an API that allows you to delete reviews. Muhahahah! The problem is that only the site moderator can do this and you don’t have his credentials. This has not stopped you in the past.

To earn your flag you must perform the following actions.

Hints:

 

 

 

 

 

 

FLAG 5: Hack JWTs – #2 (15 pts)

You’ve learned about a new experimental programming language that is TOP SECRET! This language only requires 1 single keyword to find a polynomial time algorithm to solve any NP-hard problem! You want the 1 million dollar reward for solving this problem and thus need access to this programming language. Find the language.

To earn your flag you must perform the following actions.

Hints:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FLAG 6: Hack JWTs – #3 (10 pts)

You’ve been informed that the system has a weak key vulnerability that can be decrypted using a brute-force attack. The weak key corresponds to the employee ID of one of the developers who developed the code, assuming that no one could guess the employee ID.

A friendly employee in the company has leaked the pattern for the employee ID number, which would consist of numeric digits and could be up to seven digits. Pass this weak key on to the flag6 API and you should get the flag.

To earn your flag you must perform the following actions.

Hints:

 

 

Flag 7: Broken Access Control (10 pts)

Like many other systems, this one also maintains user profiles or settings. These profiles may contain sensitive information that can be exploited by malicious hackers to gain unauthorized access to restricted areas of the system. Regrettably, the access control measures for protecting APIs, which ideally should be segmented based on role-based permissions, have been compromised in this system. Your objective is to reset the password of a system administrator user, thereby allowing you to log in as that user and exploit their access for your own entertainment and financial gain.

To earn your flag you must perform the following actions.

There’s a slight catch though. To accomplish this flag, you will need to write a script in any language you want because there are too many users to brute force this flag. There is only one user that will give you Flag 7, so think of this as a needle in a haystack. Some hints on what to account for in your script:

A successful flag will display a Congratulations message like the following:

Hints:

Resources:

 

 

Flag 8: Server Side Request Forgery (SSRF) (10 pts)

Rumor has it that the IPLRA hosts a hidden application on an HTTP web server running inside its containerized environment. This application is only accessible from within the container and cannot be directly reached from the outside world. However, vulnerabilities within the IPLRA API might allow an attacker to discover this application.

To earn your flag you must perform the following actions.

A successful flag will display a Congratulations message like the following:

Hints:

Resources:

 

 

 

 

 

 

 

 

 

API Security

Due: Mon Oct 6, 2025 11:59pmDue: Mon Oct 6, 2025 11:59pm

You will be learning about modern web-based API security principles in this project. These APIs are extremely popular ways of sharing data and integrating enterprise software systems. Understanding how they work and security best practices are paramount to a well rounded security expert.